European Commission and Dutch government agencies breached by Ivanti EPMM flaw.

Summary

By the CyberWire staff

European Commission and Dutch government agencies breached by Ivanti EPMM flaw.

Government and cyber agencies around the world are issuing warnings about a wave of attacks targeting two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), the Record reports. The code injection flaws (CVE-2026-1281 and CVE-2026-1340) were patched late last month, and can allow attackers to acheive unauthenticated remote code execution. The US Cybersecurity and Infrastructure Security Agency (CISA) has added one flaw to its Known Exploited Vulnerabilities Catalog, while agencies in Canada, Singapore, and the UK warned of active exploitation.

The Dutch Data Protection Authority and the Judicial Council both confirmed breaches due to the flaws, with work-related staff data exposed. The European Commission also disclosed a breach of its "central infrastructure managing mobile devices," though it didn't name Ivanti EPMM directly.

Ivanti has issued guidance to help customers mitigate the flaws and detect post-exploit activity.

Meter: the end-to-end, secure enterprise network

Fragmented networks create security blind spots that are hard to patch. Meter takes a different approach, with an integrated enterprise networking architecture designed for security at the core, the edge, and everywhere in between. Learn how Meter protects every site by default at meter.com/security.

Singapore says China-linked hackers targeted all four of the country's telecoms.

The Cyber Security Agency of Singapore (CSA) has shared details on China-linked cyberespionage attacks that targeted all four of Singapore's major telecommunications providers, the Straits Times reports. The attacks, attributed to the PRC-affiliated threat actor UNC3886, breached local telecom networks operated by Singtel, M1, StarHub, and Simba Telecom. The CSA says the hackers were not able to disrupt services and did not access personal data.

In response to the attacks, the agency says Singapore launched its "largest coordinated cyber incident response effort undertaken to date," involving the CSA, the Infocomm Media Development Authority, the Centre for Strategic Infocomm Technologies, the Digital and Intelligence Service, the Government Technology Agency of Singapore, and the Internal Security Department.

Secure enterprise AI with Glean and Palo Alto Networks, live on Feb 26

Security leaders are under pressure to move fast on AI while keeping firm control over risk. On February 26 at 10:30 AM PT, join security leaders from Glean and Palo Alto Networks for a live fireside chat on securing enterprise AI. Learn what to secure across the AI lifecycle—from models and data to agents—and the practical guardrails Security should own to reduce risk without slowing the business.

BridgePay confirms ransomware attack.

Florida-based payment platform provider BridgePay has confirmed that a ransomware attack was responsible for system-wide outages that began last week, Infosecurity Magazine reports. Local governments across Florida and Texas reported disruptions to their online payment portals due to the incident. BleepingComputer notes that the outage is also affecting many private businesses and restaurants across the US.

BridgePay said in a statement, "Restoration efforts are actively underway, and all work is being conducted with care to ensure systems are brought back online safely and securely. We not have an ETA on when this process will be completed. Because of the nature of attack - ransomware - we are still in the early stages of this process. We do want to reiterate this was not a card data breach. No card data was compromised and any file that may have been accessed was encrypted."

Experience the Power of Community at RSAC 2026 Conference

RSAC™ 2026 Conference returns to San Francisco March 23–26, bringing together the global cybersecurity community for four days of expert insights, hands-on learning, and breakthrough innovation. Join thousands of practitioners, executives, and innovators as they tackle today’s toughest challenges and explore solutions shaping tomorrow. From cutting-edge ideas to immersive programs and vibrant networking, this is where meaningful progress happens. Register today and be part of the conversations driving cybersecurity forward.

Attacks, Threats, and Vulnerabilities

BeyondTrust warns of critical RCE flaw in remote support software (BleepingComputer) BeyondTrust warned customers to patch a critical security flaw in its Remote Support (RS) and Privileged Remote Access (PRA) software that could allow unauthenticated attackers to execute arbitrary code remotely.

Chrome extensions can use unfixable time-channel to leak tab URLs (CyberInsider) A bug in Chrome allows extensions to extract the full URL of any tab by exploiting timing differences in the declarativeNetRequest API.

Claude Desktop Extensions 0-Click RCE Vulnerability Exposes 10,000+ Users to Remote Attacks (Cyber Security News) A new critical vulnerability discovered by security research firm LayerX has exposed a fundamental architectural flaw in how Large Language Models (LLMs) handle trust boundaries.

