Threats — writing by Peter Bassill
Threats
Breaches, campaigns and the vulnerabilities being used right now. 67 articles
-
The freezer that did not exist
While Europe's supermarket fridges were being warmed by attackers, I put a decoy refrigeration controller on the open internet to watch who came. Seven days, a thousand visitors, one patient four-hour session, and a factory password that was simply known.
-
The week in cyber — 2 to 6 November 2026
The NCSC's AI ransomware forecast, the Cyber Security and Resilience Bill clearing the Lords, a school estate undone by domain trusts, and a WordPress flaw exploited mid-upgrade.
-
The week in cyber — 26 to 30 October 2026
£130 million for AI-led cyber defence, PHP2Shell in a state-aligned toolkit, an unrevoked key behind the LiteLLM compromise, GCHQ's uncounted storage devices, and a reseller breach found by Stripe.
-
The week in cyber — 19 to 23 October 2026
One PHP bug took 32 UK government services offline, a trusted AI gateway shipped credential-stealing malware, and the ICO reminded us what a twelve-year-old Password1 costs.
-
The week in cyber — 12 to 16 October 2026
A record Microsoft patch load, a Legal Aid Agency breach that keeps growing, French supermarket fridges hacked while 800+ UK controllers sit on the open internet, GhostAction hitting 30,000 repositories, and support ending for software many still run.
-
SonicWall SMA1000: the third time in four months
SonicWall patched a third CVSS 10.0 hole in its SMA1000 gateway on 6 October; honeypots saw it probed within three days. It is the third unauthenticated SSRF in that interface since July. How the chain works, and what to do whether you run an SMA1000 or a TZ in the cupboard.
-
The week in cyber — 5 to 9 October 2026
ASOS breached via a third party, FortiBleed still feeding ransomware crews, Atlassian exploited within two hours of a public PoC, a fresh NetScaler flaw, and hijacked ccTLDs yielding real certificates.
-
The basics should not need a specialist: reading the 2026 cyber skills survey
57 per cent of UK businesses are not confident in at least one of nine basic security tasks, up from 49 per cent. What the government survey actually measures, why the rise may be good news, and why most of the fixes are defaults, not training.
-
Patching is step five: inside the NetScaler zero-days
Attackers exploited two Citrix NetScaler ADC and Gateway flaws for weeks before fixes shipped on 27 September. How CVE-2026-88771 turns a log line into a root shell, who is affected, and why the NCSC lists patching fifth.
-
Critical is not the same as urgent: what 70,686 CVEs in 2026 actually ask of you
Of 70,686 CVEs published between 1 January and 22 September, 161 are known to be exploited. What NVD, EPSS, CISA's catalogue and Exploit-DB say about severity, deadlines and the software attackers use, and a one-line triage rule.
-
The 999 lines held: Dyfed-Powys Police and the staff question
Dyfed-Powys Police kept 999 and 101 running through a cyber incident and has so far found no evidence the public's data was accessed; staff data is still under investigation. What went right, what "technical difficulties" costs, and why your own people should never hear last.
-
The week in cyber — 21 to 25 September 2026
A BIG-IP zero-day already under attack, Revolut's second breach this month, prompt-injected AI agents at Salesforce, an AI phishing service dismantled by Microsoft and the Met, and a whisky retailer undone by a bolt-on app — five stories, all about trust handed to someone else.
-
Somebody else's problem: the lockbox codes, the reporting tool, and the supplier review
A London property manager kept bank details, passwords and key-safe codes where a cloud analytics tool could read them; a vulnerability in that tool did the rest. Why "the cloud" is not a security decision, and a supplier review you can actually run and evidence.
-
Aimed at a person, not a network: Iran's CHOSEN BRICK
The NCSC, FBI and AIVD have published a joint advisory on CHOSEN BRICK, Windows malware Iranian state actors use to find, watch and expose dissidents, activists and journalists. A fake MRI result, a fake Norton, a Telegram bot, and a deliberate move from the work laptop to the home one. What it does, how to look for it, and what employers of people at risk should do this week.
-
The week in cyber — 7 to 11 September 2026
The EU’s vulnerability clock started, Microsoft shipped a record Patch Tuesday, CrowdStrike’s sensor became an escalation path, and Parliament said no to personal director liability — four things, each with a decision attached.