National CERT/CC

The National CERT/CC @NITAUganda1 is the national point of contact for cybersecurity incident coordination Uganda & coordinates sub sector CERT teams in Uganda.

[National CERT/CC @CERT_UG]

Patch Now

OpenSSH "SSHole" (CVE-2026-123158): root on Alpine Linux within hours of disclosure. Update to 10.6p2.

CryptoPayment Gateway WP plugin: CVSS 10, no fix exists, wallet credentials exposed. Remove it today.

WordPress Core: even patching CVE-2026-119977 has a catch.

[National CERT/CC @CERT_UG]

Patch Now | Nov 5

WordPress Core (CVE-2026-119977): exploited during the upgrade process itself. Federal deadline tomorrow.

Rails Active Storage: crafted uploads can leak server secrets. Update to 8.1.4.1/8.0.5.2.

Apple (CVE-2024-27834): old flaw, new espionage campaign.

[National CERT/CC @CERT_UG]

Patch Now

Synology NAS: C3RB3R ransomware hitting outdated DSM builds. Update to the latest build for your line today.

GitLab: 1,000+ exposed servers still vulnerable to active exploitation weeks after patch.

BTCPay Server: $1.63M stolen from unpatched hot wallets.

[National CERT/CC @CERT_UG]

Patch Now | Nov 3

Cisco SD-WAN "KeyDrift" (CVE-2026-20127): encryption keys stolen since 2023. Patch, then rotate keys separately.

Langflow (CVSS 9.8): unauth RCE, Metasploit module exists. Update to 1.13.0.

s2Member WordPress plugin: public exploit out. Update now.

[National CERT/CC @CERT_UG]

Patch Now | Nov 2

Drupal Commerce Core (CVE-2026-118539): active attacks, 42,000+ stores exposed. Patch and audit orders.

Ivanti Connect Secure: 3 flaws chained to unauthenticated root. Update today.

Cisco ASA/FTD (CVE-2026-76418): unauth firewall crash, exploited.

[National CERT/CC @CERT_UG]

🚨 Cyber Pulse Issue 16 is out.

Worth noting on Binance: this is the second major exchange in two years brought down by one compromised employee device, not a platform flaw. Bybit in 2025, now Binance. Exchanges harden infrastructure, not always the humans with access to it.

[NITA-Uganda @NITAUganda1]

🚨CyberPulse Issue 16 | Cybersecurity Awareness Bulletin

This week’s biggest threat: Binance has confirmed a security incident affecting about $6.3 billion in assets, the largest crypto heist on record, overtaking the $1.5 billion Bybit theft. Nearly $3 billion has been frozen so far. The breach reportedly started with a compromised laptop belonging to one Binance engineer, which gave the attacker access to submit unauthorised withdrawals. TRM Labs and Chainalysis have linked the attack to North Korea with high confidence. One compromised laptop, billions gone.

Also flagged:

❗eMudhra CA Weak Keys: A script error caused this Indian certificate authority to generate weak intermediate CA keys. No publicly trusted certificates were affected, but it’s a reminder that even trust infrastructure has bugs.
❗GitHub Token Leak: A leaked GitHub token with publish access to widely used npm packages was found this week. One leaked token can threaten software that millions depend on.
❗ConnectWise Cloud Backup Breach: Attackers used stolen credentials and AI-assisted tools to reach downstream Microsoft 365 accounts, and the access keys they obtained reportedly still work even after the vendor’s fix.

💡Tip: After a major breach like Binance’s, scammers move fast with fake “compensation” or “verify your account” messages aimed at worried users. If you get a message claiming to be from an exchange after a breach, go directly to their official website instead of clicking any link.

Protect yourself:
✔️Secure work laptops and the accounts on them
✔️Keep access tokens and keys private, and replace them if exposed
✔️Ignore “compensation” messages and use official websites only
Read, share, help build a safer digital Uganda.

#CyberPulse #CyberSecurity #CERTUg #PoweredByNITAU

[National CERT/CC @CERT_UG]

Patch Now | Oct 29

Veeam Backup & Replication (CVE-2026-108142, CVSS 9.1): unauthenticated auth bypass. Also patch Veeam ONE and Linux Agent.

Oracle EBS (CVE-2026-101767): scanning started days after the patch. Apply Oct CPU now.

EDK II UEFI: 16yr PXE flaw, no tagged fix yet.

[National CERT/CC @CERT_UG]

Patch Now | Oct 28

Tailscale officially confirms nearly a dozen SSH flaws from last week's Tailworm report. Patches coming, keep mitigations in place.

Microsoft: emergency update distrusts compromised eMudhra cert keys. Apply today.

Apple: CoreGraphics spyware patch
#CERTUGCC

[National CERT/CC @CERT_UG]

Patch Now | Oct 27

F5 NGINX (CVSS 9.2 x3): heap overflow and use-after-free flaws across Plus, Open Source, Ingress. Patch or apply mitigations today.

Plex2Shell (CVSS 9.8): chained flaws, CISA deadline passed. Update now.

Cisco Nexus: 5 critical NX-OS flaws, root access.

[National CERT/CC @CERT_UG]

Patch Now | Oct 26 (weekend recap)

PHP2Shell escalated hard: millions of attempts, Mirai deployment, a government agency hit. Patch today.

Node.js "Node2Shell" (CVE-2026-111497): Brotli RCE, update now.

