Weekly Security Watch

Important Developments

This week combines a Dutch regulatory milestone with rapid exploitation of platforms for collaboration, virtualization, AI and operational-technology. The recurring control failures are exposed services, delayed remediation, weak segmentation and excessive machine privileges.

1. Dutch Cybersecurity Act enters into force

On 15 August, the Dutch Cybersecurity Act implementing NIS2 entered into force. The NCSC now directs organizations in scope to register through MijnNCSC, moving Dutch NIS2 compliance from preparation into operational execution.

• Why you should care: This changes cyber governance from a readiness program into a live legal and supervisory obligation.
• Operational impact: Covered organizations need working ownership, registration, incident escalation and evidence of risk-management controls.
• Regulatory impact: Potential exposure under the Cybersecurity Act where registration, security measures or incident reporting are inadequate.
• Sector relevance: Essential and important entities across energy, transport, digital infrastructure, health, government, manufacturing and other covered sectors.
• Recommended actions: Confirm scope and registration; brief executives; test the reporting chain; document control ownership and supplier oversight.

Sources

NCSC Netherlands: Cybersecurity Act and registration

Further reading

2. Active macOS Screen Sharing exploitation confirmed in the Netherlands

NCSC-NL reported active exploitation of CVE-2026-65400 against systems exposing Screen Sharing on port 5900. In observed cases, attackers obtained root access and installed a Monero miner; CISA also added the flaw to KEV.

• Why you should care: This is locally confirmed exploitation with a clear exposed-service pattern, not a theoretical desktop vulnerability.
• Operational impact: Root compromise, unauthorized workloads and possible lateral movement from affected Macs.
• Regulatory impact: Incident assessment and notification may be required where regulated systems or personal data are affected.
• Sector relevance: Organizations with managed or unmanaged macOS systems, especially remote administration environments.
• Recommended actions: Patch supported macOS versions; block internet exposure of port 5900; hunt for miner activity and unauthorized root access.

Sources

NCSC-NL advisory NCSC-2026-0280

CISA KEV additions, 18 August

3. Four enterprise infrastructure flaws added to CISA KEV

CISA added exploited flaws affecting Microsoft IKE, SharePoint, VMware vCenter and macOS. The products span remote connectivity, collaboration, virtualization control and endpoint administration, giving attackers several high-value paths into enterprise estates.

• Why you should care: KEV status provides stronger prioritization evidence than severity scoring alone.
• Operational impact: Remote code execution, authentication bypass, device takeover and control-plane compromise.
• Regulatory impact: Exploitation evidence raises the standard for defensible patch prioritization and incident review.
• Sector relevance: All large enterprises; especially public sector, finance, healthcare, managed services and hosting.
• Recommended actions: Patch exposed and privileged systems first; verify successful installation; retrospectively review telemetry for compromise.

Sources

CISA: four KEV additions

SecurityWeek analysis

4. VMware vCenter exploitation reaches European victims

Active exploitation of CVE-2026-59310 has been associated with backdoor deployment and reverse-SSH tooling. Public reporting identified infections in multiple countries, with Germany and France among the most affected locations cited.

• Why you should care: Compromising vCenter can give an attacker leverage over many workloads through one management plane.
• Operational impact: Loss of administrative control, persistence in virtual infrastructure and possible ransomware deployment.
• Regulatory impact: Potential material incident and service-continuity implications for NIS2- or DORA-regulated environments.
• Sector relevance: Enterprises, cloud and hosting providers, financial services and public administration.
• Recommended actions: Patch vCenter; restrict management-plane access; review administrator events, new binaries and outbound tunnels.

Sources

SecurityWeek: exploited vCenter flaw

The Hacker News: exploitation overview

5. Zimbra command injection exploited in the wild

CERT Polska observed exploitation of CVE-2026-73570 in Zimbra Collaboration before version 10.1.20 when the optional SNMP package and notifications are enabled. The flaw permits unauthenticated operating-system command execution as the Zimbra user.

