Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore

Alerts & Advisories

Provides alerts and advisories on emerging cyber threats, vulnerabilities, and preventive measures to help individuals and organisations stay secure online.

1270 items

23 October 2026

Critical Vulnerability in Node.js

Attackers can exploit a critical vulnerability affecting Node.js to execute arbitrary code remotely or disclose sensitive information on affected systems. Patch immediately.

23 October 2026

WizLearn Technologies LMS – Authentication Bypass Vulnerability Could Allow Unauthorised Access and Administrative Control

A vulnerability has been discovered in WizLearn Technologies’ Learning Management System (LMS). WizLearn Technologies has since implemented the necessary measures to address the vulnerability. Special thanks to the researcher and WizLearn Technologies for coordinating through CSA's Responsible Vulnerability Disclosure Policy.

22 October 2026

Critical Vulnerability in Fortinet FortiSIEM

Attackers can exploit a critical vulnerability in Fortinet FortiSIEM to execute arbitrary code. Patch immediately.

22 October 2026

Critical Vulnerability in GitLab

Attackers can exploit a critical vulnerability in GitLab to execute arbitrary code without authentication. Patch immediately.

21 October 2026

Critical Vulnerabilities in PHP (PHP2Shell)

Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately.

21 October 2026

Critical Vulnerabilities in F5 NGINX Products

Attackers can exploit critical vulnerabilities in F5 NGINX products to perform remote code execution or cause denial-of-service (DoS) conditions. Patch immediately.

21 October 2026

Security Bulletin 21 Oct 2026 [PDF, 2MB]

(opens in new tab)

20 October 2026

Advantech ADAM-3600 EdgeLink – Multiple Vulnerabilities including Remote Code Execution, Authentication Bypass, and Sensitive Data Exfiltration

Multiple vulnerabilities have been discovered in Advantech's ADAM-3600 EdgeLink remote terminal unit product. Advantech has released a security update to address these vulnerabilities. Special thanks to Advantech for coordinating the disclosure of these vulnerabilities with CSA.

20 October 2026

Critical Vulnerabilities in Next.js

Attackers can exploit critical vulnerabilities in Next.js to perform remote code execution. Patch immediately.

20 October 2026

Active Exploitation of Vulnerability in Ivanti Connect Secure

Attackers are exploiting a high-severity vulnerability in Ivanti Connect Secure to execute arbitrary commands. Patch immediately.