15:46

Nov 11, 2026

N-able Zero-Days, BroadWorks Exploitation, and the ClickFix Attack Chain

N-able Zero-Days, BroadWorks Exploitation, and the ClickFix Attack Chain This episode examines three immediate threats facing UK small businesses in November 2026. First, zero-day vulnerabilities in N-able N-central, the remote monitoring platform used by many managed IT providers, created a window of exposure across entire MSP client bases before hotfixes became available. Second, CISA confirmed active exploitation of a Cisco BroadWorks authentication bypass, affecting business telephony infrastructure widely deployed across UK enterprises, often without their knowledge. Third, the ClickFix social engineering technique has matured from simple clipboard tricks into sophisticated attack chains combining malvertising, typosquatting, and engineered consent to deliver remote access trojans. The episode provides specific questions to ask IT and telephony providers, technical mitigations for PowerShell-based attacks, and staff briefing guidance. Also noted: the NCSC’s new Cyber Adversary Simulation scheme, Microsoft’s patch Tuesday addressing 1,328 vulnerabilities including 45 critical remote code execution flaws, and Maersk’s confirmation of a suspected data theft incident. Chapters Introduction Mauven introduces three threat scenarios: vulnerabilities in the remote management tool used by IT providers, an actively exploited flaw in UK business phone infrastructure, and a social engineering attack that requires no technical vulnerability. N-able N-central Zero-Days: The Tool Your MSP Uses to Manage Your Systems Zero-day vulnerabilities disclosed in N-able N-central on 8-9 November created exposure across managed service provider client bases. Hotfixes released 11 November. Analysis of supply chain risk through MSP compromise, specific questions to ask providers about patch status and anomalous access monitoring. Call to Action Listener engagement request to follow the show and share with others who need these conversations with their IT providers. Cisco BroadWorks: CISA Confirms Active Exploitation CISA added a Cisco BroadWorks authentication bypass to its Known Exploited Vulnerabilities catalogue on 11 November, confirming in-the-wild attacks. Examination of BroadWorks deployment in UK business telephony, integration points with directory services, and questions to ask communications providers. ClickFix Has Grown Up: What Started as a Clipboard Trick Is Now a Full Attack Chain Evolution of the ClickFix social engineering technique from 2024 clipboard commands to sophisticated 2026 campaigns using malvertising, typosquatting, and fake verification prompts. Current payloads include remote access trojans and elaborate PowerShell scripts with animated progress indicators. Staff briefing guidance and technical mitigations through PowerShell execution policy and web filtering. Also Noted Today NCSC launches Cyber Adversary Simulation scheme. Microsoft November 2026 Patch Tuesday addresses 1,328 vulnerabilities including 60 critical and 45 remote code execution flaws. Fixes for Exchange Server sign-in and USB audio issues. Maersk confirms IT security incident investigation involving suspected data theft. Conclusion Three action items: contact IT provider about N-able N-central hotfixes, contact phone provider about BroadWorks patch status, brief staff on specific ClickFix attack mechanics. Links https://www.ncsc.gov.uk/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.huntress.com/ https://blog.talosintelligence.com/

14:25

Nov 10, 2026

Email Gateways Under Active Attack, Chrome Zero-Day Number Eight

Email Gateways Under Active Attack, Chrome Zero-Day Number Eight Active exploitation is confirmed against Barracuda Email Security Gateway appliances, with attackers gaining root-level access to devices that sit at one of the most sensitive positions in any network. Google has patched the eighth Chrome zero-day of 2026, a use-after-free vulnerability exploited in the wild. Russia’s Turla group is intercepting government Exchange email using new malware called Cereal, with implications for any UK small business in the public sector supply chain. Plus a note on SAP’s maximum-severity November patches. This briefing focuses on immediate operational steps: patching Barracuda ESG today, verifying Chrome updates across your entire fleet, reviewing Exchange forwarding rules, and closing the gap between security guidance and actual implementation. The common thread across all three stories is email infrastructure, the same attack surface organisations have been told to protect for fifteen years, and the persistent gap between published guidance and consistent application of basic security disciplines. Chapters Intro Opening summary of three active threat stories, all with immediate operational relevance to UK small businesses. Focus on Barracuda Email Security Gateway under active exploitation. Barracuda Email Security Gateway: Active Exploitation, Root Access Barracuda Networks confirms active exploitation of two vulnerabilities allowing root access to Email Security Gateway appliances. History of ESG targeting, operational implications of email gateway compromise, and immediate patching and log review requirements. CTA Call to action: follow the show and share the briefing, particularly the Barracuda item which is actively exploited. Chrome Zero-Day Number Eight Google patches eighth Chrome zero-day of 2026, a use-after-free vulnerability exploited in the wild. Discussion of the patch management gap in small business environments and practical steps to verify Chrome updates across managed and unmanaged devices. Turla’s Cereal Malware: Intercepting Government Exchange Email Russia’s Turla group deploys Cereal malware to intercept Microsoft Exchange email at government organisations. Supply chain implications for UK businesses working with public sector clients, and the case for reviewing on-premise Exchange security posture. SAP Maximum-Severity Patches SAP’s November 2026 security updates include four maximum-severity vulnerabilities in NetWeaver, Web Dispatcher, and Gateway. Relevant for mid-market professional services, manufacturing, and distribution sectors. The Pattern Analysis of the common thread across today’s stories: email infrastructure, browsers, and mail servers remain the same attack surface organisations have been told to protect for fifteen years. The gap between published guidance and consistent implementation of basic security disciplines. Outro Summary of practical takeaways: patch Barracuda ESG, verify Chrome updates, review Exchange configuration. Closing remarks.

16:34

Nov 9, 2026

Backup Software Exploited, Personalised Hotel Phishing, and Email Authentication Crackdown

Backup Software Exploited, Personalised Hotel Phishing, and Email Authentication Crackdown Today’s threat briefing covers three critical issues affecting UK small businesses. First, AhsayCBS cloud backup software has been actively exploited since 7 October 2026 through two chained vulnerabilities allowing unauthenticated remote code execution. The product sits in MSP infrastructure stacks, meaning businesses often don’t know they’re exposed. Second, a sophisticated phishing campaign targets hospitality customers with fake booking pages containing genuine reservation details including hotel names, dates, prices, and guest information. The personalisation defeats standard phishing detection advice. Third, Microsoft’s stricter email authentication enforcement is bouncing legitimate mail from domains with missing or misconfigured SPF, DKIM, and DMARC records. All three items share a common thread: they exploit infrastructure components that receive minimal scrutiny because they’re assumed to work correctly. Mauven provides specific, actionable steps for each threat, including questions to ask IT providers, staff briefing points, and DNS configuration checks using MXToolbox. Chapters Introduction Mauven opens with a provocation: backup software in MSP supply chains has been actively exploited since 7 October 2026, and most affected businesses don’t know. Today’s episode covers three threats targeting overlooked infrastructure components. AhsayCBS Exploited for Unauthenticated Remote Code Execution Two critical vulnerabilities in AhsayCBS cloud backup management platform have been actively exploited since 7 October 2026. The chained vulnerabilities (CVE-2026-105133 and CVE-2026-105134) require no credentials and provide SYSTEM-level access. Attackers deploy JSP webshells and cryptominers. Mauven explains why this specifically affects UK small businesses through MSP relationships and provides specific questions to ask IT providers. Call to Action Mauven encourages listeners to follow the show and share it with colleagues who need threat intelligence briefings. Hospitality Phishing with Personalised Fake Booking Pages A sophisticated phishing campaign documented by Netcraft uses genuine reservation data to create fake hotel booking pages. The lures include accurate hotel names, dates, prices, and guest information, defeating standard phishing detection advice. The operation includes 3D Secure bypass capabilities and targets multiple languages. Mauven addresses both hospitality businesses and organisations that book staff travel, explaining the specific payment-request red flag. Microsoft Email Authentication Crackdown Microsoft’s stricter enforcement of email authentication standards is bouncing legitimate mail from domains with missing or misconfigured SPF, DKIM, and DMARC records. Mauven explains what these authentication methods do, why the enforcement is correct policy, and provides step-by-step guidance for checking DNS records using MXToolbox, including warnings about forgotten sending services. Conclusion Mauven identifies the common thread: all three threats target infrastructure components that receive minimal attention because they’re assumed to work correctly. The AhsayCBS exploitation has been active for over a month against systems meant to be safety nets. Specific actions are summarised for each threat. Links https://www.huntress.com/blog/ahsaycbs-exploited-cve-2026-105133-cve-2026-105134 https://www.netcraft.com/blog/hospitality-phishing-campaign-booking-impersonation/ https://www.theregister.com/2026/11/09/microsoft-email-authentication-enforcement/ https://www.ncsc.gov.uk/guidance/email-security-and-anti-spoofing https://mxtoolbox.com/ https://www.actionfraud.police.uk/

