Five things from the past working week that a UK board should know about, in the order I would raise them with a chair over coffee on Monday morning. It was a week of old problems arriving at scale: a record patch load, a government breach that keeps growing in the telling, and unpatched kit someone else owns. I have left out the noise. What survives has a decision attached.

1. Microsoft shipped a record patch load, and one flaw was already being used

On Tuesday 14 October Microsoft's monthly release fixed more than 1,400 vulnerabilities, the largest single month it has produced. Security Affairs counts 1,415 CVEs, though the exact figure varies by source because of how Microsoft now groups them. One is under active attack: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web, the warning Windows attaches to files from the internet. It needs a user to open something, which is exactly what phishing is for. The same release carries 59 potentially wormable flaws and a SharePoint privilege escalation (CVE-2026-102866).

For boards. Nobody can patch 1,400 things at once, so the question is how your team chooses. Ask what the rule is for ordering them, how long the exploited one will take to reach every laptop, and who signs off the risk of the rest.

2. The Legal Aid Agency breach is bigger than first described

The Ministry of Justice has published an update on the April 2025 attack on the Legal Aid Agency. BleepingComputer reports that the stolen records go back to 1978, with about 250,000 predating 2007. The data includes dates of birth, national ID numbers, criminal history, employment status and financial records, plus provider contracts and portal credentials. The MoJ says it has seen no evidence the data has been published, and is investing over £200 million in modernising legal aid digital services. Eighteen months on, the scope is still being established; SC Media summarises the same disclosure.

For boards. Ask how far back your own retained data goes, and why. Records you no longer need are a liability with no business benefit, and the length of this agency's disclosure is the cost of not knowing what you hold.

3. Hackers cooked the fridges of French supermarkets, and over 800 British controllers are on the open internet

Overnight on Sunday, attackers took over the refrigeration systems of hundreds of French supermarkets, forcing Danfoss-controlled units into a continuous defrost cycle and pushing temperatures as high as 50°C. The Grocer reports that Carrefour lost fridges in 80 of its 6,000 stores, at least 300 Intermarché and Netto outlets were hit, and Monoprix put its figure at 5% of more than 400 stores. The Register adds that Claroty had disclosed flaws in these controllers in August, and that many of the affected units were end-of-life or ran outdated firmware.

The UK angle comes from my own analysis at UK Cyber Defence, shared with The Grocer. Britain has few of that Danfoss model: we found 15 reachable on the internet, which are very unlikely to have been patched. But more than 800 refrigeration and building controllers of various makes, including Danfoss, Carel and Copeland, have their web login pages open to anyone who looks. Most sit on consumer broadband, rural broadband and machine-to-machine cellular networks rather than retail infrastructure, which points to a maintenance contractor taking the quickest route to remote access. The retailer's IT team frequently does not know the device exists. That is not a broken lock, but it is a front door on the street. France was not singled out for a grudge; it simply had the most reachable Danfoss estate in the world, roughly 2,967 devices.

For boards. Ask your facilities and estates leads for a list of every internet-connected controller in your stores, depots and offices, and who installed each one. Then ask whether the management pages can be reached from the open internet, and whether contractors' remote access has ever been reviewed. This is housekeeping rather than rocket science, and the owner is rarely the IT director.

4. A credential-stealing campaign hit more than 30,000 GitHub repositories

GitGuardian researchers observed a spike on 8 and 9 October in the GhostAction campaign. The Hacker News reports that about 1,900 compromised GitHub accounts were used to push malicious workflow files that steal build secrets: cloud credentials, npm, PyPI and Docker tokens, and AI provider keys. GitHub began blocking the workflow on 9 October, and later waves extracted nothing. Some victims had been hit before, which suggests secrets were never rotated.

For boards. Your software supply chain includes your suppliers' build pipelines and your own. Ask whether developer accounts use strong MFA, whether build secrets are short-lived, and how quickly you could rotate every one of them if told today.

5. Support ended this week for software many firms still run

On 13 October Microsoft ended support for Office 2021, Windows 11 24H2 Home and Pro, and the final year of extended security updates for Windows Server 2012 and 2012 R2, as Kocho's October roundup notes. They will keep running, but they will no longer be patched, in a month when Microsoft has just fixed 1,400 flaws.

For boards. Ask for the count of systems now past support, and a date by which each will be replaced or isolated. An accepted risk needs a name against it.

The thread that ties this together

Four of these five were not new in any technical sense. A shell flaw, an old government database, unpatched controllers, unrotated secrets: each was known, or knowable, well before it hurt. The expensive part is the gap between knowing and acting, and it grows as the volume of things to act on climbs. The Cyber Security and Resilience Bill returns to the Lords for Report Stage on 26 October, and will push more of this onto boards in writing.

What is the oldest known weakness in your estate, and who has been told in writing that it is theirs to close?