$ ls writing/ -lt
writing.
Notes from the desk, not thought leadership. Specifics over slogans. If a piece couldn't earn its keep at a kitchen table, it didn't make it here.
Total · 201 pieces
Latest · 2026·10·10 Page · 1 / 9 Locale · en_GB
License · CC BY 4.0
2026·10·10
SonicWall SMA1000: the third time in four months SonicWall patched a third CVSS 10.0 hole in its SMA1000 gateway on 6 October; honeypots saw it probed within three days. It is the third unauthenticated SSRF in that interface since July. How the chain works, and what to do whether you run an SMA1000 or a TZ in the cupboard. vulnerability · sonicwall · remote access · small business · board
18 min
2026·10·10
The week in cyber — 5 to 9 October 2026 ASOS breached via a third party, FortiBleed still feeding ransomware crews, Atlassian exploited within two hours of a public PoC, a fresh NetScaler flaw, and hijacked ccTLDs yielding real certificates. weekly · governance · ned · board
5 min
2026·10·05
A board, no chair and a new address: the ICO becomes the Information Commission On 30 September the Information Commissioner ceased to exist and a board-led Information Commission took over, two days after the regulator left Wilmslow for Manchester. What changed, what did not, and why the chair is empty. regulation · governance · board · privacy · data protection · policy
13 min
2026·09·30
Half a million faces, one wrong alert: grading the BTP pilot In its first six months, British Transport Police scanned more than half a million faces at London stations and got one alert, which was wrong. Its own deployment register shows why: the watchlist, not the camera. What a pilot should prove before it grows. privacy · data protection · biometrics · governance
7 min
2026·09·30
The basics should not need a specialist: reading the 2026 cyber skills survey 57 per cent of UK businesses are not confident in at least one of nine basic security tasks, up from 49 per cent. What the government survey actually measures, why the rise may be good news, and why most of the fixes are defaults, not training. small business · cyber essentials · incident response · plain english
6 min
2026·09·29
Patching is step five: inside the NetScaler zero-days Attackers exploited two Citrix NetScaler ADC and Gateway flaws for weeks before fixes shipped on 27 September. How CVE-2026-88771 turns a log line into a root shell, who is affected, and why the NCSC lists patching fifth. vulnerability management · incident response · patching · threat intel · board
12 min
2026·09·27
Critical is not the same as urgent: what 70,686 CVEs in 2026 actually ask of you Of 70,686 CVEs published between 1 January and 22 September, 161 are known to be exploited. What NVD, EPSS, CISA's catalogue and Exploit-DB say about severity, deadlines and the software attackers use, and a one-line triage rule. vulnerability management · patching · threat intel · research · board
19 min
2026·09·27
The 999 lines held: Dyfed-Powys Police and the staff question Dyfed-Powys Police kept 999 and 101 running through a cyber incident and has so far found no evidence the public's data was accessed; staff data is still under investigation. What went right, what "technical difficulties" costs, and why your own people should never hear last. incident response · data protection · social engineering · governance · board
10 min
2026·09·26
The week in cyber — 21 to 25 September 2026 A BIG-IP zero-day already under attack, Revolut's second breach this month, prompt-injected AI agents at Salesforce, an AI phishing service dismantled by Microsoft and the Met, and a whisky retailer undone by a bolt-on app — five stories, all about trust handed to someone else. weekly · governance · ned · board
6 min
2026·09·18
Somebody else's problem: the lockbox codes, the reporting tool, and the supplier review A London property manager kept bank details, passwords and key-safe codes where a cloud analytics tool could read them; a vulnerability in that tool did the rest. Why "the cloud" is not a security decision, and a supplier review you can actually run and evidence. supply chain · data protection · governance · board · small business · cloud · plain english
19 min
2026·09·15
Aimed at a person, not a network: Iran's CHOSEN BRICK The NCSC, FBI and AIVD have published a joint advisory on CHOSEN BRICK, Windows malware Iranian state actors use to find, watch and expose dissidents, activists and journalists. A fake MRI result, a fake Norton, a Telegram bot, and a deliberate move from the work laptop to the home one. What it does, how to look for it, and what employers of people at risk should do this week. state-aligned · threat intel · spyware · social engineering · high-risk individuals · board
17 min
2026·09·12
The week in cyber — 7 to 11 September 2026 The EU’s vulnerability clock started, Microsoft shipped a record Patch Tuesday, CrowdStrike’s sensor became an escalation path, and Parliament said no to personal director liability — four things, each with a decision attached. weekly · governance · ned · board
5 min