• Why you should care: Email servers combine sensitive communications, identity data and a trusted position inside the network.
• Operational impact: Mail access, persistence, credential harvesting and lateral movement.
• Regulatory impact: Possible GDPR and NIS2 consequences if communications or personal data are accessed.
• Sector relevance: Government, education, professional services and organizations running self-hosted email.
• Recommended actions: Upgrade to 10.1.20; verify the vulnerable configuration; use CERT Polska indicators to review logs and recently created files.

Sources

BleepingComputer: CERT Polska warning

SecurityWeek: active Zimzbra campaign

6. MLflow exploitation targets cloud credentials

Attackers are exploiting CVE-2026-64849, an unauthenticated server-side request forgery flaw in MLflow. CISA added the issue to KEV; reporting says vulnerable servers can be made to reach internal or cloud-metadata endpoints and expose credentials.

• Why you should care: AI engineering services may hold powerful machine identities but receive less security scrutiny than production platforms.
• Operational impact: Cloud credential theft, internal service discovery and follow-on account compromise.
• Regulatory impact: Data-breach and service-resilience obligations depend on the permissions and information accessible to the stolen identity.
• Sector relevance: Cloud, technology, data science, financial services and organizations deploying AI applications.
• Recommended actions: Upgrade to MLflow 3.15.0; remove public exposure; rotate potentially exposed credentials; review cloud audit and outbound-request logs.

Sources

SecurityWeek: MLflow credential theft

BleepingComputer: CISA exploitation warning

7. GitLab critical flaw exploited shortly after disclosure

NCSC-NL highlighted CVE-2026-19478, a critical GitLab GraphQL flaw, and SecurityWeek reported exploitation shortly after disclosure. The issue can affect public project and user data without authentication.

• Why you should care: Development platforms are both business systems and potential supply-chain launch points.
• Operational impact: Disruption or manipulation of repositories and development workflows; possible loss of project data.
• Regulatory impact: Software integrity and supplier-governance obligations may be relevant where affected code supports regulated services.
• Sector relevance: Software vendors, digital services, financial services and internal development teams.
• Recommended actions: Apply GitLab updates immediately; restrict external access; validate repository integrity and review unauthenticated GraphQL activity.

Sources

NCSC Netherlands vulnerability alerts feed

SecurityWeek latest news

8. AI-assisted scripts target Siemens industrial controllers

A joint US advisory describes an active threat using AI-generated exploitation scripts against internet-exposed or poorly protected Siemens S7 PLCs. The activity is focused on reconnaissance and capability development and is broader than Siemens alone.

• Why you should care: AI reduces the expertise and time needed to create working industrial-control attack tools.
• Operational impact: Possible process disruption, safety incidents, downtime, equipment damage and supply-chain effects.
• Regulatory impact: NIS2 resilience obligations are directly relevant to European operators of essential and important industrial services.
• Sector relevance: Manufacturing, energy, water, chemicals, food and commercial facilities.
• Recommended actions: Inventory PLCs; remove internet exposure; patch; strengthen access controls; monitor protocol, configuration and ladder-logic changes.

Sources

CISA joint advisory AA26-231A

SecurityWeek: Siemens PLC threat

Further reading

9. TrueConf servers used to distribute trojanized clients

CISA added two exploited TrueConf Server flaws to KEV. Reporting links exploitation to Head Mare, which compromised servers, replaced legitimate client installers and delivered PhantomCore malware through a trusted collaboration channel.

• Why you should care: The attack turns an internal software-distribution path into a supply-chain mechanism.
• Operational impact: Server compromise, malware deployment to users, privileged database access and persistent backdoors.
• Regulatory impact: Potential breach notification and supplier-risk consequences where client software reaches regulated environments.
• Sector relevance: Organizations using self-hosted collaboration platforms; energy, transport, technology and government.
• Recommended actions: Patch TrueConf; verify installer signatures and hashes; inspect servers for web shells; hunt endpoints that installed clients from affected servers.

