EU, Dutch government announce hacks following Ivanti zero-days

A wave of active cyberattacks is exploiting two critical Ivanti EPMM code-injection vulnerabilities (CVE-2026-1281 and CVE-2026-1340, CVSS 9.8) that allow device takeover without credentials; multiple national agencies (including Dutch authorities and the European Commission) reported unauthorized access to staff contact information, while CISA and other national cyber agencies confirmed exploitation in the wild and urged patching and log review.