If you just remember one thing from this briefing…
A VPN used for supplier and engineer access was being exploited as a zero-day weeks before the government's own patch deadline for it passed.
CISA confirmed exploitation of an Ivanti Connect Secure flaw from at least 1 October, but only added it to its exploited-vulnerability catalogue with a 16 October deadline — already overdue by the time this reaches you. Ask one question: for every remote-access product your suppliers and engineers use, how long would exploitation run before anyone noticed.
Priority13 Oct
Ivanti Connect Secure zero-day added to the exploited-vulnerability catalogue
CISA confirmed in-the-wild exploitation of an authentication-bypass flaw (CVE-2026-104935, CVSS 8.6) in Ivanti Connect Secure dating to at least 1 October. The federal remediation deadline of 16 October has already passed. Connect Secure is widely used for VPN access by contractors, engineers and ground-handling suppliers.
So what: treat this as overdue, not merely important. Confirm Connect Secure's version and patch status today, and review who authenticates through it.
Priority19 Oct
Italy's aviation entities face a new NIS2 baseline security deadline
Italian aviation organisations registered under NIS2 since April 2025 became subject to baseline security measures from October 2026, per legal analysis published 19 October. The obligation sits alongside, not in place of, EASA Part-IS.
So what: if you operate in Italy or rely on Italian suppliers, confirm which baseline measures now apply and when your own transposition deadline falls.
Watch27–29 Oct
IATA holds its first dedicated Cybersecurity Summit
IATA's inaugural Cybersecurity Summit convened in Geneva from 27 to 29 October, covering supplier vulnerabilities, offensive AI and divergent national regulatory approaches. No outcomes or communique have been published yet.
So what: a first-of-its-kind summit on supplier risk signals the industry sees third-party exposure, not airline IT itself, as the open problem.
WatchOngoing
Ransomware groups continue to list aviation and aerospace suppliers
No new named victim was confirmed this fortnight, but recent leak-site listings against a US wiring-harness maker and a Brazilian aviation services firm show the supplier-first pattern persisting rather than fading.
So what: check whether any listed victim, or a comparable supplier type, sits in your own or your integrators' supply chain.