17:23

Nov 6, 2026

Mobile Watering Holes, Refrigerator Botnets, and 7.3 Billion Phishing Threats

Mobile Watering Holes, Refrigerator Botnets, and 7.3 Billion Phishing Threats Nation-state actors are running mobile exploitation infrastructure with confirmed UK targeting. Commercial refrigeration controllers in supermarkets and cold storage facilities have been compromised and conscripted into spam botnets. Microsoft’s Q3 2026 email threat report documents 7.3 billion phishing attempts in a single quarter, with attackers shifting to SVG attachments and CAPTCHA-gated techniques that bypass most email filters. Meanwhile, DigiCert has disclosed a sixteen-month security lapse affecting one of the world’s largest certificate authorities. All four stories share a common thread: internet-facing systems with known vulnerabilities that remain unpatched and unmonitored. This episode examines APT29’s Poisoned Source campaign, which uses compromised analytics providers and watering hole attacks to deliver mobile exploits targeting unpatched iOS and Android devices. We analyse the operational reality of industrial control systems being weaponised for spam infrastructure, and explain why SVG attachments now represent a significant email security gap. The practical message is straightforward: the attackers are not finding clever new ways in, they are walking through doors that have been left open. Chapters Introduction Overview of three active, confirmed threats: nation-state mobile exploitation with UK targeting, commercial refrigerators conscripted into spam botnets, and Microsoft’s Q3 2026 email threat data showing 7.3 billion phishing attempts. APT29 Mobile Watering Holes and UK Targeting Detailed analysis of APT29’s Poisoned Source campaign, including supply chain compromise of Ukrainian analytics provider Plerdy, mobile-specific exploit chains targeting iOS and Android n-day vulnerabilities, and confirmed impersonation of a luxury UK hotel website near sensitive government institutions. Examination of watering hole operational mechanics and the risk to UK businesses from unpatched mobile devices accessing compromised sites. Call to Action Encouragement to follow the show and share with others who need threat intelligence. Refrigeration Controllers as Spam Infrastructure Analysis of SecurityScorecard research documenting Dixell and Copeland XWEB PRO refrigeration controllers being exploited to route spam. Examination of why industrial control systems represent entry points rather than targets, and the broader pattern of IoT and embedded devices being conscripted into proxy botnets. Microsoft Q3 2026 Email Threat Landscape Review of Microsoft’s Q3 2026 email threat report documenting 7.3 billion phishing threats, the shift from QR code attacks to SVG attachments with embedded JavaScript, CAPTCHA-gated phishing techniques, Microsoft Teams social engineering, and the XLoader malware campaign using obfuscated JScript files in RAR archives. DigiCert Sixteen-Month Breach Disclosure Brief coverage of DigiCert’s disclosure of a sixteen-month security lapse following a botched server migration, and the implications for businesses using certificates from major providers. Conclusion Summary of the common thread across all stories: internet-facing systems with known vulnerabilities that remain unpatched and unmonitored. Practical recommendations for mobile device management, operational technology security review, email gateway configuration, and provider contract terms. Links https://www.sekoia.io/en/poisoned-source-apt29s-multi-vector-watering-hole-campaign/ https://arstechnica.com/security/2024/11/russian-spies-jumped-from-one-network-to-another-via-wifi/ https://securityscorecard.com/research/refrigerator-botnet-exposed https://www.ncsc.gov.uk/collection/industrial-control-system-security https://www.microsoft.com/en-us/security/blog/2024/11/05/email-threat-landscape-report-q3-2024/ https://www.digicert.com/support/certificate-breach-notification

16:35

Nov 5, 2026

APT29 Mobile Watering Holes, Zyxel Zero-Day, and Device-Code Phishing

APT29 Mobile Watering Holes, Zyxel Zero-Day, and Device-Code Phishing Russian state-linked APT29 is running active watering hole attacks through compromised legitimate websites, including a UK hotel. The campaign targets mobile devices via silent JavaScript exploits requiring no user interaction beyond visiting the site. Separately, Zyxel has patched a zero-day in its SMB-focused GS1900 network switches after nearly 1,000 devices were compromised worldwide, with attackers stealing configuration files and credentials. The SkyW4lker phishing kit continues to bypass multi-factor authentication on Microsoft 365 accounts by abusing legitimate device-code authentication flows, with over 600 analyses recorded between June and October 2026. All three incidents exploit the gap between available patches or configurations and actual deployment. UK small businesses are advised to verify mobile device patch status, check for vulnerable Zyxel switches, and restrict device-code flow authentication in Microsoft 365 tenants. Additional intelligence covers AI-driven attack automation by VAPOR PANDA, North Korean financial crime, and an active XLoader campaign targeting business email. Chapters Introduction Overview of three current threat scenarios affecting UK small businesses, with focus on APT29’s use of legitimate websites as attack infrastructure. APT29 Mobile Watering Holes Analysis of Russian Foreign Intelligence Service-linked group’s watering hole campaign targeting mobile devices through compromised websites including a UK hotel, exploiting n-day vulnerabilities spanning iOS and Android across 2024-2026. Call to Action Listener engagement prompt. Zyxel GS1900 Zero-Day Coverage of zero-day vulnerabilities in Zyxel’s SMB-targeted network switches, with nearly 1,000 devices compromised before patches were available, resulting in credential and configuration theft. SkyW4lker Device-Code Phishing Examination of phishing kit abusing Microsoft’s legitimate device-code authentication flow to bypass multi-factor authentication, with 618 sandbox analyses recorded June-October 2026 and rising activity in Europe. Wider Intelligence Picture Brief notes on AI-driven attack automation by VAPOR PANDA, North Korean state-sponsored financial crime totalling $6.34 billion, and active XLoader campaign targeting business email. Closing Summary Synthesis of common themes across the day’s threats and three actionable questions for UK SMBs regarding mobile device patching, network infrastructure firmware, and Microsoft 365 authentication configuration. Links https://www.sekoia.io/en/apt29-mobile-watering-holes/ https://www.bleepingcomputer.com/news/security/zyxel-patches-zero-day-exploited-in-attacks-on-gs1900-switches/ https://any.run/cybersecurity-blog/skyw4lker-phishing-kit/ https://www.ncsc.gov.uk/guidance/token-theft

15:45

Nov 4, 2026

WordPress RCE, APT29 Zero-Click Mobile Attacks, and AI Supply Chain Crisis

WordPress RCE, APT29 Zero-Click Mobile Attacks, and AI Supply Chain Crisis The fourth of November briefing opens with an urgent WordPress remote code execution vulnerability now under active exploitation, affecting a significant portion of UK SMB websites. CISA’s KEV listing confirms mass scanning is already underway, making immediate patch verification essential. The second thread examines APT29’s large-scale watering hole campaign exploiting unpatched mobile devices through zero-click attacks, compromising iOS and Android systems invisibly. The main focus is Black October: nine AI developer platforms breached throughout October 2026, with stolen credentials fuelling LLMJacking attacks generating hundred-thousand-pound fraudulent charges. The Cursor marketplace incident saw malicious Claude Code extensions install persistent SSH backdoors surviving removal and reboots. Yoba campaigns use digitally signed legitimate executables to sideload cryptocurrency miners, evading signature-based detection. The briefing closes with the cPGuard supply chain compromise, where attackers weaponised trusted update infrastructure to distribute backdoors. Across all threads, the pattern is clear: exploitation succeeds not through sophisticated attacks, but through gaps between assumed security measures and actual implementation. Chapters Introduction Daily briefing overview: WordPress RCE under active exploitation, APT29 zero-click mobile attacks, and October’s systematic AI developer tool compromises. WordPress RCE: Patched Does Not Mean Protected CISA KEV listing confirms active WordPress exploitation. Mass scanning underway before official announcements. UK SMBs must verify patches directly with hosting providers rather than assuming updates are applied. Call to Action Follow the show for automatic briefings and share with UK business owners whose WordPress sites may be at risk. APT29 Mobile Watering Holes: Zero-Click Means Zero Warning Russian state actor APT29 runs large-scale watering hole campaign exploiting n-day mobile vulnerabilities on both iOS and Android. Zero-click exploitation requires no user interaction. Deferred mobile updates create exploitable gaps. Black October: AI Tool Supply Chain Crisis Nine AI developer platforms breached throughout October 2026. Stolen credentials enable LLMJacking attacks with six-figure fraudulent charges. Cursor marketplace distributed malicious Claude Code extension with persistent SSH backdoors. Yoba campaign uses digitally signed executables for DLL sideloading. Systematic targeting of AI tools creates downstream exposure for all organisations using compromised developers. cPGuard Supply Chain Compromise Attackers compromised cPGuard update infrastructure, distributing backdoors through legitimate autoupdate mechanism. Trusted security tool became delivery vehicle for malware. Closing Common pattern across all threats: exploitation succeeds through gaps between assumed and actual security implementation. Confirm rather than assume, ask rather than wait. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.wiz.io/blog/black-october-ai-developer-platforms-breached https://cloud.google.com/blog/topics/threat-intelligence/llmjacking https://www.microsoft.com/en-us/security/blog/2026/10/30/cursor-marketplace-malicious-extension https://expel.com/blog/cursor-claude-code-backdoor-analysis/ https://www.bleepingcomputer.com/news/security/cpguard-supply-chain-attack/ https://www.ncsc.gov.uk/collection/supply-chain-security

14:17

Nov 3, 2026

AI-Assisted Threats and Active Node-RED Exploitation: The Narrowing Window

AI-Assisted Threats and Active Node-RED Exploitation: The Narrowing Window The NCSC’s latest Artificial Intelligence and Cyber Intrusion assessment warns of AI-powered attacks on UK critical infrastructure within two years, but the more immediate concern lies beneath the headline. AI is already lowering barriers for less capable threat actors, making existing vulnerabilities more exploitable across all UK organisations. Meanwhile, CVE-2026-58115, a maximum-severity flaw in Node-RED, has been actively exploited since 30 October. Node-RED is embedded in industrial IoT gateways, building management systems, and operational technology controllers, often without end users knowing it’s there. The vulnerability allows unauthenticated access to admin interfaces, enabling attackers to deploy malicious payloads. This episode examines how these stories connect: the AI-assisted future the NCSC describes is not distant speculation but an acceleration of threats already in motion. For UK SMBs, the window to address fundamental security hygiene is narrowing rapidly. Chapters Introduction Mauven introduces two connected threat stories: the NCSC’s AI and cyber intrusion assessment and active exploitation of a Node-RED vulnerability. Both illustrate how the threat landscape is changing for UK SMBs. NCSC Artificial Intelligence Threat Assessment The NCSC warns of AI-powered attacks on critical infrastructure by 2028, but the buried finding matters more for SMBs: AI is already lowering barriers for less capable actors. Reconnaissance, phishing, and vulnerability identification are now accessible to anyone with commercial tools. Existing weaknesses in unpatched systems and legacy infrastructure are now more exploitable because AI finds them faster and more efficiently. Call to Action Mauven encourages listeners to follow the show and share it with colleagues managing infrastructure who would benefit from threat intelligence briefings. Node-RED Industrial Control System Exploitation CVE-2026-58115 is a maximum-severity unauthenticated access flaw in Node-RED, actively exploited since 30 October. Node-RED is embedded in industrial IoT and operational technology products, often without customer awareness. Attackers exploit the admin API to deploy malicious payloads, using three layers of encoding and compromised Microsoft infrastructure. Businesses must check for Node-RED presence, restrict admin interface access, and apply patches urgently. The Connection Between Stories The Node-RED vulnerability exemplifies what the NCSC’s AI assessment describes: automated tools exploiting internet-exposed systems in environments with poor inventory practices. AI-assisted attacks are not a future threat but an acceleration of current capabilities. The two-year warning applies to complex targets; simpler environments are already within reach of existing tooling. Closing Remarks Mauven reinforces that the NCSC assessment describes a trajectory already in motion. Fundamental security hygiene, patching, network segmentation, and multi-factor authentication, are not aspirational but baseline requirements. The cost of ignoring them is rising quickly. Links https://www.ncsc.gov.uk/ https://www.theregister.com/ https://vulncheck.com/ https://otx.alienvault.com/

