Educate, Empower, Secure: Building a Cyber-safe Bhutan
Services We Provide
Bhutan Computer Incident Response Team (BtCIRT) is a part of the Government Technology Agency (GovTech). The BtCIRT is mandated to enhance cyber security in Bhutan by facilitating collaboration and information exchange among stakeholders, rendering assistance in capacity building and through sustained advocacy in computer security. Click here to learn more
Incident
Analysis
Security Event
Monitoring
Security
Awareness
Report Cybersecurity Incident
BtCIRT encourages the reporting of cybersecurity incidents as it enables us to better understand the scope and nature of cyber incidents in Bhutan. This will enable us to issue alerts or advisories on relevant threats, and assist a broader range of individuals and organisations.
Advisories
Critical Remote Code Execution in PHP (CVE-2026-109618 and CVE-2026-109619) – 20261021012
Severity CRITICAL Threat Category Vulnerability – Remote Code Execution (unauthenticated) Affected Platforms PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before ...
Read More →
Critical Remote Code Execution in Drupal Core and the Entity List Module (CVE-2026-108097 and CVE-2026-108099) – 20261020011
Severity CRITICAL Threat Category Vulnerability – Remote Code Execution Affected Platforms Drupal core Field UI module: 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, 11.4.0 ...
Read More →
Unauthenticated Authorization Bypass in the Avada (Fusion) Builder WordPress Plugin (CVE-2026-97670) – 20261013010
Severity CRITICAL Threat Category Vulnerability – Authorization Bypass / Code Injection (CWE-94) Affected Platforms WordPress sites running the Avada (Fusion) Builder plugin, all versions up ...
Read More →
Authenticated Remote Code Execution in Langflow via MCP Stdio Transport (CVE-2026-105740) -20261013009
Severity CRITICAL Threat Category Vulnerability – OS Command Injection / Remote Code Execution (CWE-78) Affected Platforms Langflow (langflow-ai) self-hosted AI workflow builder, all versions before ...
Read More →
Unauthenticated Stored Cross-Site Scripting in WPS Limit Login WordPress Plugin (CVE-2026-93622) – 2026092808
Severity HIGH Threat Category Vulnerability – Stored Cross-Site Scripting (CWE-79) Affected Platforms WordPress sites running the WPS Limit Login plugin (by NicolasKulka), all versions up ...
Read More →
Critical Authentication Bypass in Proxmox Virtual Environment 7.x and 8.0 (CVE-2023-54391) – 20260902007
Severity CRITICAL Threat Category Vulnerability – Authentication Bypass (CWE-304) Affected Platforms Proxmox Virtual Environment 7.0 – 7.4 and 8.0 with libpve-access-control 7.0-7 through 8.0.3 (all ...
Read More →
Global Cyber Security News
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
- High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
- Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
Vulnerability Notification
- VU#763488: Memory corruption vulnerabilities in PHP
- VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting
- VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
- VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
- VU#166125: Bisheng has authentication bypass vulnerabilities
Publications
REQUEST for EXPRESSION OF INTEREST(REoI) FOR (CONSULTING SERVICES – FIRMS SELECTION)
The GovTech Agency would like to invite eligible and interested Consulting Firms for the National Cybersecurity Risk Assessment deployment. Interested firms can submit Expression of ...
Read More →
17thDecember related Scams Alert
The Bhutan Computer Incident Response Team (BtCIRT), Cybersecurity Division GovTech Agency earnestly urges the general public to remain vigilant and avoid falling victim to National ...
Read More →
Cyber Security Awareness
Cyber Security Awareness Program The Department of Information Technology and Telecom, in its efforts to help promote conducive and safer cyber environment for work and ...
Read More →
National Cybersecurity Strategy of Bhutan
The Published National Cybersecurity Strategy of Bhutan for the year 2024 to 2029
Read More →