Week of January 19, 2026: Fortinet Patch Bypass and EU Cybersecurity Act Overhaul

The week of January 19, 2026 brought reports that fully patched FortiGate firewalls were still being compromised through CVE-2025-59718, fresh CISA Known Exploited Vulnerabilities Catalog additions including an actively exploited Cisco Unified Communications flaw, and a European Commission proposal to overhaul the EU Cybersecurity Act for ICT supply chains. The same week also saw the UK NCSC warn of continuing pro-Russian hacktivist operations, a RansomHub claim against Apple assembly partner Luxshare, and the British Army's £279 million investment in a new cyber regiment base.

CISA Adds Actively Exploited Cisco Communications Flaw to KEV Catalog

On January 21, 2026, CISA added CVE-2026-20045, a Cisco Unified Communications code injection vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The flaw affects Cisco Unified Communications Manager and related products, and Cisco's advisory noted attackers could gain user-level access and escalate to root. Federal civilian agencies were required to remediate it under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize the fix given active targeting of enterprise telephony infrastructure. (CISA)

CISA Adds Four More Exploited Flaws, Spanning Vite, Versa, Prettier and Zimbra

On January 22, 2026, CISA added four more vulnerabilities to the KEV Catalog: CVE-2025-31125 in Vite, CVE-2025-34026 in Versa Concerto, CVE-2025-54313 in the eslint-config-prettier package, and CVE-2025-68645 in Synacor Zimbra Collaboration Suite. All four were confirmed under active exploitation, and the agency again required federal civilian agencies to remediate by the posted deadlines while recommending the same urgency for private-sector security teams managing exposed software supply chains and collaboration platforms. (CISA)

Patched FortiGate Firewalls Keep Falling to CVE-2025-59718

Starting around January 20, 2026, administrators reported that fully patched FortiGate firewalls running FortiOS 7.4.9 were still being compromised through CVE-2025-59718, a critical authentication bypass tied to FortiCloud single sign-on. Huntress and Arctic Wolf confirmed attackers used malicious SAML responses to create new admin accounts and exfiltrate configurations. On January 23, 2026, Fortinet acknowledged a "new attack path" against upgraded appliances and said a fix was in progress, urging customers to restrict management-interface access and rotate credentials. (Help Net Security)

EU Proposes Revised Cybersecurity Act to Lock Down ICT Supply Chains

On January 21, 2026, the European Commission proposed a cybersecurity package that includes a revised EU Cybersecurity Act aimed at securing ICT supply chains. The plan introduces mandatory derisking of European mobile networks from high-risk third-country suppliers, a streamlined European Cybersecurity Certification Framework allowing new schemes within 12 months, and amendments to the NIS2 Directive meant to simplify jurisdictional rules and ransomware-attack data collection, with ENISA taking an expanded coordinating role across member states. (Help Net Security)

UK NCSC Warns of Ongoing Pro-Russian Hacktivist Campaigns

The UK National Cyber Security Centre reported on January 21, 2026 that pro-Russian hacktivist groups, including NoName057(16), were continuing cyber operations against UK organizations and critical infrastructure. The group, active since March 2022, has repeatedly targeted local government websites with DDoS activity and coordinates through Telegram while distributing its DDoSia tool on GitHub. NCSC urged organizations to review defensive posture and strengthen denial-of-service resilience as the UK rolled out a £210 million Government Cyber Action Plan. (Help Net Security)

RansomHub Claims Breach of Apple Assembly Partner Luxshare

On January 21, 2026, the RansomHub ransomware-as-a-service group posted claims on its data leak site that it had breached Apple assembly partner Luxshare Precision Industry, alleging theft of 3D CAD models, circuit board design files, and engineering documentation tied to Apple, Nvidia, and other clients. Cybernews researchers said sample files appeared to include details on device repair and shipping arrangements between Apple and Luxshare. Luxshare had not confirmed the incident at the time of reporting. (Help Net Security)

British Army Commits £279 Million to Permanent Cyber Regiment Base

On January 19, 2026, the British Army announced a new permanent base for its 13 Signal Regiment, backed by £279 million in government spending. The regiment will relocate to Duke of Gloucester Barracks in Gloucestershire, hosting the Army's Cyber, Information and Security Operations Centre alongside new training and intelligence facilities. The project is expected to create 92 jobs, including 32 apprenticeships, with construction scheduled to begin in 2027 and completion targeted for 2030, following more than 90,000 cyberattacks against UK military networks over two years. (Help Net Security)