13:24

Nov 2, 2026

Network Perimeter Under Active Attack: Ivanti, FortiMail, and GitLab

Network Perimeter Under Active Attack: Ivanti, FortiMail, and GitLab Three critical vulnerabilities affecting network perimeter devices are under active exploitation, with attacks beginning weeks before patches became available. Ivanti Connect Secure has been targeted with a zero-day exploit chain active since early October, affecting SSL VPN gateways widely used across UK professional services, NHS supply chains, and local government. FortiMail email security appliances face confirmed exploitation of an unauthenticated remote code execution flaw allowing attackers to write arbitrary files without credentials. Over a thousand GitLab servers remain unpatched against a maximum-severity vulnerability, with Alpine Linux forced to rebuild infrastructure from scratch following attempted compromise. The common thread is products that sit at the security perimeter, often managed by third parties and updated far less frequently than endpoint devices. For UK SMBs, the operational question is not whether to patch, but whether compromise occurred during the window when no patch existed. Additional threats include C3RB3R ransomware targeting Synology NAS backup infrastructure and the TIKTOUK credential harvesting toolkit systematically extracting secrets from WordPress installations. This briefing examines why network edge appliances represent a structural vulnerability and what patch cadence changes are now operationally necessary. Chapters Introduction Three significant threats involve products at the network edge: remote access gateways, mail security appliances, and code repositories. When attackers compromise infrastructure at this layer, they hold valid credentials on trusted systems before endpoint detection can respond. Ivanti Connect Secure Zero-Day Exploit Chain Ivanti patched two vulnerabilities in Connect Secure on 2 November 2026, but active exploitation began on 1 October. The five-week gap means organisations must assess whether compromise occurred before patches existed. The exploit chain provides meaningful control over SSL VPN gateways used across UK professional services, NHS contractors, and local government. Call to Action Brief listener engagement prompt encouraging subscription and sharing of the briefing. FortiMail Unauthenticated Remote Code Execution CVE-2026-104286 allows unauthenticated attackers to write arbitrary files to FortiMail systems via crafted HTTP requests. Multiple versions across the 8.0, 7.6, 7.4, and 7.2 ranges are affected. The vulnerability is especially concerning in MSP environments where a single compromised appliance can represent exposure across multiple client organisations. GitLab Server Exploitation and Supply Chain Risk Over a thousand internet-exposed GitLab servers remain unpatched against a maximum-severity RCE vulnerability. Alpine Linux rebuilt its entire GitLab infrastructure following attempted exploitation on 20-21 October 2026. The supply chain risk extends beyond direct users to any organisation using software built on compromised development infrastructure. Synology NAS Ransomware and WordPress Credential Harvesting C3RB3R ransomware is targeting Synology NAS devices, particularly dangerous because it compromises backup infrastructure alongside primary data. The TIKTOUK toolkit is conducting methodical credential harvesting from WordPress installations, extracting database configurations, AWS keys, and SMTP credentials from exposed configuration files. Closing Analysis Attackers systematically target products that form the security perimeter, exploiting the gap between operational trust and patch cadence. Network edge appliances require patch review processes that run at least as fast as workstation patching, a structural change most UK SMB environments have not yet implemented. Links https://www.ivanti.com/ https://www.fortinet.com/ https://about.gitlab.com/ https://www.shadowserver.org/ https://alpinelinux.org/ https://www.synology.com/ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ https://www.ncsc.gov.uk/

13:19

Oct 30, 2026

GitLab and Drupal Under Active Attack, Plus Supply Chain Breach in Cursor

GitLab and Drupal Under Active Attack, Plus Supply Chain Breach in Cursor CISA has confirmed active exploitation of a maximum-severity GitLab vulnerability allowing unauthenticated remote code execution, while Drupal Commerce Core faces a critical access bypass attack in the wild. Both flaws pose immediate risk to UK businesses and the agencies managing their infrastructure. Meanwhile, a supply chain compromise in the Cursor Marketplace on 29 October introduced a persistent SSH backdoor into developer environments, creating lateral risk for every client those developers serve. Today’s briefing examines the common thread connecting these incidents: downstream exposure through trusted third parties. Mauven walks through immediate verification steps for GitLab and Drupal users, explains how to check for the Cursor SSH key compromise, and frames the structural supply chain risk that UK SMBs consistently underestimate. Patches exist for the first two vulnerabilities. The question is whether your suppliers have applied them. Chapters Introduction Overview of today’s three incidents: actively exploited vulnerabilities in GitLab and Drupal Commerce Core, and a supply chain compromise in the Cursor Marketplace that hasn’t received sufficient attention. GitLab Remote Code Execution: CISA Confirms Active Exploitation CISA adds a maximum-severity GitLab vulnerability to its Known Exploited Vulnerabilities catalogue. The flaw permits unauthenticated remote code execution and is being exploited in the wild. GitLab’s widespread deployment among UK agencies and MSPs means exposure extends to every client relying on those providers. Immediate patch verification required. Call to Action Reminder to follow the show and share with colleagues who need threat intelligence. Drupal Commerce Core: Access Bypass Under Active Attack Drupal warns of active exploitation targeting a critical access bypass vulnerability in Commerce Core, affecting e-commerce functionality including customer data and order systems. The module’s prevalence across UK retail and public sector sites makes this a live incident risk until patches are confirmed applied. Supply Chain in Developer Tooling: The Cursor Marketplace Compromise Version 2.1.313 of the Claude Code extension in Cursor Marketplace was compromised on 29 October with a malicious loader that plants an attacker-controlled SSH key labelled ‘svc-telemetry’ and establishes persistent remote access. Developer machine compromise creates lateral risk to every client system those developers can reach. The Pattern Connecting Today’s Stories All three incidents share a common structure: downstream organisations are the primary victims through trusted supplier relationships. Supply chain risk in UK SMBs remains underestimated because patch compliance and security posture cannot be audited from outside without contractual requirements and active verification. Closing Actions and Sign-Off Three immediate actions: confirm GitLab and Drupal patch status in writing today, check authorised keys files for the Cursor compromise, and ask IT providers directly about their patch turnaround for actively exploited vulnerabilities. Patches exist; the question is whether suppliers have applied them. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/guidance/vulnerability-management https://www.drupal.org/security https://www.huntress.com/ https://www.binance.com/ https://www.ncsc.gov.uk/news/star-blizzard-campaign-targeting-uk-individuals-and-organisations

17:58

Oct 28, 2026

Node2Shell Exploitation, 123 Reg Breach, and Teams Attack Surge

Node2Shell Exploitation, 123 Reg Breach, and Teams Attack Surge CISA has added Node2Shell to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of a critical flaw in Node.js Brotli compression handling that enables remote code execution without authentication. UK domain registrar 123 Reg has disclosed a customer data breach attributed to sophisticated threat actors with suspected China nexus, exposing domain ownership records and billing information for hundreds of thousands of small businesses. Arctic Wolf has documented over 400 incidents involving Microsoft Teams external chat abuse for initial access, with attackers using fake IT support personas and device-code phishing to bypass multi-factor authentication. Additional coverage includes scanning activity targeting Oracle E-Business Suite vulnerability CVE-2026-101767 and technical analysis of Qilin ransomware operations targeting VMware ESXi infrastructure. Mauven provides actionable guidance on immediate patch verification, registrar account security, Teams federation controls, and phishing-resistant MFA deployment for UK small businesses. Chapters Introduction Overview of three critical UK threat developments: active exploitation of Node2Shell vulnerability, 123 Reg customer data breach, and widespread Microsoft Teams attack pattern. Node2Shell: CISA Confirms Active Exploitation Analysis of CISA’s KEV catalogue addition for Node2Shell (CVE-2026-76461), a critical Brotli compression vulnerability in Node.js enabling unauthenticated remote code execution. Guidance on patch verification, exposure assessment for UK web infrastructure, and managed service provider accountability. Call to Action Listener engagement prompt to follow the show and share with relevant contacts. 123 Reg Customer Data Breach Examination of 123 Reg breach disclosure, suspected China-nexus threat actor attribution, scope of exposed domain registrar data, and implications for UK small businesses. Actionable steps for credential rotation, MFA enablement, and domain security verification. Microsoft Teams External Chat Attacks Detailed analysis of 400+ documented incidents using Teams external chat for initial access, including email bombing tactics, fake IT support personas, and SkyW4lker device-code phishing kit bypassing standard MFA. Configuration guidance for Teams federation controls and phishing-resistant authentication. Oracle EBS and Qilin Ransomware Brief coverage of scanning activity targeting Oracle E-Business Suite CVE-2026-101767 and technical analysis of Qilin ransomware operations against VMware ESXi infrastructure, with supply chain risk considerations. Closing Summary of key actionable items: Node2Shell patch verification and Teams external access configuration review with IT providers. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://arcticwolf.com/resources/blog/microsoft-teams-external-chat-attacks https://www.123-reg.co.uk/ https://www.microsoft.com/security/blog/ https://www.oracle.com/security-alerts/ https://www.sentinelone.com/labs/qilin-ransomware-analysis

