Threats — writing by Peter Bassill
Threats · page 3 of 5
Breaches, campaigns and the vulnerabilities being used right now. 67 articles
-
FortiBleed: your firewall, turned into a wiretap
An update on the FortiGate exploitation story. SOCRadar's dismantling of FortiBleed shows 430,000 firewalls targeted and 110 million credentials harvested — by turning the appliance's own diagnostics into a credential tap. A board read, then the technical detail.
-
Prinz Eugen: the ransomware that takes your newest work first
A new Go-based encryptor takes your most recently modified files first, inverting the assumption that fast response limits the damage. One data-broker turned operator, a UK firm already on the leak site. A board-level read, then a full technical teardown.
-
The week in cyber — 15 to 19 June 2026
The NCSC calls it a contest, Parliament widens the net, and the actual ways in this week were an unpatched log server and a hijacked npm account.
-
Breached without being touched: the Klue attack and the case for digital sovereignty
Two security firms were caught in a data theft this week without an attacker going anywhere near their systems. The way in was a sales tool they had connected to their CRM themselves. This is the clearest argument I have for owning your stack that I have seen in a while.
-
The criminals have a product team now: The Gentlemen and the industrialised EDR-killer
A ransomware crew is shipping its affiliates a polished, standardised tool whose only job is to switch off your endpoint protection before the encryptor runs. The interesting part is not the malware. It is the business model.
-
The week in cyber — 8 to 12 June 2026
Oracle PeopleSoft zero-day hits UK universities, Qilin ransomware exploits Check Point VPNs, Microsoft patches a wormable kernel flaw, and two regulatory deadlines land within days of each other.
-
The week in cyber — 1 to 5 June 2026
A self-propagating worm hiding under Red Hat's npm name, two actively-exploited flaws at the edge and the core of the typical UK network, an Android zero-day in the June update, and the Cyber Security and Resilience Bill reaching its final Commons stage.
-
The week in cyber — 25 to 29 May 2026
GCHQ's director on a 'moment of consequence', the TrapDoor supply chain campaign reaching into AI coding assistants, the Cyber Security and Resilience Bill still grinding through Report Stage, and quantum quietly becoming a 2026 planning item.
-
The nine-second problem
An AI agent took nine seconds to delete a production database and its backups. The agent did what it was authorised to do. That is the finding.
-
The week in cyber — 18 to 22 May 2026
A self-spreading npm worm, a government letter that boards should read, and the second-quietest Patch Tuesday in two years. What the past working week looked like through a UK board lens.
-
The week in cyber — 11 to 15 May 2026
A self-spreading npm worm hit TanStack, Patch Tuesday had its quietest month in two years, the Cyber Security and Resilience Bill moved to Report Stage, and the ICO issued a five-step plan boards should actually read.
-
The week in cyber — 4 to 8 May 2026
The ICO fined South Staffordshire Water nearly £1m, the DSIT cyber newsletter quietly confirmed the regulatory direction of travel, and the Canvas extortion played out on a public timeline.
-
The week in cyber — 27 April to 1 May 2026
A learning platform serving thirty million people was breached, cPanel disclosed a zero-day that had been live in the wild for months, and April closed as the worst month for ransomware on record.
-
The week in cyber — 20 to 24 April 2026
NCSC and CISA named the Beijing-based outfit running covert botnets, the UK cyber chief told businesses to brace, and a sitting MP's website was hit with 142 million requests. A busy week.
-
Healthcare's reckoning
Three months of attacks have produced a clarifying set of numbers. £32.7m at Synnovis. 150,000 households warned at NHS Dumfries and Galloway. At least one patient death attributed. Healthcare is where concentration risk meets the lowest acceptable downtime threshold.