Sources

SecurityWeek: exploited TrueConf vulnerabilities

The Hacker News: PhantomCore delivery chain

10. GeoTools zero-day scanning raises open-source exposure concerns

NCSC-NL warned of a CVSS 9.8 SQL-injection vulnerability affecting multiple GeoTools versions and stated that malicious actors were actively scanning for it. GeoTools is an open-source Java library, so exposure may sit inside applications rather than appear as a named infrastructure asset.

• Why you should care: The dependency may be present across internally developed and third-party geospatial applications.
• Operational impact: Potential application and data compromise depending on how vulnerable components are deployed.
• Regulatory impact: Supply-chain and vulnerability-management duties may apply where affected applications support regulated services.
• Sector relevance: Government, logistics, utilities, environmental services and geospatial software providers.
• Recommended actions: Use software composition data to locate affected versions; apply vendor updates; review exposed applications and database activity.

Sources

NCSC Netherlands alerts feed

NCSC Netherlands current alerts

Takeaways

Common Patterns

The week is defined by attack paths that cross trust boundaries. Remote administration, email, collaboration, virtualization, AI tooling and PLC management all sit close to privileged identities or critical operations. The root causes repeat: unnecessary internet exposure, slow remediation after fixes become available, weak segmentation, and service accounts or machine identities with excessive reach.

A second pattern is the conversion of trusted platforms into distribution or pivot mechanisms. TrueConf served poisoned client installers; vCenter offers leverage over many workloads; GitLab sits inside development workflows; MLflow can expose cloud identities. The business risk is therefore larger than the vulnerable product itself.

AI is relevant in two distinct ways. MLflow shows that enterprise AI infrastructure is now a target. The Siemens advisory shows AI assisting attacker capability development. Neither point justifies treating every AI-related alert as novel, but both justify adding AI and automation platforms to normal asset, identity and exposure controls.

Sector Insights

Critical infrastructure and manufacturing face the clearest physical and continuity risk from exposed PLCs. Technology and software organizations face development-chain risk through GitLab and service-distribution risk through TrueConf. Cloud and data teams should treat MLflow as privileged infrastructure. Public-sector, education and professional-services organizations running Zimbra should prioritize server-side hunting because user awareness controls do not prevent unauthenticated exploitation.

Regulatory Implications

For Dutch organizations, the Cybersecurity Act entering into force is the central governance development. Registration, incident escalation and demonstrable risk management now require operational ownership. NIS2-covered entities should connect vulnerability triage to service criticality, supplier dependence and reporting thresholds. DORA-regulated firms should apply the same evidence-led approach to ICT concentration, third-party access and recovery readiness. Where email, cloud credentials or collaboration data may have been accessed, GDPR assessment should run in parallel rather than after technical containment.

Strategic Recommendations

• Run a 72-hour exposure and ownership review covering Screen Sharing, Zimbra, vCenter, GitLab, MLflow, TrueConf and externally reachable industrial controllers.
• Prioritize active exploitation and business criticality over CVSS alone; verify patch success and perform retrospective compromise checks.
• Treat machine identities, cloud roles and management-plane credentials as privileged access; reduce permissions and rotate secrets after suspected exposure.
• Require suppliers and platform owners to provide evidence of patching, compromise assessment and recovery capability.
• Use a single executive escalation path linking security operations, legal, privacy, communications and service owners under the Dutch Cybersecurity Act.
  

Board-Level Narrative

The board-level issue is concentrated dependency on a small number of trusted control points. A compromised hypervisor manager, developer platform, email server, AI service or industrial controller can affect many services at once. The appropriate measure of resilience is not the number of patches applied, but whether the organization can rapidly identify exposed critical assets, determine whether exploitation occurred, contain privileged access and maintain essential operations. This week also marks a change in Dutch accountability: with the Cybersecurity Act in force, governance evidence, clear decision rights and tested reporting processes are part of the control environment, not administrative follow-up.

This overview was generated with AI assistance and has been verified and edited by a human editor. If you have spotted a factual error, please let us know in the comments.

The information contained in this Weekly Security Watch is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. CISO Community and CISO Platform Nederland assume no legal liability or responsibility for any damage resulting from either the use or inability to use the information included. This includes damage resulting from the inaccuracy or incompleteness of the information contained in this briefing.