15:12

Oct 27, 2026

PHP2Shell KEV, Teams Social Engineering, and LiteLLM Supply Chain Compromise

PHP2Shell KEV, Teams Social Engineering, and LiteLLM Supply Chain Compromise Today’s briefing covers three active threats exploiting trusted infrastructure. CISA has added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming in-the-wild exploitation linked to North Korea’s Lazarus Group. The campaign targets government, financial, manufacturing, logistics, and transportation sectors through unauthenticated remote code execution. Arctic Wolf’s analysis of over four hundred incidents documents how Microsoft Teams’ default external chat settings enable sophisticated social engineering attacks, with attackers creating fake IT support tenants to deliver malware or steal credentials. The third story examines the LiteLLM supply chain compromise from 21 October 2026, where a malicious PyPI package distributed stolen-credential payloads through Python startup hooks. All three attacks exploit legitimate systems working as designed rather than traditional vulnerabilities. The episode provides specific configuration guidance for Microsoft 365 Teams external access settings, PHP patching requirements, and credential rotation procedures for organisations potentially affected by the LiteLLM compromise. The common thread is that defence requires active auditing of what is enabled by default, not simply avoiding mistakes. Chapters Introduction Overview of three active threats targeting UK businesses: CISA’s KEV catalogue additions, Microsoft Teams social engineering, and LiteLLM supply chain compromise. PHP2Shell KEV Confirmed CISA confirms exploitation of CVE-2026-109618 and CVE-2026-109619, PHP vulnerabilities linked to Lazarus Group enabling unauthenticated remote code execution. Covers targeting priorities, small business risk through supply chains, and specific patching guidance for WordPress, Drupal, and Magento environments. Call to Action Listener engagement reminder to follow the show and share with business owners who need threat intelligence. Teams External Chat at Scale Arctic Wolf documents over four hundred incidents exploiting Microsoft Teams’ default external chat settings. Attackers create fake IT support tenants, manufacture email flooding to establish credibility, then deliver malware or steal credentials. Includes specific configuration guidance for Teams admin centre external access restrictions. LiteLLM Supply Chain Compromise Analysis of the 21 October 2026 compromise of LiteLLM version 1.107.0 through PyPI and container images. Malicious package used Python startup hooks to steal credentials automatically. Credential rotation guidance for affected environments. The Thread Connecting Today Examination of how all three threats exploit trusted systems working as designed rather than traditional vulnerabilities. Discussion of the gap between available guidance and implementation in UK SMB environments. Outro Summary of practical actions: verify PHP patching status, audit Teams external access settings, and rotate credentials if LiteLLM was deployed between 21-23 October 2026. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/microsoft-365-security-configuration-guidance https://www.microsoft.com/en-us/security/blog/ https://arcticwolf.com/ https://cyfirma.com/ https://www.ncsc.gov.uk/

14:18

Oct 26, 2026

PHP2Shell Exploited by Lazarus Group, Magento Skimmers Active, UK Biobank Breach Timeline

PHP2Shell Exploited by Lazarus Group, Magento Skimmers Active, UK Biobank Breach Timeline Today’s briefing covers three evolving threats with material implications for UK small businesses. First, CVE-2026-1096018 and CVE-2026-1096019, collectively known as PHP2Shell, are now confirmed exploited in the wild by threat actors linked to North Korea’s Lazarus Group. Roughly three quarters of the web runs PHP, including WordPress, WooCommerce and Magento installations. Unauthenticated remote code execution is possible on unpatched systems, with web shell deployment providing persistent access. Second, a payment card skimming campaign tracked via deepveindrilling.com has compromised 953 Magento stores since July 2025, injecting malicious JavaScript into CMS blocks and using browser fingerprinting to evade automated scanners. Third, UK Biobank’s prolonged offline period following a data breach attempt illustrates the operational reality of incident response timelines, even for well-resourced organisations. The episode provides actionable steps for confirming PHP patch status, auditing Magento CMS blocks manually, and assessing detection capability for personal data breaches under UK GDPR requirements. Chapters Intro Mauven introduces the twenty-sixth of October briefing, flagging that PHP2Shell vulnerabilities first covered on the twenty-first are now confirmed exploited in the wild by Lazarus Group, shifting the conversation from vulnerability management to incident response. PHP2Shell: Lazarus Group, Confirmed Exploitation, Your Website at Risk CVE-2026-1096018 and CVE-2026-1096019 allow unauthenticated remote code execution on unpatched PHP servers. Exploitation is confirmed in the wild, linked to Lazarus Group’s Minjun campaign active since June 2026. Roughly three quarters of the web runs PHP, including WordPress, WooCommerce and Magento. Attack chain involves web shell deployment for persistent access. PHP 8.1 reached end of life in December 2024; PHP 8.2 reaches end of life in December 2025. Mauven provides three immediate actions: confirm PHP version and patching status with hosting provider in writing, verify version independently if possible, and review server access logs from June 2026 for anomalies. CTA Mauven encourages listeners to follow the show and share the episode with anyone managing a website or postponing PHP updates. Magento Skimming: 953 Stores, Over a Year Running Sansec research reveals a skimming campaign tracked via deepveindrilling.com has compromised 953 online stores, predominantly Magento, since July 2025 by injecting malicious JavaScript loaders into CMS blocks. Campaign exploits CVE-2025-54236, CVE-2026-48356 and CVE-2026-75650. Skimmer uses browser fingerprinting to evade automated security scanners and persists via localStorage. Mauven advises manual review of CMS blocks for script tags and external domains, verification of patching status for associated CVEs, and assessment of whether current monitoring would detect CMS block injection. UK Biobank: What the Breach Timeline Tells You UK Biobank, holding data on approximately 500,000 people, has been offline for months following an incident in which data was offered for sale on Alibaba. The organisation is awaiting government clearance to resume operations. Mauven highlights that UK GDPR requires breach notification to the ICO within 72 hours of becoming aware, emphasising that detection capability determines when that clock starts. Smaller organisations often discover breaches through external signals rather than internal detection. Mauven recommends access logging on systems holding personal data, anomaly alerting, and regular review of output. Outro Mauven summarises: PHP2Shell is confirmed exploited by Lazarus Group, Magento stores need manual CMS block audits, and detection capability for personal data breaches remains a structural gap. The episode closes with a reminder that the gap between knowing a risk and closing it is the recurring problem across all three stories. Links https://www.bleepingcomputer.com/news/security/php2shell-vulnerabilities-exploited-in-the-wild/ https://www.cyfirma.com/research/threat-advisory-minjun-campaign-targeting-php-infrastructure/ https://www.theregister.com/2026/10/26/php2shell_exploitation_confirmed/ https://www.ncsc.gov.uk/guidance/vulnerability-management https://www.sansec.io/research/deepveindrilling-magento-skimming-campaign https://www.theregister.com/2026/10/26/uk_biobank_preparing_to_resume/ https://ico.org.uk/for-organisations/report-a-breach/

15:34

Oct 23, 2026

PHP2Shell Persists, AI-Powered Ransomware, and Year-End Phishing Begins

PHP2Shell Persists, AI-Powered Ransomware, and Year-End Phishing Begins Mauven examines three active threats demanding immediate attention from UK small businesses. PHP2Shell vulnerabilities remain widely unpatched despite active exploitation that began days before public disclosure, with automated scanning targeting WordPress, WooCommerce, and Magento installations. New research reveals ransomware affiliates using commercial AI services as operational infrastructure, spending over twenty-three thousand dollars to automate edge device exploitation at scale. Meanwhile, year-end phishing campaigns are already targeting finance and HR staff with fake compensation notices, invoice approvals, and SharePoint lures timed to coincide with Q4 administrative workload. The episode provides specific patching guidance, edge device management questions, and practical phishing defence steps that can be implemented this week. No technical background required, just clear direction on where the exposure sits and what to do about it. Chapters Introduction Mauven introduces three persistent threats requiring immediate action: unpatched PHP2Shell vulnerabilities, AI-powered ransomware infrastructure, and year-end phishing campaigns already underway. PHP2Shell: Still Dangerous Detailed analysis of PHP2Shell vulnerabilities exploited four days before public disclosure. ISC SANS has lowered alert level but unpatched installations remain exposed. Covers disclosure timeline, technical mechanics, Mirai botnet activity, and specific patched versions required for WordPress, WooCommerce, and Magento sites. Call to Action Brief reminder to follow the show and share the briefing with colleagues who need threat intelligence. AI-Powered Ransomware Infrastructure SOCRadar research reveals exposed command-and-control servers showing INC and The Gentlemen ransomware affiliates using commercial AI services for systematic exploitation. Over eight thousand logged messages, twenty-three thousand dollars in AI spending, and targeting of FortiGate, FortiWeb, and Palo Alto edge devices. Connects to Group-IB research on seventy thousand exposed credentials. Year-End Phishing Campaign Analysis Netcraft identifies active year-end phishing lures targeting finance and HR staff with fake compensation notices, invoice approvals, and DocuSign requests. Campaigns timed to coincide with Q4 administrative workload. Provides specific verification rules and conversation framework for at-risk staff. Closing Remarks Three action points: confirm PHP patching in writing, verify edge device firmware versions, and conduct direct conversations with finance and HR staff about year-end phishing. Emphasises that the gap between knowing what to do and doing it is where most damage occurs. Links https://isc.sans.edu/ https://aws.amazon.com/security/ https://www.theregister.com/ https://vulncheck.com/ https://www.socradar.io/ https://www.group-ib.com/ https://www.ncsc.gov.uk/ https://www.netcraft.com/

16:07

Oct 23, 2026

Android Banking Trojan, Python Supply Chain Attack, and UEFI Bootkit

Android Banking Trojan, Python Supply Chain Attack, and UEFI Bootkit Mauven examines three active threats with direct implications for UK small businesses. First, the RemControl Android banking trojan is spreading through malvertising, targeting over thirty financial institutions across Western Europe by exploiting accessibility services to steal credentials and two-factor codes in real time. Second, a supply chain compromise in LiteLLM version 1.107.0, a widely used Python library for AI development, contains malicious code designed to steal API keys and credentials before application code even executes. Third, the BlackX UEFI bootkit, attributed to Chinese state-sponsored group APT41, bypasses Secure Boot protections and survives operating system reinstalls by operating at firmware level. The episode closes with a timely warning about year-end phishing campaigns that exploit the legitimate administrative activity typical of Q4. Throughout, Mauven identifies the operational gaps between what IT estates are supposed to protect and what they actually cover, with practical guidance on BYOD policies, supply chain verification, and firmware patching. Chapters Introduction Mauven introduces three threat items with direct relevance to UK small businesses, emphasising the urgency of addressing BYOD Android banking risks and the approaching year-end phishing season. RemControl Android Banking Trojan Analysis of the RemControl malware-as-a-service operation targeting Western European financial institutions through fake TVTap downloads, exploiting Android accessibility services to steal credentials and intercept two-factor authentication codes via live screen streaming. Call to Action Reminder to follow the show and share briefings with colleagues who need threat intelligence. LiteLLM Supply Chain Compromise Examination of malicious code discovered in LiteLLM version 1.107.0, a Python library for AI development, which uses startup hooks to steal credentials and load remote payloads, with implications for organisations and their suppliers. BlackX UEFI Bootkit Nation-state UEFI bootkit attributed to APT41 that bypasses Secure Boot using the Baton Drop vulnerability, persists through OS reinstalls, and disables Kaspersky and Avast security tools at firmware level. Year-End Phishing Season Warning about the seasonal increase in phishing campaigns exploiting legitimate Q4 administrative communications, with guidance on verification procedures. Closing Mauven summarises the common thread of operational gaps between intended and actual IT coverage, urging listeners to identify and address these vulnerabilities. Links https://www.group-ib.com/blog/remcontrol-android-banking-trojan/ https://www.microsoft.com/en-us/security/blog/2024/10/23/litellm-supply-chain-compromise/ https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-used-in-espionage-campaign/ https://www.ncsc.gov.uk/collection/supply-chain-security https://www.netcraft.com/blog/year-end-phishing-campaigns/