Litigation, Investigation, and Law Enforcement

County pays $600,000 to pentesters it arrested for assessing courthouse security (Ars Technica) Settlement comes more than 6 years after Gary DeMercurio and Justin Wynn's ordeal began.

Inspector General Investigating Whether ICE's Surveillance Tech Breaks the Law (404 Media) DHS's inspector general is probing ICE's biometric and surveillance programs.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

State of the Net (Virtual and Washington, DC, USA, Feb 9, 2026) Annually attracting over 600 attendees, the State of the Net Conference provides unparalleled opportunities to network and engage on key policy issues. It is also the only Internet policy conference with over 50 percent of Congressional staff and government policymakers in attendance, making it the perfect setting to explore important, emerging trends. The State of the Net Conference Series is hosted by the Internet Education Foundation, a 501(c)(3) non-profit organization dedicated to educating the public and policymakers about the potential of a decentralized global Internet to promote communications, commerce and democracy. IEF works closely with leaders on Capitol Hill and in the private sector to host the most important debates in Internet policy.

New York Cybersecurity Summit (New York City, Feb 25, 2026) Maximize your networking opportunities by meeting with fellow industry executives and leading security experts at the upcoming 17th Edition of the New York Official Cybersecurity Summit on Wednesday, February 25, 2026. Secure your admission now! Use Code CSS26-CRA before February 12 for Free Admission.*

Philadelphia Cybersecurity Summit (Philadelphia, PA, Apr 15, 2026) Maximize your networking opportunities by meeting with fellow industry executives and leading security experts at the upcoming 9th Annual Philadelphia Official Cybersecurity Summit on Wednesday, April 15, 2026. Secure your admission now! Use Code CSS26-CRA before February 18 for Free Admission.*

Events

State of the Net (Virtual and Washington, DC, USA, Feb 9, 2026) Annually attracting over 600 attendees, the State of the Net Conference provides unparalleled opportunities to network and engage on key policy issues. It is also the only Internet policy conference with over 50 percent of Congressional staff and government policymakers in attendance, making it the perfect setting to explore important, emerging trends. The State of the Net Conference Series is hosted by the Internet Education Foundation, a 501(c)(3) non-profit organization dedicated to educating the public and policymakers about the potential of a decentralized global Internet to promote communications, commerce and democracy. IEF works closely with leaders on Capitol Hill and in the private sector to host the most important debates in Internet policy.

HIP Europe 26 (Frankfurt, Germany, Feb 10, 2026) Get ready to elevate your identity security skills at HIP Europe — your gateway to becoming a Hybrid Identity Protection (HIP) Hero. With the departure of original Active Directory experts and the rise of identity as the primary attack surface, the need for identity threat detection and response (ITDR) talent has never been greater. This event is the perfect opportunity to enhance your (or your team's) ITDR strategy and strengthen your organization's operational resilience.

Wild West Hackin’ Fest @ Mile High 2026 (Denver, Colorado, USA, Feb 11 - 13, 2026) More than just a conference, Wild West Hackin’ Fest (WWHF) is committed to offering high quality information security education to beginners and seasoned professionals alike. With reasonably priced training, conferences, hands-on labs, and workshops, WWHF lowers the barrier to entry for those seeking to enter into the world of information security. WWHF also offers a venue for those already established in the industry to share ideas, give back, and continue learning.

New York Cybersecurity Summit (New York City, Feb 25, 2026) Maximize your networking opportunities by meeting with fellow industry executives and leading security experts at the upcoming 17th Edition of the New York Official Cybersecurity Summit on Wednesday, February 25, 2026. Secure your admission now! Use Code CSS26-CRA before February 12 for Free Admission.*

AI SOC Summit (Tysons, Virginia, USA, Mar 3, 2026) For Security Teams who use AI and defend AI deployments: There is a lot of AI hype for Sec Ops. Come hang out as early adopters of AI dive into the good, the bad and the ugly . No vendor pitches, no AI theory. If you are trying out AI products for Sec Ops or building them in house, this is the place for you.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.09.26

Top stories.

European Commission and Dutch government agencies breached by Ivanti EPMM flaw.

Singapore says China-linked hackers targeted all four of the country's telecoms.

BridgePay confirms ransomware attack.

Notes.

Attacks, Threats, and Vulnerabilities

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events