Serial number: AV26-541
Date: June 2, 2026
On May 29, 2026, JetBrains published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-540
Date: June 2, 2026
On June 2, 2026, Siemens published a security advisory to address critical vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the web links provided, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-538
Date: June 2, 2026
On June 1, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices.
The vendor indicates that CVE-2025-48595 may be under limited, targeted exploitation.
Update 1
On June 2, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-48595 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-539
Date: June 2, 2026
On June 1, 2026, HP published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, once available.
Serial number: AV26-537
Date: June 2, 2026
On June 2, 2026, Samsung published a security update to address vulnerabilities in the following product:
The most recent security update resolves multiple identified vulnerabilities.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-536
Date: June 1, 2026
On May 29, 2026, Broadcom published a security advisory to address vulnerabilities in the following product. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-535
Date: June 1, 2026
On June 1, 2026, Qualcomm published a security bulletin to address vulnerabilities affecting Qualcomm products.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV24-401
Date: July 17, 2024
Updated: June 1, 2026
On July 16, 2024, Oracle published a security advisory to address vulnerabilities in multiple products. Included were critical updates for the following:
On June 1, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-534
Date: June 1, 2026
On May 27, 2026, Plesk published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-533
Date: June 1, 2026
On June 1, 2026, Ivanti published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-532
Date: June 1, 2026
On June 1, 2026, Mozilla published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-531
Date: June 1, 2026
Between May 25 and 31, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–530
Date: June 1, 2026
Between May 25 and 31, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26-529
Date: June 1, 2026
Between May 25 and 31, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-528
Date: June 1, 2026
Between May 25 and 31, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-527
Date: June 1, 2026
Between May 25 and 31, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-456
Date: May 12, 2026
Updated: June 1, 2026
On May 12, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
On May 21, 2026, Microsoft published an out-of-band (OOB) security update to address CVE-2026-45659, an additional vulnerability impacting Microsoft SharePoint Enterprise Server 2019, Microsoft SharePoint Server 2016 and Microsoft SharePoint Server Subscription Edition. The CVE was inadvertently omitted from the May 2026 Security Updates.
Open-source reporting indicates that CVE-2026-41089 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-462
Date: May 13, 2026
Updated: May 29, 2026
On May 13, 2026, Palo Alto Networks published security advisories to address vulnerabilities in the following products:
Update 1
On May 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to their Known Exploited Vulnerabilities (KEV) Database.
Impacted products for CVE-2026-0257:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.
Number: AL26-013
Date: May 29, 2026
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
On May 18, 2026, GitHub detected unauthorized access to its internal systems originating from a compromised employee deviceFootnote 1. The intrusion was facilitated by a maliciously modified version of the Nx Console Visual Studio Code extension (version 18.95.0)Footnote 2. The attacker successfully exfiltrated approximately 3,800 internal GitHub repositories, containing proprietary source code and internal configuration data. GitHub Enterprise Server customers are advised to follow vendors recommendations. No action is required for GitHub Enterprise Cloud clients.
In response to this security incident, and the release of the GitHub Security Notification, the Cyber Centre released AV26-512 on May 27, 2026Footnote 3.
The purpose of this alert is to increase awareness of the reported incident and to take necessary measures.
The Cyber Centre suggests the following actions:
~/.local/share/kitty/cat.py and related persistence (launch agents)In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topicsFootnote 4.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.
Serial number: AV26-526
Date: May 29, 2026
On May 28, 2026, Oracle published a security advisory to address critical vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-525
Date: May 29, 2026
On May 28, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-524
Date: May 28, 2026
On May 28, 2026, Mitel published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-523
Date: May 28, 2026
On May 27, 2026, Tanium published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-522
Date: May 28, 2026
On May 27, 2026, Erlang published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-521
Date: May 28, 2026
On May 26, 2026, Notepad++ published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-520
Date: May 28, 2026
On May 28, 2026, Zimbra published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-519
Date: May 28, 2026
On May 27, 2026, Veeam published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-518
Date: May 28, 2026
On May 27, 2026, Drupal published a security advisory to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.
Serial number: AV26-517
Date: May 27, 2026
On May 27, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-516
Date: May 27, 2026
On May 27, 2026, GitLab published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-515
Date: May 27, 2026
On May 27, 2026, Jenkins published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-514
Date: May 27, 2026
On May 27, 2026, Phoenix Contact published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, once available.
Serial number: AV26-513
Date: May 27, 2026
On May 27, 2026, Veeam published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-512
Date: May 27, 2026
On May 26, 2026, GitHub published security advisories to address vulnerabilities in the following products:
GitHub has stated that future patches and releases will be signed with a new public key, and customers will need to rotate to the new key before those patches and releases can be installed.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-511
Date: May 27, 2026
On May 26, 2026, Hitachi published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-510
Date: May 26, 2026
On May 26, 2026, ABB published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-509
Date: May 26, 2026
On May 26, 2026, Moxa published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-508
Date: May 25, 2026
On May 22, 2026, cPanel published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-507
Date: May 25, 2026
Between May 18 and 24, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–506
Date: May 25, 2026
[Control systems] CISA ICS security advisories (AV26–506)
Between May 18 and 24, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26-505
Date: May 25, 2026
Between May 18 and 24, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.
Serial number: AV26-504
Date: May 25, 2026
Between May 18 and 24, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-503
Date: May 25, 2026
On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-502
Date: May 25, 2026
Between May 18 and 24, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-492
Date: May 20, 2026
Updated: May 22, 2026
On May 20, 2026, Drupal published a security advisory to address a critical vulnerability in the following product:
Drupal has indicated that exploit attempts for CVE-2026-9082 are now being detected in the wild.
On May 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-9082 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.
Serial number: AV26-501
Date: May 22, 2026
On May 22, 2026, F5 published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-500
Date: May 22, 2026
On May 22, 2026, HPE published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-499
Date: May 22, 2026
On May 21, 2026, cPanel published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-498
Date: May 22, 2026
On May 21, 2026, Ubiquiti published a security advisory to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-497
Date: May 22, 2026
On May 21, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.