Tuesday, 13 October 2026

Maximum-severity SonicWall SMA flaw is being exploited

Dark Reading reports that a maximum-severity server-side request forgery flaw in SonicWall SMA remote-access devices is under active attack. These appliances sit at the network edge and give staff and suppliers a route into internal systems, so one compromised unit can become a foothold behind the firewall. Exploitation has already started, which shortens the time between disclosure and intrusion. Organisations running SMA should first establish where the devices are deployed, including units managed by third parties. Apply the vendor's fixes or mitigations as soon as they are available and restrict management interfaces to trusted addresses. Review logs for unusual outbound requests and for new administrator accounts created since the flaw became known. If compromise cannot be ruled out, rotate the credentials and certificates the device handled, and treat the appliance as untrusted until it has been rebuilt. Brief the board on exposure now, so that an incident does not force the question later and the response is already agreed.

Our cyber security team can map remote-access exposure and support incident response on compromised edge devices.

Houthis and Saudi Arabia now trading strikes

Change since yesterday: after the Riyadh airport attack, Saudi Arabia and the Houthis are now striking each other, according to DW, while Euronews reports that the UAE is calling for stronger Gulf defence as allies back Riyadh. Yesterday's reporting centred on the casualties at the airport and Saudi Arabia's vow of a serious response. Today's reports show that response taking shape and a regional bloc forming around it. For organisations with staff, assets or visitors in the Gulf, the risk is no longer a single incident but a sustained exchange that can touch civilian infrastructure again. Review duty-of-care arrangements for travellers and local staff, confirm alternative routings that avoid Saudi airports where possible, and check that evacuation triggers are written down and understood. Confirm insurer positions on conflict exclusions before they are needed. Agree who has authority to suspend travel at short notice.

Our advisory and intelligence desk can turn Gulf developments into travel and evacuation decisions for your organisation.

New rebel coalition in eastern DR Congo as African Union talks open in Kigali

BBC News reports that a former president has been named leader of a new DR Congo rebel coalition, while Al Jazeera says the African Union is holding talks in Kigali as fighting continues in the east of the country. Read together, the reports point to a more organised armed opposition at the same moment that diplomacy is being tried. A single coalition leadership can make the front lines more coordinated, and it complicates any negotiation that depends on separate armed groups. For companies with mining, logistics, aid or contractor exposure in eastern DRC, the practical risk is disruption to road and air movement, local extortion and sudden changes in access to sites. Review movement protocols and the validity of evacuation plans for personnel in the region. Check which suppliers and transport routes rely on territory that could change hands. Set clear decision thresholds for pausing operations, and keep communication channels with local partners current.

Ship sinks in Black Sea drone attack, Bulgaria summons Russian ambassador

BBC News reports that a ship has sunk in a drone attack in the Black Sea and that Bulgaria has summoned the Russian ambassador. DW says Bulgaria condemned the attacks and describes Russia's war in Ukraine as spilling over into Eastern Europe. The reports do not settle every detail of the attack, but a diplomatic summons by an EU and NATO state is a significant step. It moves Black Sea shipping risk closer to the territorial waters and ports of a member state. Shipping, commodity and insurance teams should review vessel routing and port calls in the western Black Sea, and confirm crew welfare and emergency contact procedures with operators. Check whether war-risk cover terms have changed or may change at short notice. Corporate security teams with staff on board or in Bulgarian ports should agree escalation steps with the master and the local agent. Track official Bulgarian and NATO statements for any change in maritime guidance.

Our advisory and intelligence desk can brief maritime and logistics teams on Black Sea risk as it develops.

Nord Stream trial of Ukrainian attack suspect opens in Germany

DW reports that the trial of a Ukrainian suspect in the Nord Stream attack has begun in Germany. The case concerns sabotage of undersea energy infrastructure, and its proceedings will be watched closely by operators of pipelines, cables and offshore assets across Europe. A court setting can bring new detail on how such an operation was planned and carried out, which in turn informs how operators assess their own exposure. It may also raise political tension, since the defendant's nationality touches on wider questions about Ukraine's relations with European partners. Operators and their security teams should avoid drawing conclusions before evidence is heard, but they can use the trial as a prompt to review monitoring of subsea and coastal assets, vessel-tracking arrangements and incident reporting lines to authorities. Prepare a short internal note for management, so decisions can follow facts as they emerge in court rather than press speculation.

Terrorism suspect caught near Rotterdam over planned mass attack

NL Times reports that a terrorism suspect has been arrested near Rotterdam, and that a mass attack on a "concrete target" was being planned. The outlet's headline does not name the target, and no second outlet among today's coverage confirms the details, so the picture may change as authorities say more. An arrest at the planning stage suggests the threat was disrupted, but it does not show whether others were involved. Organisations with public-facing sites in the Rotterdam region, including hospitality venues, event organisers and transport operators, should not scale up their security measures on the strength of one report. They should, however, confirm that access control, bag policy and staff briefings are current, and that staff know how to report suspicious behaviour. Check that lockdown and evacuation procedures have been rehearsed recently. Follow statements from the Dutch authorities and be ready to adjust guarding levels if the target or threat level is clarified.

Our manned guarding teams can adjust access control and visible deterrence at public-facing sites at short notice.

Dutch organisation prepares lawsuit as Meta keeps selling AI glasses

NL Times reports that a Dutch organisation is preparing a lawsuit after Meta refused to stop selling its AI glasses. The article does not set out the legal grounds here, but the dispute puts wearable cameras and microphones in the public eye in the Netherlands. For security directors the issue is practical. Glasses that can record and process audio and video look like ordinary eyewear, which makes them hard to spot in boardrooms, negotiation rooms, hospitals, secure facilities and events. Organisations should decide now whether such devices are permitted on premises, and say so in visitor and contractor rules. Brief reception and guarding staff on what the devices look like and how to ask politely that they are removed. For sensitive meetings, combine a clear policy with technical sweeps of the room, because a rule alone does not detect a device. Monitor the court case, as a ruling could influence how privacy law is applied to wearables in workplaces.

Our TSCM specialists sweep sensitive meeting rooms for covert recording devices, including those that look like ordinary equipment.

Regional bus and train strike begins Wednesday, services uncertain

NL Times reports that bus and train services are uncertain as a regional transport strike begins on Wednesday. The outlet's headline does not say which regions are affected or how long the action will last, so organisations should check operators' own notices before relying on any timetable. A transport strike is not a security incident in itself, but it changes how people move and where they gather. Staff may arrive late or not at all, visitors may use cars and taxis, and stations and city centres can see crowding at short notice. Facilities and security managers should confirm which sites depend on public transport for staff, shifts and deliveries. Decide in advance whether to allow remote work, flexible start times or temporary parking, and tell staff by the end of today. Events planned for Wednesday should review entry flows, steward numbers and contact points for guests who cannot reach the venue. Keep a short log of disruptions so that plans can be adjusted if the strike is extended.