Tailscale: 11 unpatched flaws, no fix yet, tighten SSH rules.

#CERTUGCC

[NITA-Uganda @NITAUganda1]

After the keynote, @JonnnieT presented a cash prize to St. Lawrence, winners of the cybersecurity hackathon.

Congratulations to the team, and well done to all the young innovators helping to keep Uganda’s digital space safe. 🇺🇬

#NITAU #DigitizeUG #EastCon2026

[NITA-Uganda @NITAUganda1]

@JonnnieT Manager Governance and Risk at @NITAUganda1 delivered a keynote address at the 2026 EastCon Cybersecurity Symposium, hosted by @milimatechug at the National ICT Innovation Hub, Nakawa.

The symposium brought together government, industry, academia and students to talk about:

🛡️Emerging cyber risks and fraud
🛡️Digital trust and data protection
🛡️Building Uganda’s national cyber resilience

At NITA-U, we remain committed to keeping Uganda’s digital space safe and secure for everyone.

#NITAU #DigitizeUG #EastCon2026

[#BeeraKuGuard @besafeonlineug]

#PatchNow https://t.co/kz7jbZuXHO

[National CERT/CC @CERT_UG]

🚨 Cyber Pulse Issue 16 is live.

This week’s biggest story: PHP shipped an emergency patch for two critical flaws. The flaw lives in PHP itself, so even a secure site can be exposed.

Also: a hacker breached 100+ companies using AI agents for ~$50 each.

#CyberSafeUG #CERTUGCC

[NITA-Uganda @NITAUganda1]

🚨CyberPulse Issue 15 | Cybersecurity Awareness Bulletin

This week's biggest threat: PHP rushed out an emergency patch for two critical flaws dubbed PHP2Shell, and attackers started exploiting them just 19 minutes later. The flaw sits in PHP itself, so even a well-secured website can be exposed if the language running it hasn't been updated. With so much of the web, including WordPress, built on PHP, this one reaches far.

Also flagged:

❗AI-Powered Hacking: One hacker used autonomous AI agents to breach over 100 corporate websites, including Deere and Cummins, at about $50 per attack.
❗Burger King Japan Breach: Contact details, birth dates and regional data of over 11 million app users were exposed. Watch out for phishing messages.
❗OVHcloud Tool Hijacked: A compromised employee GitHub account was used to publish a malicious version of OVHcloud's official command-line tool.

💡Tip: This month, attackers hijacked a WordPress backup plugin's cloud service, a Siemens update tool and a cloud provider's own command-line tool, all software people already trusted. Before updating any tool that manages your infrastructure or backups, confirm the update came from your team, not a prompt you don't remember approving.

Protect yourself:
✔️Update PHP on all your servers now
✔️Verify updates before installing them
✔️Be wary of unexpected messages after a data breach

Read, share, help build a safer digital Uganda.

#CyberPulse #CyberSecurity #CERTUg #PoweredByNITAU

[NITA-Uganda @NITAUganda1]

@johnkennyadeya @NITAUgandaED @MoICT_Ug @GCIC_Tech @CERT_UG Thanks for reaching out @johnkennyadeya

This issue was noted on the night of October 20th to which the National CERT @CERT_UG picked up on and issued an immediate and prompt advisory.

Kindly follow @CERT_UG for more guidance.

[National CERT/CC @CERT_UG]

Patch Now | Oct 22

PHP2Shell: confirmed exploited 19 min after yesterday's patch. Update now.

GitLab (CVE-2026-110264, CVSS 10.0): second max severity RCE in 9 days, reaches back 12 years.

UpdraftPlus: hidden admin accounts planted via cloud service abuse.

[National CERT/CC @CERT_UG]

Patch Now | Oct 21

PHP ships emergency patch today for two critical RCE flaws (CVSS 9.2), leaked early. Update the moment it lands.

Palo Alto CVE-2026-0257: Qilin and INC ransomware still exploiting it, now pivoting to hypervisors.

LMCache: finally patched.

[Cyber Security News @The_Cyber_News]

‼️ PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches

Details: https://t.co/wGRtJ5SXXU

The PHP security team has warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release.

Both flaws carry a CVSS v4.0 score of 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC, giving website owners and hosting providers a short window to prepare. Public reporting links the upcoming fixes to CVE-2026-109618 and CVE-2026-109619.

Security firm watchTowr describes them as reported remote code execution vulnerabilities, which could allow attackers to run their own code on affected servers. However, PHP’s advance notice does not name the CVEs or explain how the flaws work. Reports suggest the vulnerabilities could affect PHP versions from PHP 5 onward.

#cybersecuritynews

[National CERT/CC @CERT_UG]

Patch Now | Oct 20

Oracle's October CPU is out today, 109 PeopleSoft patches alone. Review and patch.

Redis RESTORE (CVE-2026-25243): fixed since May, exploited since Oct 16. Update to 8.6.3.

Siemens Software Center: signed app smuggling malware via DLL sideloading.

[National CERT/CC @CERT_UG]

Patch Now | Oct 19

SiteGuard WAF (CVE-2026-106931): protects 1.5M sites, now under active attack itself. Patch now.

BeyondTrust (CVE-2026-102764): China-linked group exploited since 2023. Deadline today.

FortiOS/PEERSTITCH (CVE-2025-61624): deadline today too.