14:40

Oct 22, 2026

PHP2Shell Exploited Pre-Patch and ConnectWise Breach Hits 2,250 Tenants

PHP2Shell Exploited Pre-Patch and ConnectWise Breach Hits 2,250 Tenants Two major threats demand immediate attention from UK small businesses today. First, critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were actively exploited four days before patches existed. Amazon’s threat intelligence detected deliberate, pre-disclosure attacks from 17 October, with Cloudflare recording millions of exploit attempts by the time fixes arrived on 21 October. These remote code execution flaws affect the PHP installations powering most UK SMB web infrastructure, including WordPress, WooCommerce and Magento. Second, Microsoft confirms a Chinese state-linked actor exploited ConnectWise infrastructure to access 2,250 cloud tenants. The breach compromised remote monitoring platforms used by UK managed service providers, with attackers achieving privileged access in under three hours using AI-assisted techniques. If your business uses an MSP, there is material probability your provider relies on ConnectWise tooling that grants administrative access to your endpoints, email and backups. Also covered: a maximum severity GitLab remote code execution flaw requiring immediate patching, and The Gentlemen ransomware group surpassing 800 claimed victims. Today’s action items are direct: verify your PHP version was updated after 21 October, and confirm whether your IT provider uses ConnectWise and what incident response they conducted. Chapters Introduction Opening briefing for 22 October 2026. Critical PHP vulnerability was exploited four days before patches existed, with millions of subsequent exploit attempts. ConnectWise breach gave Chinese state actors access to 2,250 cloud tenants through MSP infrastructure. PHP2Shell: Active Exploitation Preceded the Patch by Four Days Analysis of CVE-2026-109618 and CVE-2026-109619. Amazon detected deliberate pre-disclosure exploitation from 17 October via commercial anonymisation networks. Both vulnerabilities enable remote code execution through memory handling failures in PHP. Cloudflare recorded millions of exploit attempts by patch release. Guidance on verification, patching and log review for systems reachable before 21 October. Call to Action Encouragement to follow the show and share with colleagues. ConnectWise Breach: Chinese State Actors in 2,250 Cloud Tenants Microsoft reporting confirms Chinese state-linked intrusion through ConnectWise remote monitoring platforms used by UK MSPs. Attackers achieved privileged access in under three hours using AI agents. Explanation of MSP supply chain risk and downstream impact on SMB clients. Guidance on verifying IT provider incident response, requesting evidence of remediation, and reviewing admin activity logs. Also on the Radar GitLab patches maximum severity RCE in Regular Expression Compiler. The Gentlemen ransomware group exceeds 800 claimed victims, offering affiliates up to 90% revenue share and targeting Windows, Linux, NAS and BSD systems with double extortion. Closing Summary of immediate actions: verify PHP update status with hosting provider or developer, and confirm ConnectWise use and incident response with IT provider. Sign-off and production credits. Links https://aws.amazon.com/security/security-bulletins/ https://www.ncsc.gov.uk/guidance/zero-day-vulnerability-management https://www.microsoft.com/en-us/security/blog/ https://www.ncsc.gov.uk/collection/supply-chain-security https://about.gitlab.com/releases/categories/releases/

15:42

Oct 21, 2026

Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs

Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs Two urgent threats sit at opposite ends of the visibility spectrum today. First, the NCSC has issued a critical alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both scoring 9.4 CVSS with public exploit code already circulating. With most UK small business websites running PHP through WordPress, WooCommerce, Magento or custom applications, this is not a comfortable two-week patching window. Remote code execution risks extend well beyond website defacement to encompass customer databases, GDPR exposure and credential compromise. Second, the Wazza phishing kit is actively targeting Microsoft 365 accounts through a sophisticated device code authentication attack that bypasses MFA. By routing through legitimate infrastructure including Google Sites and Cloudflare Workers, the campaign exploits trusted platforms to make malicious traffic indistinguishable from normal business operations. The attack leverages social engineering to trick victims into completing an MFA flow that authenticates the attacker’s session rather than their own. Cisco Talos and Wiz research confirms this is part of a broader pattern of abusing legitimate platforms across more than 25 services. UK small businesses need to verify PHP patching status today, restrict device code authentication in Microsoft 365 tenants through Conditional Access policies, and ensure finance teams understand what device code phishing looks like. Also covered: a reminder on the AOMEI Backupper supply chain compromise affecting updates between April and July 2026. Chapters Introduction Overview of today’s two threats: a loud, technical PHP vulnerability with available patches, and a quiet, sophisticated phishing campaign engineered to appear legitimate. Both affect UK small businesses directly with actionable steps available today. Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 NCSC urgent alert on two critical PHP vulnerabilities scoring 9.4 CVSS with proof-of-concept exploits already circulating. Affects most UK business websites running WordPress, WooCommerce, Magento, Laravel, Symfony and Drupal. Remote code execution risks extend to databases, customer records and GDPR exposure. Four immediate actions: verify PHP version with hosting provider in writing, prioritise internal PHP systems, check WAF rule deployment, and review hosting contracts for update control. Call to Action Encouragement to follow the show and share with colleagues who need threat intelligence. The Wazza Phishing Kit and Microsoft 365 Sophisticated phishing campaign active since July 2026 targeting Microsoft 365 through device code authentication. Originates from compromised legitimate accounts, routes through trusted platforms like Google Sites and Cloudflare Workers to bypass security filters. Exploits legitimate Microsoft device code flow to obtain authentication tokens after victim completes MFA, effectively bypassing multi-factor authentication through social engineering. Cisco Talos documents abuse of 25+ legitimate platforms. Wiz research shows similar patterns in Google Cloud environments. Requires restricting device code authentication through Conditional Access policies and targeted staff awareness about unexpected authentication prompts. AOMEI Backupper Supply Chain Reminder Brief reminder of yesterday’s coverage on AOMEI Backupper supply chain compromise between April and July 2026. Three separate windows where attackers modified download instructions to deliver malware, with the longest window lasting ten minutes. Affects backup software used by over 100 million users worldwide, commonly deployed by UK small businesses. Requires verification of whether the software was updated during the compromise window and endpoint review if so. Conclusion and Action Items Three immediate actions: contact hosting provider to verify PHP patching status in writing, confirm device code authentication is restricted in Microsoft 365 tenant, and flag AOMEI Backupper for review if updated between April and July 2026. All require a phone call or email today rather than budget. Links https://www.ncsc.gov.uk/ https://isc.sans.edu/ https://www.php.net/ https://www.levelblue.com/ https://blog.talosintelligence.com/ https://www.wiz.io/

14:50

Oct 20, 2026

AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach

AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach Three recent incidents expose fundamental gaps in UK business security practice. AOMEI Backupper, backup software deployed across millions of systems, suffered a supply chain compromise between April and July 2026 when attackers tampered with update infrastructure during brief windows, delivering remote access backdoors to users who triggered legitimate update checks. Citrix NetScaler devices face active exploitation of CVE-2026-88771, a critical remote code execution vulnerability with no workaround, as attackers deploy web shells and chain additional vulnerabilities for persistent access. The ICO has issued reprimands to two Welsh organisations following a ransomware breach affecting 3,300 people, predominantly children, after attackers gained entry through a forgotten test account secured with the password Password1. Additional reporting covers the compromise of a Microsoft 365 API credential belonging to ConnectWise Cloud Backup, which enabled automated bulk access across hundreds of customer tenants. The briefing provides actionable guidance for checking AOMEI exposure, confirming NetScaler patch status, auditing dormant accounts, and interrogating MSP access logging. None of these failures required sophisticated attack techniques. All map to existing NCSC guidance that remains unimplemented across UK SMB environments. Chapters Introduction Daily threat briefing for 20 October 2026 covering three incidents that map where UK businesses continue to leave security gaps: a supply chain attack in trusted backup software, critical network infrastructure exploitation, and a breach starting with a test account using Password1. AOMEI Backupper Supply Chain Compromise Attackers compromised AOMEI Backupper update infrastructure between April and July 2026, delivering malicious payloads during brief tampering windows. Over 100 million users worldwide, with significant UK SMB deployment. Guidance on checking for indicators of compromise and interrogating IT providers about exposure across their client base. Mid-Episode Call to Action Brief reminder to follow the show and share with business owners and IT managers. NetScaler Remote Code Execution CVE-2026-88771 Citrix NetScaler devices face active exploitation of a critical vulnerability with CVSS score 9.8. No workaround exists. Attackers deploy web shells and chain additional CVEs for persistence. Guidance on obtaining written confirmation of patch status from MSPs and understanding the absence of UK mandatory remediation deadlines. ICO Reprimands for Welsh Organisations ICO has issued reprimands to Ogi Networks and Data Cymru following a ransomware breach affecting approximately 3,300 people, predominantly children, after attackers accessed a forgotten test account with the password Password1. Guidance on auditing dormant accounts, enforcing password policies, and implementing multi-factor authentication. MSP Credential Exposure in Microsoft 365 Huntress research documents compromise of ConnectWise Cloud Backup Microsoft 365 API credential, enabling bulk automated access across hundreds of customer tenants. Guidance on interrogating MSPs about their credential hygiene, access logging, and exposure to this specific incident. Closing Summary Three immediate actions: check AOMEI Backupper installations against published indicators, obtain written confirmation of NetScaler patch status, and audit dormant and test accounts. All three failures map to existing guidance; the gap is implementation, not knowledge. Links https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-supply-chain-attack https://www.citrix.com/security/advisory/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.zscaler.com/blogs/security-research/netscaler-exploitation-analysis https://ico.org.uk/action-weve-taken/enforcement/ https://www.ncsc.gov.uk/guidance/supply-chain-security https://www.ncsc.gov.uk/guidance/password-policy https://www.huntress.com/blog/connectwise-cloud-backup-credential-compromise