2026·09·10
What shipped, and when did you know: the Cyber Resilience Act's clock starts tomorrow From 11 September 2026, anyone selling software or connected hardware into the EU has 24 hours from the moment they know a flaw is being exploited to tell a national CSIRT. What that means, what it does not yet mean, and why it reaches British firms that never signed up to it. regulation · governance · board · ned · supply chain · vulnerability management
22 min
2026·09·08
No personal liability, no change: the Cyber Security and Resilience Bill misses the one lever that works Peers asked why the Cyber Security and Resilience Bill lets executives off the personal liability hook. The Government said corporate fines are enough. Thirty years of watching boards tells me they are not, and here is why. governance · policy · board · regulation · ciso
9 min
2026·09·08
Trezor, ShipMonk, and the deletion that never happened Trezor's shipping partner was breached through a Metabase zero-day in August. This week the count reached 81,000, because 67,000 records came from 2019 to 2021 orders ShipMonk had confirmed in writing were deleted. A timeline, and what it teaches about supplier assurances. breach · supply chain · privacy · governance · board
15 min
2026·09·06
The unmarkable exam: the child-safety law no one is allowed to grade The Children's Commissioner told a Lords committee that children say the Online Safety Act has made "absolutely no difference" — and that she can't judge it, because Ofcom won't release the platforms' risk assessments. A law built to be unmarkable has already told you something. children · online safety · accountability · plain english · series
6 min
2026·09·04
The week in cyber — 31 August to 4 September 2026 Parliament writes a 24-hour clock into law while attackers work through the appliances at your network edge — four things from the week, each with a decision attached. weekly · governance · ned · board
6 min
2026·09·01
The consent nobody sought: Britain says no to the keys Someone finally asked the public — and across every party, Britain said it would not trust the state with the keys to its private life. A sidebar to the series that goes to the foundation the whole age-verification project rests on: a consent never sought, and never given. privacy · encryption · online safety · plain english · series
12 min
2026·08·31
The UK threat landscape: August 2026 The first of a monthly series. In August, 8.7 million airport customers, more than a thousand charities and a national police database lost data through exposed keys and open portals rather than exploits; a small power generator went dark; and the patch window shrank to days. threat landscape · monthly · ransomware · governance · board · cni
33 min
2026·08·30
The honeypot changes address Part 11: Meta settles the US child-safety case for up to $18bn and the UN comes out against outright bans — the week the ban model lost the argument. But the age check just moved from the platform to the app store, and the identity honeypot moved with it. children · online safety · plain english · series
6 min
2026·08·27
AI-generated harm against children in 2026 Revisiting the September 2024 post on deepfakes and children. UK law has criminalised creation of intimate deepfakes of minors. Schools have policies. The IWF reports massive growth in AI-generated CSAM. Voice clone fraud is mature. What has actually changed and what to do. privacy · children · ai · deepfake · update
8 min
2026·08·18
Struck down before the start: France's court reads the argument back Part 10: eighteen days before launch, France's Constitutional Council struck the under-15 ban down — on the grounds this series pressed: disproportion, and age verification with no guarantees for private life. A reprieve, but the redraft is already commissioned. children · online safety · plain english · series
7 min
2026·08·06
Gaming and online communities in 2026: what changed Revisiting the 2023 post on gaming, voice chat, and the communities that look least like social media. Three years of platform safety overhauls, AI moderation, AI voice in games, and the new financial and AI-companion risks that did not exist last time. privacy · children · gaming · update
7 min
2026·07·25
The first hour Part 3: a child has just told you they are being extorted over an image. What to do, in what order, in the hour that follows. Why not to pay, why not to block before you capture, what Report Remove actually does, and why the image is not the emergency. children · online safety · exploitation · plain english · series
10 min
2026·07·25
The first message is always kind Part 2: how contact with a child actually starts. Not a stranger saying something obviously wrong, but attention, aimed at a child having a bad week. The pattern, the four things that stop them telling you, and the sentence to say before anything happens. children · online safety · exploitation · plain english · series
9 min
$ grep -l tag:* | sort | uniq
Browse by tag — filtering applies to the list above.