ANSSI (cyber.gouv.fr actualités)
anssi-cyber-gouv-actualites · A · active
https://cyber.gouv.fr/actualites/
2026-09-30 intel run (S3): France's national cybersecurity authority now publishes incident reports and guidance under cyber.gouv.fr/actualites, not only as CERT-FR avis; it hosted the DGFiP incident report on 2026-09-29. RSS https://cyber.gouv.fr/actualites/rss returned five dated items on the direct transport (newest 2026-09-29). Candidate: promote to active after 3 contributing runs. | 2026-10-24 (S2): RECIPE CHANGE: https://cyber.gouv.fr/actualites/rss now returns an Incapsula challenge page on the direct transport (the `feed` subcommand fails to parse it). Working recipe: `python3 tools/fetch_source.py extract https://cyber.gouv.fr/actualites/` returned the dated listing ('Publié le ...', newest 2026-10-12) but was served through the metered jina reader; WebFetch returned an empty page. Nothing in window. | 2026-10-29: promoted to active (promotion_due: cited by published entries from 3 or more distinct runs).
Cited in 9 entries
Citation cadence
Citation days per ISO week (18 weeks of coverage span, total 8).
- CVE-2026-76954 and CVE-2026-85101, Synology DSM (SA-26:19): a pre-authentication SQL injection in the Auth API (CVSS 9.8) allows arbitrary file read and write, and an rsync authentication bypass reads and writes files; fixed in DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13, no mitigation2026-11-11
- CVE-2026-121653, Ivanti Endpoint Manager before 2024 SU8: an unauthenticated SQL injection in the Core leads to remote code execution (CVSS 3.1 9.8), with a missing-authentication flaw in the Cloud Services Application that edits trusted EPM Core certificates (CVE-2026-121683, 9.4)2026-11-11
- CVE-2026-109593 and CVE-2026-109594, SonicWall GMS 9.5.2 and earlier: an unauthenticated network attacker may read internal GMS files (CVSS 3.1 9.1), and SonicWall says the end-of-life product gets no fix and has no workaround2026-11-05
- CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)2026-10-30
- CVE-2026-109618 / CVE-2026-109619, NetScaler ADC and Gateway: the PHP2Shell flaws reach the management GUI on the NSIP, management-enabled SNIPs and the cluster IP of every supported version; fixed in 14.1-73.49, 13.1-64.32 and the FIPS and NDcPP builds2026-10-23
- CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, the root-escalation step was patched on 2026-10-29 and CISA lists all three chain flaws (CVSS 8.6)2026-10-14
- ANSSI's REACTIV situation reports on French state data breaches: 99 since 1 August in the first, driven by Metabase CVE-2026-72898, infostealer credentials without MFA, IDOR flaws and supplier rebound, and 64 more in the second, which names the reuse of stolen secrets as the one recurring technique2026-10-02
- France's tax authority says it cut the intruders' accounts in June and July and found no data theft; it took the criminal's sale listing two months later to establish that 678,000 records had already gone2026-08-15
- FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions2026-07-13