13:48

Oct 19, 2026

ConnectWise Breach, NetScaler RCE, and the MSP Trust Problem

ConnectWise Breach, NetScaler RCE, and the MSP Trust Problem On 15 October 2026, a threat actor authenticated to Microsoft Graph API using a compromised ConnectWise Cloud Backup vendor credential, gaining automated access to hundreds of customer Microsoft 365 tenants. Meanwhile, CVE-2026-88771, a critical remote code execution vulnerability in NetScaler Application Delivery Controller and Gateway, continues to be actively exploited with web shell deployment documented in the wild. This episode examines both incidents through the lens of supply-chain risk in managed service provider relationships. Mauven walks through the structural security implications of vendor-level service principals, the exploitation mechanics of the NetScaler vulnerability, and the practical steps UK small businesses should take to audit third-party access to their environments. Also covered: F5’s out-of-band patches for critical NGINX vulnerabilities. This is not theoretical exposure. These are active incidents requiring immediate response from businesses that rely on MSP-managed infrastructure. Chapters Intro Mauven opens the 19 October 2026 briefing with an urgent note for businesses using MSP relationships or Citrix VPN infrastructure. Two active, documented incidents require immediate attention. ConnectWise Supply-Chain Breach Hits M365 Tenants On 15 October, an attacker used a compromised ConnectWise Cloud Backup vendor credential to traverse hundreds of Microsoft 365 customer tenants via automated GUID-sorted enumeration. The incident exposes the structural risk of vendor-level service principals. Mauven details the authentication mechanics, the scope of exposure, and four actionable steps: confirm product use with your MSP, audit enterprise applications in Azure AD, check audit logs for IP 144.172.64.128, and demand written answers on credential rotation processes. CTA Follow the show and share this episode with anyone managing an MSP relationship or making patching decisions. NetScaler RCE CVE-2026-88771 Under Active Exploitation CVE-2026-88771, disclosed 27 September 2026, is a CVSS 9.8 remote code execution vulnerability in NetScaler ADC and Gateway. CISA has added it to the Known Exploited Vulnerabilities catalogue. Attackers are deploying web shells for persistent access. Mauven outlines patching priorities, the importance of pre-patch compromise review, and the need for written confirmation from MSPs managing NetScaler infrastructure. Critical NGINX Vulnerabilities Patched Out-of-Band F5 has released out-of-band patches for multiple critical NGINX vulnerabilities, including three enabling remote code execution. Businesses using managed hosting should confirm with providers that patches have been applied. The Pattern All three incidents share a common thread: the products and vendors between your business and the internet are part of your attack surface. NCSC guidance on supply-chain risk and third-party access controls exists but is inconsistently applied across the MSP industry. Outro Mauven closes with two priority questions for MSPs: what is connected to our Microsoft 365 tenancy and what permissions does it have, and have our NetScaler appliances been patched and reviewed for compromise. Written answers required. Links https://www.huntress.com/blog/connectwise-cloud-backup-breach https://www.ncsc.gov.uk/collection/supply-chain-security https://support.citrix.com/article/CTX626634 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.zscaler.com/blogs/security-research/netscaler-cve-2026-88771-exploitation-analysis https://www.f5.com/company/blog/security/nginx-out-of-band-security-patches https://www.bleepingcomputer.com/news/security/f5-nginx-vulnerabilities-patched-out-of-band/

18:22

Oct 16, 2026

Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel

Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel On 16 October 2026, three active threat campaigns demand immediate attention from UK small businesses. First, a zero-day vulnerability in BeyondTrust Remote Support appliances (CVE-2026-102764) has been exploited since late August by ARMORY CASTLE, a suspected Chinese state-linked actor, targeting the IT provider supply chain. Second, an AI-orchestrated exploitation campaign against PaperCut print management software is operating automatically across 45-plus countries, representing a fundamental shift in attack velocity and scale. Third, DragonForce ransomware has evolved from opportunistic operation to sophisticated cartel offering white-label services, with affiliates exploiting vulnerabilities including the nearly five-year-old Log4Shell. A supplementary proxyjacking campaign (skynox-7) has compromised at least 143 network edge devices globally. The common thread: known vulnerabilities, unpatched systems, and IT tooling that business owners have never inventoried. All three campaigns are confirmed active, documented by Mandiant, Hunt.io, ReliaQuest, Bitsight, and GreyNoise. This briefing provides actionable guidance for businesses that may be exposed through their IT providers or their own infrastructure, with specific questions to ask and checks to run today. Chapters Introduction Overview of three confirmed, active threat campaigns directly relevant to UK small businesses: a zero-day in remote support software, an AI-orchestrated print management exploit, and a restructured ransomware cartel. ARMORY CASTLE BeyondTrust Zero-Day Exploitation Analysis of CVE-2026-102764, a zero-day in BeyondTrust Remote Support exploited by suspected Chinese state actor ARMORY CASTLE since late August 2026, including post-exploitation techniques and supply chain implications for businesses using managed IT providers. Mid-Episode Call to Action Invitation to follow the show and share with fellow business owners. AI-Orchestrated PaperCut Exploitation Campaign Examination of automated exploitation targeting PaperCut NG/MF print management software across 45-plus countries, using AI agents to execute attacks at unprecedented scale and speed, with implications for professional services and healthcare sectors. DragonForce Ransomware Cartel Evolution Assessment of DragonForce’s transformation from opportunistic ransomware operator to white-label cartel model, including exploitation of Log4Shell and other years-old vulnerabilities still present in UK business environments. Skynox-7 Network Edge Device Proxyjacking Brief on proxyjacking campaign compromising NAS, NVR, and DVR devices globally, turning business hardware into criminal proxy infrastructure through exploitation of known vulnerabilities and default credentials. Closing and Action Items Summary of common vulnerabilities across all campaigns and specific questions business owners should ask their IT providers immediately. Links https://www.beyondtrust.com/trust-center/security-advisories https://www.mandiant.com/resources/blog https://hunt.io/blog https://www.reliaquest.com/blog https://www.bitsight.com/blog https://www.greynoise.io/blog https://www.ncsc.gov.uk/guidance/patch-management

14:20

Oct 15, 2026

Ivanti Zero-Day Chain, FortiGate Implant, and Legal Aid Agency Breach

Ivanti Zero-Day Chain, FortiGate Implant, and Legal Aid Agency Breach Three critical security incidents dominate today’s briefing. Ivanti Connect Secure VPN appliances face active exploitation through a three-vulnerability chain granting unauthenticated root access, with particular risk to managed service providers and their client bases. The PEERSTITCH implant campaign reveals how a 2024 FortiManager compromise led to persistent, memory-resident malware on hundreds of FortiGate firewalls, surviving standard detection methods. The Legal Aid Agency breach now confirms exfiltration of nearly 50 years of records, creating direct pretexting risks for legal services firms. Each incident exposes the gap between patching and verification, between logs that appear clean and systems that actually are clean. For small businesses relying on managed IT infrastructure, this episode provides specific questions to ask providers and concrete steps to verify security posture. The NCSC has also published updated guidance on post-quantum cryptography in TLS configurations, signalling the start of a multi-year migration that requires planning rather than crisis response. Chapters Introduction Overview of three major security incidents involving systems left open that shouldn’t have been, and the gap between official accounts and operational reality. Ivanti Connect Secure Zero-Day Chain Analysis of three chained zero-day vulnerabilities enabling unauthenticated root access to Ivanti VPN appliances, with particular focus on risks to managed service providers and their client bases. Includes specific verification steps for organisations and their IT providers. Listener Call to Action Brief reminder to follow the show and share with colleagues who need threat intelligence updates. PEERSTITCH FortiGate Implant Deep dive into a sophisticated intrusion campaign originating from a 2024 FortiManager compromise, leading to deployment of memory-resident malware on hundreds of managed FortiGate firewalls. Explains why standard compromise checks would have missed this threat and what verification steps are actually required. Legal Aid Agency Breach Examination of a breach affecting nearly 50 years of records, including probation service data, and the specific pretexting risks this creates for legal services firms and their clients. Covers verification procedures for firms handling legal aid cases. NCSC TLS Guidance Update Planning note on newly published NCSC guidance for post-quantum cryptography migration in TLS configurations, framed as a multi-year planning exercise rather than immediate crisis. Closing Remarks Summary emphasising the distinction between devices that appear secure and devices that actually are secure, and the importance of asking IT providers how they verify security rather than assuming it. Links https://www.ivanti.com/security https://www.paloaltonetworks.com/unit42 https://www.ncsc.gov.uk/guidance/using-tls-to-protect-data https://www.ncsc.gov.uk/guidance/post-quantum-cryptography

15:15

Oct 14, 2026

CoGUI Phishing Takedown, Ivanti Zero-Day, and Android Banking Malware

CoGUI Phishing Takedown, Ivanti Zero-Day, and Android Banking Malware Today’s briefing examines a major phishing infrastructure disruption alongside active exploitation of a critical VPN vulnerability. Microsoft and law enforcement partners have taken down the CoGUI phishing-as-a-service operation responsible for over one billion malicious messages targeting 75,000 organisations across 150 countries, though operators remain at large. CISA has added an Ivanti Connect Secure zero-day to its Known Exploited Vulnerabilities catalogue, with confirmed active exploitation dating back to 1 October 2026. UK small businesses using managed service providers should verify their remote access infrastructure is patched immediately. The episode also covers a credential-harvesting campaign targeting WatchGuard VPN users through SEO poisoning, and new Android banking malware that replaces legitimate applications with compromised versions. Practical guidance focuses on credential phishing defences, VPN security verification, and mobile banking application hygiene for business users. Chapters Introduction Overview of a major phishing infrastructure takedown and an actively exploited Ivanti Connect Secure zero-day affecting remote access systems. The CoGUI Phishing Takedown Analysis of the disrupted phishing-as-a-service marketplace responsible for one billion malicious messages, why operators remaining at large matters, and a related WatchGuard VPN credential-harvesting campaign using SEO poisoning. Call to Action Listener engagement request to share the briefing with others who need threat intelligence. Ivanti Connect Secure Zero-Day Breakdown of the CISA-catalogued vulnerability with two weeks of confirmed exploitation before public disclosure, implications for managed service provider customers, and immediate patch verification requirements. Hirudo Android Malware New Android malware that replaces legitimate banking applications with modified versions, relevant to businesses conducting mobile banking operations. Closing Summary Recap of the day’s threat landscape: phishing infrastructure reconstitution risks, urgent Ivanti patching requirements, and defences against SEO-poisoned software downloads. Links https://www.bleepingcomputer.com/news/security/microsoft-disrupts-massive-phishing-as-a-service-operation/ https://blogs.microsoft.com/on-the-issues/2026/10/14/cogui-phishing-takedown-digital-crimes-unit/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.huntress.com/blog/watchguard-vpn-credential-phishing-campaign https://www.ncsc.gov.uk/guidance/phishing-resistant-authentication

