Singapore opened SICW 2026 with a blunt message: no government, company or country can see the full picture of today's cyber threats, and artificial intelligence is now raising the stakes for defenders and attackers alike. Speaking at the opening ceremony of the 11th Singapore International Cyber Week on 13 October 2026, Gwenda Fong, Commissioner of Cybersecurity and Chief Executive of the Cyber Security Agency of Singapore (CSA), called for stronger international cooperation as threats grow more complex. Her address came a day after Josephine Teo, Minister for Digital Development and Information and Minister-in-charge of Cybersecurity and Smart Nation, warned that trust in digital systems is becoming harder to sustain. This year's theme is "Cyber at a Crossroads: Shaping the New Cyber Order.

SICW 2026 Opens With a Warning

Fong, attending her first SICW as CSA chief, said Singapore's success has been built on being open and connected. That leaves its economy and society dependent on digital infrastructure, platforms and supply chains that extend well beyond its shores. Governments, infrastructure operators, cloud providers and cybersecurity firms each see part of the threat landscape, she said, but none sees all of it. "What appears to be an isolated incident to one organisation may in fact be part of a much larger campaign," Fong said. Assembling the picture is only half the challenge, she added. It must be done quickly enough to act before the adversary does.

AI Cuts Both Ways at SICW 2026

Fong said Singapore cannot simply keep adding analysts as threats grow in volume and sophistication. Instead, it wants AI to help defenders "see more, understand faster and to act more effectively." But adversaries can harness AI too, operating at greater speed and scale. The real test of AI cybersecurity, she said, is making sure the technology strengthens defences rather than tilting the advantage towards attackers. She also flagged a newer risk. As agentic AI systems gain access to data, applications and tools, they create new dependencies and vulnerabilities. "For years, cybersecurity has required us to understand what is connected to what. In an increasingly agentic world, we must also understand what can act on what," Fong said, pointing to questions of permissions and consequences.

SICW 2026 Puts AI Risks Into Practice

Rather than only discussing what AI could mean for security, CSA is testing it in practice this year. CSA is partnering with Google on an agentic AI cyber scenario exercise for international partners. It is working with the Singapore AI Safety Hub on a frontier AI governance workshop for officials from ASEAN and the wider Asia-Pacific. With Cloudflare, it is running hands-on training in AI-enabled cyber defence for critical infrastructure operators. Fong pointed to the ASEAN CERT Incident Drill, held since 2006, as proof that practising together builds the habits that matter in a real crisis.

The Trust Deficit Behind SICW 2026

On 12 October, Teo described what she called a paradox. At precisely the time when more trust is needed, trust is becoming harder to sustain. AI systems can make mistakes, be manipulated or behave in unintended ways, she said, and their capabilities are advancing faster than our understanding of the risks. Teo cited UNC3886's campaign against Singapore's telecommunications sector as a recent example of sophisticated actors targeting critical infrastructure. Ransomware and cybercrime remain pervasive, while strategic competition is forcing harder choices on technologies, suppliers, standards and interoperability. "We are willing to interact more, but find ourselves willing to trust less," she said. Without trust, Teo warned, businesses will hesitate to digitalise, citizens will be wary of new technologies, and countries will be less willing to stay open and connected.

"Accountability Cannot Be Outsourced"

Teo said industry must be a partner in securing the digital ecosystem, since it builds and operates much of the infrastructure economies depend on. That means shared standards, threat intelligence sharing, incident reporting and testing new technologies before deployment. On increasingly autonomous AI, she said human judgement, oversight or control must be retained where necessary. "Ultimately, accountability cannot be outsourced. Least of all, to machines," she said. She outlined steps already under way. CSA released its Securing Agentic AI Addendum earlier this year to guide organisations on securing autonomous AI systems. The agency is also working with industry to prepare critical infrastructure for the transition to quantum-safe systems. In addition, leading operational technology manufacturers and technology providers have committed to attain Singapore's Cyber Trust Mark.

