Threats — writing by Peter Bassill
Threats · page 2 of 5
Breaches, campaigns and the vulnerabilities being used right now. 67 articles
-
Trezor, ShipMonk, and the deletion that never happened
Trezor's shipping partner was breached through a Metabase zero-day in August. This week the count reached 81,000, because 67,000 records came from 2019 to 2021 orders ShipMonk had confirmed in writing were deleted. A timeline, and what it teaches about supplier assurances.
-
The week in cyber — 31 August to 4 September 2026
Parliament writes a 24-hour clock into law while attackers work through the appliances at your network edge — four things from the week, each with a decision attached.
-
The UK threat landscape: August 2026
The first of a monthly series. In August, 8.7 million airport customers, more than a thousand charities and a national police database lost data through exposed keys and open portals rather than exploits; a small power generator went dark; and the patch window shrank to days.
-
The week in cyber — 20 to 24 July 2026
A zero-click Russian email campaign, a SharePoint patch trailing its own exploitation, an AI agent that escaped its sandbox, and a council insider nobody was watching — four containment failures and the board questions they leave behind.
-
The week in cyber — 13 to 17 July 2026
Allied agencies named the FSB unit scanning UK routers, Microsoft shipped its largest patch on record with two flaws already exploited, the Cyber Security and Resilience Bill reached the Lords, and a poisoned npm package walked around this year's install-time defences.
-
wp2shell: WordPress core has an unauthenticated RCE. Patch now.
wp2shell (CVE-2026-63030) is an unauthenticated remote code execution flaw in WordPress core — not a plugin — patched on 17 July in 6.9.5 and 7.0.2. No public exploit yet, but one is coming fast. Why a core flaw is different, and why you should patch every site now.
-
Patch FortiSandbox by Sunday: when the security appliance is the hole
CISA has told federal agencies to patch two actively-exploited FortiSandbox flaws by Sunday — both unauthenticated, CVSS 9.1 remote code execution. The malware sandbox is the way in. Why the KEV is your real triage list, and why your security appliances are the target.
-
The TfL hackers were teenagers. Unusually, they were caught.
Two young Britons — Thalha Jubair, 20, and Owen Flowers, 18 — jailed five and a half years each for the 2024 Transport for London attack: £29m of damage, 148 systems down, done with social engineering. The UK's largest cybercrime case — and, unusually, they were caught.
-
The Qantas breach was a phone call: what we know
A living account of the Qantas breach, now pinned on a tech-support scam. No zero-day — a phone call to a contact centre exposed 5.7 million customers. What's confirmed, what's still unproven, and the help-desk controls that actually stop it. Updated as it develops.
-
Six hundred patches, two emergencies, and one broken Dell
Microsoft's July Patch Tuesday broke its record again — 622 CVEs, or 570 depending who's counting — then Microsoft blocked its own update on overheating Dells. The headline number is theatre; the real list is two exploited zero-days. A triage, not a panic.
-
The week in cyber — 6 to 10 July 2026
Whitehall credentials for sale after a Fortinet campaign that needed no zero-day, a voluntary pledge launched at Number 10 that most of the FTSE ignored, the Bank of England naming frontier AI as a stability risk, and npm about to break your build on purpose.
-
Three weeks with the door open
A cybercrime crew backdoored 25,000 websites using nothing but public exploits — then left its own server open on the internet for three weeks. The exposed working directory shows an adversary far less polished, and far more industrialised, than its victims imagined.
-
Ghosts and runners: living off GitHub
Attackers have stopped bringing their own infrastructure and started borrowing GitHub's — dormant accounts aged for years to blend in, and CI runners turned into backdoors. A look at the ghost-account and hijacked-runner campaigns, and the dull controls that would stop them.
-
The week in cyber — 29 June to 3 July 2026
A CitrixBleed sequel exploited within a day, on-prem SharePoint on a patch clock that runs out today, the police pricing UK ransomware and asking you not to pay, and the Cyber Security and Resilience Bill heading for the Lords.
-
The week in cyber — 24 to 28 June 2026
Cisco phone systems, an engineering PLM vault and the Linux kernel each turned into a route to root in the same week — against a CISA patch deadline that fell on Sunday.