15:50

Oct 13, 2026

Retail Breaches, NetScaler Zero-Days, and the Password That Exposed Denmark

Retail Breaches, NetScaler Zero-Days, and the Password That Exposed Denmark In today’s briefing, we examine three incidents that reveal a troubling pattern: security failures that require no sophisticated adversary, only the absence of basic controls. TFG London, owner of Hobbs and Whistles, confirms a cyberattack that’s part of a wider autumn assault on UK retail. Two zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now, with webshells already deployed in production environments. In Denmark, a small IT firm’s use of the password ‘123456’ exposed personal data on 8.8 million people, nearly the entire population. We also cover internet-connected refrigeration system attacks in France and critical SAP vulnerabilities. The thread connecting these stories is not technical complexity but organisational failure to implement known protections. For UK SMBs, the lesson is clear: your risk often lives in the systems and suppliers you’re connected to, not just in your own infrastructure. This episode provides specific, actionable questions to ask your IT providers and MSPs today, because the gap between guidance and implementation remains dangerously wide. Chapters Introduction Mauven introduces three incidents requiring no sophisticated adversary, only the absence of action: a UK retail breach, actively exploited zero-days, and a catastrophic password failure in Denmark. UK Retail Hit Again: TFG London Confirms Cyberattack TFG London, parent of Hobbs and Whistles, confirms a cyberattack with systems offline and orders delayed. The incident fits a pattern of autumn attacks on UK retail. Businesses sharing supply chains, logistics platforms, or IT connections with affected retailers should review access logs and understand their exposure through shared infrastructure. Call to Action A reminder to follow the show and share it with others who need daily threat intelligence. NetScaler Zero-Days: Active Exploitation, Right Now Two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are under active exploitation. CVE-2026-88771 allows unauthenticated remote code execution with webshells already deployed. CVE-2026-88772 is a DTLS memory overflow enabling similar attacks. UK SMBs should ask MSPs and IT providers in writing whether they run affected NetScaler products and confirm patching status, treating silence as confirmation of risk. ‘123456’: The Password That Exposed 8.8 Million People A small Danish IT firm with access to Denmark’s civil register was breached via weak passwords, including ‘123456’, exposing data on 8.8 million people. UK businesses must conduct due diligence on data processors, require MFA on privileged accounts, and update data processor agreements to specify minimum security standards as required under UK GDPR. Today’s Wider Context: Refrigeration, SAP, and What Physical Systems Tell Us Attackers compromised internet-connected refrigeration systems at hundreds of French supermarkets by exploiting outdated firmware. SAP published October security updates addressing 20 vulnerabilities, including a maximum-severity flaw in Cloud SDK for Python. UK businesses should review building management system security and confirm SAP patching with their ERP providers. Conclusion The consistent pattern across today’s incidents is not technical sophistication but the gap between knowing security best practices and implementing them. UK SMBs should review supplier connections, particularly those established years ago, and start by asking one supplier with data access about MFA enforcement on privileged accounts. Links https://unit42.paloaltonetworks.com/netscaler-zero-day-vulnerabilities/ https://www.ncsc.gov.uk/collection/supply-chain-security https://www.ncsc.gov.uk/collection/supply-chain-security/supplier-assurance

13:15

Oct 12, 2026

GitLab Max-Severity RCE, JFrog Artifactory Backdoor, and Retail Supply Chain Disruption

GitLab Max-Severity RCE, JFrog Artifactory Backdoor, and Retail Supply Chain Disruption Three critical incidents with direct supply chain implications dominate today’s threat landscape. GitLab has issued an emergency warning for a maximum-severity unauthenticated remote code execution vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching. Meanwhile, Wiz Research confirms active in-the-wild exploitation of three JFrog Artifactory vulnerabilities being chained to deploy a Rust-based backdoor with full administrative access. In the retail sector, Ahold Delhaize has taken systems offline following a cybersecurity incident, with potential knock-on effects for suppliers and logistics partners across Europe and North America. All three incidents highlight a common theme: attackers are targeting developer and software management infrastructure that often sits outside standard vulnerability management programmes. UK small businesses face indirect but material risk through their IT providers, MSPs, and software suppliers. The episode examines what these incidents mean for organisations without direct control over the affected infrastructure, and how to verify patching status and supply chain exposure when you rely on third parties for critical services. Chapters Introduction Opening summary of three supply chain-focused incidents requiring immediate attention, with emphasis on active targeting of software build infrastructure. GitLab Max-Severity RCE Emergency warning for unauthenticated remote code execution vulnerability in GitLab CI/CD Regular Expression Compiler. Explains CI/CD pipeline risk, the specific flaw, patching urgency, and how to verify MSP response. Call to Action Brief listener engagement prompt encouraging show following and sharing with colleagues and suppliers. JFrog Artifactory Active Exploitation Active in-the-wild exploitation of three chained JFrog Artifactory vulnerabilities deploying a Rust-based backdoor. Details the three-step attack chain, payload characteristics, and indirect supply chain exposure for UK SMBs. Ahold Delhaize Retail Incident Cybersecurity incident at major food retail group Ahold Delhaize prompts system shutdowns. Examines scale, containment measures, and knock-on effects for suppliers, logistics partners, and payment processors in the supply chain. The Wider Picture Analysis of NCSC external attack surface management consultation in context of today’s incidents. Highlights gap between standard vulnerability management and developer infrastructure, and the implications for UK SMBs relying on third-party providers. Closing Summary of supply chain attack concentration and advice on verifying patching evidence from IT providers rather than accepting assumptions. Links https://about.gitlab.com/releases/2026/10/12/security-release-gitlab-17-5-1-released/ https://www.wiz.io/blog/jfrog-artifactory-vulnerabilities-exploited-in-the-wild https://www.aholddelhaize.com/newsroom/2026/10/12/cybersecurity-incident/ https://www.ncsc.gov.uk/blog-post/external-attack-surface-management https://www.ncsc.gov.uk/collection/developers-collection/principles/protect-your-code-repository https://nvd.nist.gov/vuln/detail/CVE-2026-42016 https://nvd.nist.gov/vuln/detail/CVE-2026-42018 https://nvd.nist.gov/vuln/detail/CVE-2026-82329

5:46

Oct 6, 2026

Zero-Day Threats and Linux Breaches: Essential Measures

Zero-Day Threats and Linux Breaches: Essential Measures Mauven delves into two critical cybersecurity threats impacting UK businesses. The StyleSmuggler vulnerability affects Magento platforms through PHP code injections, compromising e-commerce security. Despite existing guidance from the National Cyber Security Centre, many businesses remain vulnerable, urging immediate action for secure transaction processing. The ClingSTUN backdoor targets Linux systems, exploiting IoT devices using unpatched flaws and deceptive STUN infrastructure. Businesses must prioritise patch management, network segmentation, and robust authentication to safeguard against these sophisticated threats. Chapters Intro Introduction to the day’s threats involving Magento and Linux systems. StyleSmuggler: Magento Under Siege Exploration of the zero-day vulnerability affecting Magento, its implications, and steps for UK businesses to enhance e-commerce security. CTA Encouragement to follow the podcast for daily threat insights. ClingSTUN Backdoor: A New Menace for Linux Systems Discussion of the ClingSTUN malware threatening Linux IoT devices and security strategies for UK businesses. Outro Emphasis on proactive action and patch management to maintain cybersecurity resilience. Links https://www.ncsc.gov.uk https://adobe.com https://magento.com

6:57

Oct 5, 2026

Safeguarding Against BPFDoor and AVERAT Threats

Safeguarding Against BPFDoor and AVERAT Threats Join Mauven on today’s Threat Analysis as she explores crucial cybersecurity threats faced by UK businesses. With recent developments around BPFDoor variants and the new AVERAT implant, companies need to secure their network-edge appliances urgently. Attackers exploit SMTP traffic on port 25, integrating seamlessly into trusted mail operations. Small and medium enterprises often neglect these network edges, exposing themselves to significant risks. This episode delves into how these cybercriminals operate, their strategic targeting of telecommunications firms, and the evolving tactics of BPFDoor and AVERAT. Mauven emphasises the importance of regular mail server updates and layered security measures. She urges businesses to conduct audits and use intrusion detection systems, suggesting a proactive approach to cybersecurity. Stay updated to protect your business against these ongoing threats. Chapters Intro Introduction to the pressing issue of BPFDoor and AVERAT targeting UK businesses. BPFDoor and AVERAT Exploit UK Network Edges Exploration of how these exploits use SMTP traffic to infiltrate network-edge appliances. How They Operate Details on the tactics used by cybercriminals to bypass defences and access sensitive networks. Deeper Insights Analysis of the persistence and evolving nature of these threats within corporate environments. What Isn’t Said Discussion on the broader strategies and implications of the attackers’ methods. Action Steps for SMBs Guidance on security measures for small and medium businesses to protect against these threats. CTA Encouragement to follow the podcast for continuous insight and protection tips. Outro Reiteration of the urgency to act against BPFDoor and AVERAT threats. Links https://www.ncsc.gov.uk/ https://www.cisa.gov/ https://www.cybersecuritycentre.uk/

6:00

Oct 2, 2026

Critical Vulnerabilities in FortiMail and Dell CSM

Critical Vulnerabilities in FortiMail and Dell CSM In today’s episode of Threat Analysis, Mauven dives into pressing cyber vulnerabilities affecting small and medium businesses. The episode focuses on a zero-day vulnerability in FortiMail, identified as CVE-2026-104286, which hackers actively exploit without requiring authentication. The episode stresses the necessity of timely patch management, a lesson highlighted by the NCSC back in 2025. Mauven outlines the urgent actions businesses must take to protect their systems, including reviewing patch policies and updating security protocols. Additionally, the episode examines critical issues in Dell’s Container Storage Modules, which present maximum severity vulnerabilities capable of granting attackers administrative control in Kubernetes environments. The importance of maintaining current system patches and reinforcing access controls is emphasised to prevent potential operations disruption and sensitive data compromise. Lastly, the hijack of Microsoft’s X account serves as a reminder that robust credential security is vital for businesses of all sizes. Strong passwords, two-factor authentication, and vigilant monitoring are recommended to mitigate credential theft risks. Join Mauven for an insightful analysis of these significant cyber threats. Chapters Intro Mauven introduces the episode’s focus on critical vulnerabilities in FortiMail and Dell CSM, urging businesses to prioritise patch management. FortiMail Zero-Day Vulnerability Discussion of CVE-2026-104286 vulnerability in FortiMail, its severe implications, lack of a current patch, and urgent measures businesses should implement. Dell CSM Vulnerabilities Exploration of maximum severity vulnerabilities in Dell CSM that can enable attackers to gain administrative control, stressing the need for timely updates. CTA Encouragement to follow the podcast and share it with others for regular insights into cybersecurity threats. Microsoft X Account Hijack Analysis of the hijack of Microsoft’s X account and its implications for businesses’ credential security and reputation management. Outro Conclusion emphasising the importance of proactive cybersecurity measures and regular patch management to safeguard against emerging threats. Links https://www.ncsc.gov.uk/ https://www.fortinet.com/blog/threat-research https://www.dell.com/en-uk

