ENISA
enisa · A · active
https://www.enisa.europa.eu/news
EU Agency for Cybersecurity; threat landscape and policy reporting. /news lists press releases with dates. For substantive threat-landscape work, also drill into /publications (annual ENISA Threat Landscape, sector-specific reports). Slow-cadence policy source, when the feed is empty in the window, flag as 'no items' rather than treating as fetch failure. 2026-05-08 audit: WebFetch returned 5 dated posts incl. 'New CVE Numbering Authorities' 2026-05-06. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.enisa.europa.eu/news (then webfetch per-article URL; for substantive work drill /publications). AVOID: Slow-cadence policy source; empty window is 'no items', not a fetch failure. /news skews exercises/policy; drill /publications for the actual Threat Landscape reports.. | 2026-07-05 admiralty audit: A, EU cybersecurity primary authority; live, keep active. Slow-cadence/policy-skewed; empty window = 'no items', drill /publications for Threat Landscape. | 2026-08-23 audit: recipe healthy (WebFetch /news renders a real dated listing). Genuinely quiet, newest item 2026-08-06, nothing at all published 2026-08-09 to 2026-08-23. A multi-week gap is within this source's normal policy-skewed cadence; zero contribution here is not a transport signal. | 2026-09-15 intel run: enisa.europa.eu/news returned only a JS-shell/navigation HTML (Drupal SPA-style listing) via direct bridge fetch; no structured recipe available. No in-window item recovered. | 2026-09-30 intel run: `extract` on /news now returns the featured-news block. | 2026-10-02 (2026-10-02T0404Z-intel): the /news listing is undated; per-item dates need `extract` on each article (frontmatter date), one fetch per item. | 2026-10-17 (2026-10-17T0256Z-intel): S2: extract returns the news listing, and extract of each item carries its date.
Cited in 9 entries
Citation cadence
Citation days per ISO week (25 weeks of coverage span, total 7).
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)2026-10-21
- CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)2026-10-06
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)2026-09-10
- CVE-2025-25249, Fortinet FortiOS/FortiSwitchManager: unauthenticated CAPWAP heap overflow added to CISA KEV, actively exploited since July via the PivotC2 RAT2026-09-10
- Finland's NCSC-FI publishes an operational manufacturer checklist for the EU Cyber Resilience Act's 24h/72h/14-day/1-month reporting clock, two weeks before the 11 September 2026 go-live2026-08-29
- Cyber Europe 2026 tests the revised EU Cyber Blueprint and triggers the first live activation of the EU Cybersecurity Reserve2026-06-14
- ENISA onboards four new CVE Numbering Authorities under its CVE Root, and seven more move over from MITRE Root2026-05-09