What Comes Next

Teo said Senior Minister K Shanmugam would launch the Singapore Cybersecurity Strategy 2026, the country's updated national strategy, the following day, with partnerships remaining central to it. That approach will also carry into 2027, when Singapore assumes the ASEAN Chairmanship. Teo said Singapore will work with the bloc's 11 member states to strengthen collective cyber resilience, deepen practical cooperation and capacity building, and work more closely with industry. Estonia's Minister of Justice and Digital Affairs, Liisa-Ly Pakosta, also joined the week's proceedings for a fireside chat with Fong. Both leaders acknowledged that geopolitical competition is making cooperation harder. "Disagreement need not prevent dialogue, and competition need not preclude practical cooperation," Fong said. Teo put it simply: trust is not built through declarations, but through candid exchanges, competence and consistent action. Fong closed with a challenge to every delegate in the room: look beyond your own vantage point and find the people who can help you see the rest.

More than 500 police chiefs and law enforcement delegates from 59 countries gathered for the European Police Chiefs Convention 2026 to address how artificial intelligence is changing crime and creating new challenges for law enforcement. Held at Europol’s headquarters from September 28 to 30, the convention focused on AI, cybercrime, lawful access to data, disinformation, radicalisation and international cooperation. The event brought together representatives from 15 international organisations, including INTERPOL and the World Customs Organization. Europol Acting Executive Director Jürgen Ebner said organised crime has become increasingly digital and called for stronger national capabilities supported by shared European capabilities.

European Police Chiefs Convention 2026 Tackles AI-Driven Crime

A major focus of the European Police Chiefs Convention 2026 was AI in law enforcement and the changing role of artificial intelligence in criminal activity. According to Europol, criminals are using generative AI, deepfakes and autonomous agents to increase the scale and speed of their operations. These technologies are being misused in fraud, cybercrime, migrant smuggling and child exploitation. The convention also highlighted the potential benefits of AI for police agencies. Law enforcement can use the technology for faster data analysis, forensic investigations and intelligence gathering. However, participants said stronger international cooperation, investment in AI capabilities and regulatory frameworks will be needed as law enforcement agencies adopt the technology. [caption id="attachment_114531" align="aligncenter" width="600"] Image Source: Europol[/caption]

Deepfakes and AI Expand the Criminal Threat Landscape

The growing use of deepfakes was discussed as part of a broader shift in how criminals can use AI to support illicit activities. Europol said AI is amplifying criminal capabilities, with autonomous agents and generative AI allowing operations to be carried out at greater speed. The discussions placed these developments alongside existing concerns around online fraud and cybercrime. The convention did not frame AI only as a criminal threat. Law enforcement agencies are also looking at how the same technology can improve investigations and intelligence gathering. Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy at the European Commission, said the origin and control of technologies used for critical law enforcement capabilities are important considerations. She also highlighted the need to understand and reduce strategic dependencies affecting security infrastructure.

Lawful Access to Data Remains a Police Challenge

Another key topic was lawful access to data, alongside wider questions around information sharing and cross-border cooperation. Law enforcement representatives discussed how agencies can strengthen their ability to respond to increasingly digital criminal activity while working across jurisdictions. Wim Mijs, CEO of the European Banking Federation, also called for greater cooperation between banks, law enforcement, social media platforms and telecommunications companies to identify and stop online fraud before money is transferred. [caption id="attachment_114533" align="aligncenter" width="600"] Image Source: Europol[/caption] The discussions reflect the growing importance of cooperation between public authorities and private-sector organisations in responding to digitally enabled crime.

Radicalisation and Online Propaganda

The convention also examined the prevention of radicalisation, with law enforcement officials discussing online radicalisation, lone actors and changing forms of extremist activity. Europol said law enforcement faces challenges in identifying behavioural changes, dealing with encrypted communications and responding to rapidly changing propaganda. Algorithms and social isolation were also identified as factors that can amplify risks. Participants highlighted cross-border information sharing, community trust, platform accountability and early intervention as areas requiring attention.

Europol and Customs Agency Strengthen Cooperation

Police and customs representatives also discussed ways to disrupt cross-border criminal activity. Europol and the World Customs Organization signed a Joint Cooperation Action Plan for 2026–27 covering strategic analysis, information exchange and capacity building. The convention concluded with the presentation of the 2026 Europol Excellence Awards in Innovation. Law enforcement agencies from Spain, Denmark and the Netherlands received awards across three categories covering ethics, diversity and inclusion, innovative operations and technical solutions. The discussions at the European Police Chiefs Convention 2026 highlighted how law enforcement agencies are adapting to a threat environment increasingly shaped by digital technologies, AI and cross-border criminal activity.

Microsoft's Patch Tuesday September 2026 rollout has broken previous records, with the company addressing 974 CVEs across its product lineup in a single release. Two of these vulnerabilities were already being exploited in the wild before fixes became available, prompting quick action from federal cybersecurity authorities.  The sheer volume of this month's Patch Tuesday September 2026 release dwarfs recent months. Windows accounted for 723 of the fixed flaws, while the Office suite received patches for 222 issues, 111 of which affected Office 2016 specifically.  

Scale of Patch Tuesday September 2026 

SQL Server products saw 62 CVEs resolved, Developer Tools had 22, SharePoint Server received 16 fixes, Azure had 12, Skype for Business had 10, and Exchange Server accounted for 9. More than 110 of the vulnerabilities patched carry a critical severity rating, and nearly 90% of the total fall into three categories: privilege escalation, remote code execution, and information disclosure.   Factoring in fixes for 25 non-Microsoft CVEs, the combined total for this Patch Tuesday September 2026 cycle reaches 999 resolved vulnerabilities.  This release continues a pattern of escalating patch volumes from Microsoft in recent months — 457 CVEs were addressed in August, 663 in July, 220 in June, and 161 in May, making September's numbers a significant jump even against that backdrop. 

The Two Exploited Zero-Days 

Central to this month's Patch Tuesday September 2026 update are two CVEs that Microsoft confirmed had been exploited before patches were issued.  The first, CVE-2026-85880 (CVSS 7.8), is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component. It allows an attacker with local access to escalate privileges and obtain SYSTEM-level control. Microsoft's advisory states that an attacker who can execute code in a low-privilege AppContainer could exploit this vulnerability locally to escape the sandbox and elevate privileges on the affected system, with no additional user interaction required.  The second actively exploited flaw, CVE-2026-81963 (CVSS 7.8), stems from improper link resolution within the Windows Update Stack. Like the ALPC bug, it enables a local, authorized attacker to escalate privileges and gain SYSTEM access.  Both CVEs have since been added to the Known Exploited Vulnerabilities (KEV) catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Federal Civilian Executive Branch agencies now face a September 22, 2026 deadline to apply the relevant patches. 

Other Notable CVEs Worth Tracking 

Beyond the zero-days, several other CVEs patched in this Patch Tuesday September 2026 batch carry high severity scores and warrant prompt attention from Microsoft administrators: 

• CVE-2026-55007 (CVSS 8.1) — a double-free flaw in Microsoft Exchange Server enabling remote code execution 

• CVE-2026-80097 (CVSS 8.6) — improper authentication in Microsoft Authenticator allowing local privilege escalation 

• CVE-2026-69465 (CVSS 8.8) — missing authorization in Microsoft Office SharePoint permitting remote code execution 

• CVE-2026-65669 (CVSS 9.6) — an injection flaw in SQL Server enabling remote privilege escalation 

• CVE-2026-69525 (CVSS 9.8) — use-after-free in Windows Remote Desktop Services allowing remote code execution 

• CVE-2026-69595 (CVSS 9.8) — use-after-free in the Windows Services for NFS ONCRPC XDR Driver 

• CVE-2026-69730 (CVSS 9.8) — use-after-free in the Windows DNS server 

• CVE-2026-69829 (CVSS 9.8) — heap-based buffer overflow in Windows Shell 

• CVE-2026-72979 (CVSS 9.8) — use-after-free in the Windows DHCP Server 

Alongside the CVE fixes, Microsoft's Patch Tuesday September 2026 release also included new Servicing Stack Updates (SSUs), classified as critical, covering Windows Server 2012, Windows Server 2012 R2, and Windows 10 Version 1607/Server 2016.  Given the number of critical-severity CVEs and the confirmed exploitation of two privilege-escalation bugs, security teams are expected to prioritize this Patch Tuesday September 2026 rollout above routine monthly cycles, particularly for internet-facing Windows and Exchange deployments. 

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.