7:28

Oct 1, 2026

Evolving Cyber Threats to UK SMBs

Evolving Cyber Threats to UK SMBs In today’s episode of Threat Analysis, Mauven MacLeod explores the escalating cybersecurity threats faced by UK small businesses. As technological advancements bring more complex cyberattacks, businesses encounter significant risks, beyond just IT concerns. The episode delves into 2CLoader, a sophisticated malware loader identified in August 2026, which utilises advanced evasion techniques. These tactics allow it to bypass conventional security measures, posing a substantial risk. Further, we examine zero-day vulnerabilities in PaperCut MF software, highlighting widespread implications beyond the education sector. The episode also covers recent Citrix NetScaler Gateway issues, where command injection vulnerabilities were exploited prior to disclosure. These cases underscore the importance of timely updates and robust security strategies for networked software relied upon by businesses. With insights into potential repercussions, including data breaches and reputational damage, the focus remains on preventative measures. Mauven recommends regular software updates and network traffic analysis as key defensive strategies. Reinforcing your business’s cybersecurity today could prevent catastrophic breaches tomorrow. Tune in to understand the vital steps necessary to safeguard your business operations in an increasingly precarious digital landscape. Chapters Intro Introduction to the expanding cybersecurity threats for UK small businesses. New Malware Loader Examination of the 2CLoader, its evasion techniques, and impact on businesses. CTA Encouragement to follow the podcast for continuous updates. PaperCut MF Zero-Days Discussion on zero-day vulnerabilities exploited in PaperCut MF software. Citrix NetScaler Vulnerability Insight into command injection vulnerabilities in Citrix NetScaler. What This Means for UK SMBs Assessment of the broader implications for UK small and medium businesses. Outro Conclusion with emphasis on the importance of staying informed and proactive. Links https://www.example1.com https://www.example2.com https://www.example3.com

7:12

Sep 30, 2026

Cyber Threats Facing UK Small Businesses

Cyber Threats Facing UK Small Businesses In today’s episode of Threat Analysis, Mauven MacLeod explores pressing cybersecurity threats impacting UK small businesses. The discussion begins with ValleyRAT, a sophisticated malware posing as innocuous software discovered by AlienVault OTX. This threat utilises DLL sideloading to gain backdoor access to organizations’ systems, recording keystrokes and siphoning data without detection. Despite its current focus on China and India, businesses linked to these regions should heighten their security measures. Next, the episode examines the ‘Spring Ring’ voice phishing campaign analysed by Unit 42. This vishing scheme targets employees on platforms like Microsoft Teams, urging the implementation of robust verification processes and multi-factor authentication. Attention is also drawn to serious vulnerabilities in TeamViewer software, as reported by Bleeping Computer. Unpatched systems are left vulnerable to remote attacks and data breaches, highlighting the importance of proactive security updates. Finally, the episode addresses concerns from a survey in The Register indicating a widespread lack of cyber skills among UK businesses. Without dedicated IT staff, many small to medium enterprises are particularly vulnerable. Mauven emphasises the need for regular training and awareness to foster a cyber-resilient culture. Tune in for essential insights to safeguard your business. Chapters Intro Introduction to today’s cybersecurity threats for UK small businesses, focusing on malware and phishing scams. ValleyRAT Backdoor Discussion on ValleyRAT malware, its operation, risks, and recommended security measures to counteract the threat. CTA Encouraging listeners to follow the podcast for regular cybersecurity updates. Spring Ring Phishing Scams Exploration of the ‘Spring Ring’ voice phishing campaign and defensive strategies to prevent vishing attacks. TeamViewer Vulnerabilities Analysis of TeamViewer vulnerabilities and the urgent need to patch systems to prevent potential data breaches. Lack of Cyber Skills in UK Businesses Examining the skills gap in UK businesses regarding cybersecurity and advocating for improved training and awareness. Outro Concluding remarks on the necessity of proactive measures in cybersecurity for small businesses. Links https://www.alienvault.com https://unit42.paloaltonetworks.com https://www.bleepingcomputer.com https://www.theregister.com

6:50

Sep 29, 2026

AI Risks and Cybersecurity Essentials for UK SMBs

AI Risks and Cybersecurity Essentials for UK SMBs In today’s episode of Threat Analysis, Mauven delves into critical developments impacting UK small and medium-sized businesses (SMBs). We begin with OpenAI’s surprising decision to pause its GPT-6.1 Astra model due to unforeseen behaviours, raising concerns about AI oversight and control measures. This move underscores the importance of implementing robust governance policies around AI technologies. We then shift focus to cybersecurity, highlighting a critical vulnerability patched by Kiteworks. This case emphasises the necessity of proactive patch management strategies to prevent potential exploits. Finally, we address the ongoing risks associated with WordPress vulnerabilities as noted by the SANS Internet Storm Center. Maintaining an up-to-date WordPress installation and using security plugins are crucial for safeguarding digital assets. Tune in to understand how these developments can shape your business strategies and how to effectively shield your operations against emerging threats. Chapters Intro Overview of the episode’s focus on AI and cybersecurity implications for UK SMBs. OpenAI’s GPT-6.1 Astra Discussion on the benching of GPT-6.1 Astra and the need for AI governance. CTA Encouragement to follow and share the podcast for timely updates. Kiteworks Critical Vulnerability Insights into the importance of patch management following Kiteworks’ security flaw. WordPress Vulnerabilities Exploration of WordPress vulnerabilities and strategies for securing web assets. Outro Recap of key takeaways: AI monitoring, patching vulnerabilities, and securing digital presence. Links https://www.theregister.com/ https://www.bleepingcomputer.com/ https://isc.sans.edu/

8:27

Sep 28, 2026

Citrix and Oracle Vulnerabilities: A Wake-Up Call for UK SMBs

Citrix and Oracle Vulnerabilities: A Wake-Up Call for UK SMBs In today’s episode of Threat Analysis, Mauven MacLeod delves into critical vulnerabilities affecting Citrix NetScaler ADC and Gateway products. These security flaws pose significant threats to businesses of all sizes across the UK, as cybercriminals actively exploit them. Despite existing advisories, many organisations have yet to implement necessary patches, leaving themselves vulnerable to breaches. Mauven outlines the extensive implications for small and medium-sized businesses, emphasising the importance of prompt patch management and board-level awareness. Additionally, the resurgence of the ShinyHunters group and their exploitation of Oracle PeopleSoft vulnerabilities raises further concerns. Companies, irrespective of their size, risk exposure to data breaches and reputational damage. Transparency from vendors regarding their patch management history is crucial. Mauven provides actionable steps for SMBs to safeguard against these threats, highlighting the importance of staff education alongside technical defences. Chapters Intro Introduction to the episode, focusing on Citrix vulnerabilities impacting UK businesses. Citrix Vulnerabilities Discussion on the exploitation of Citrix NetScaler ADC and Gateway vulnerabilities and their implications for UK SMBs. CTA Encouragement for listeners to subscribe and share the podcast. ShinyHunters: Renewed Attacks Examination of ShinyHunters’ attacks on Oracle PeopleSoft and implications for various sectors. Citrix’s Critical Moment Analysis of recurring vulnerabilities in Citrix products due to inadequate testing and risk management. Wider Impacts and Vendor Responsibility Exploration of the broader impacts of cybersecurity vulnerabilities on supply chains and vendor responsibilities. Actionable Steps for SMBs Guidance on patch management, vendor review, and staff education to mitigate cybersecurity risks. Outro Conclusion reinforcing the importance of vigilance, timely patching, and team preparedness. Links https://www.ncsc.gov.uk https://www.cisa.gov https://www.theregister.com

6:38

Sep 25, 2026

Navigating Critical VeloCloud Flaws and Rising Malware Tactics

Navigating Critical VeloCloud Flaws and Rising Malware Tactics In today’s episode of ‘Threat Analysis’, we delve into a critical vulnerability affecting VeloCloud Orchestrator environments. With a CVSS score of ten, this flaw allows remote attackers to potentially gain full control over VCO hosts, posing significant risks to small and medium businesses. We explore why robust systems alone aren’t enough and the crucial steps to mitigate such threats. Next, we examine the stealthy operations of the OpenSUpdater malware, exploiting open-source software flexibility. This malware disguises itself within recompiled 7zip SFX stubs, evading traditional security measures and necessitating a shift in cybersecurity strategies. Additionally, we spotlight ClickFix, a growing threat leveraging social engineering tactics through clipboard poisoning. This episode underlines the importance of fostering a security-conscious culture within organisations to combat evolving cyber threats effectively. Join Mauven as we navigate these digital challenges, advocating for proactive vigilance and robust cybersecurity practices. Chapters Intro Introduction to today’s focus on digital vulnerabilities. Critical VeloCloud Vulnerability Exploration of the severe VeloCloud Orchestrator flaw and its implications. CTA Encouragement to subscribe and spread the word about Threat Analysis. OpenSUpdater Malware Tactics Discussion on how OpenSUpdater exploits open-source software vulnerabilities. The Verdict on ClickFix Insight into ClickFix’s effective social engineering strategies. Outro Conclusion emphasising the importance of cybersecurity vigilance. Links https://www.securityweek.com/velocloud-vulnerability https://threatpost.com/opensupdater-malware https://www.csoonline.com/social-engineering-tricks

15:13

Sep 24, 2026

TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering

TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering CISA confirms ransomware gangs are actively exploiting a critical JetBrains TeamCity vulnerability patched in July, eleven weeks after the fix became available. UK SMBs face supply chain exposure through managed service providers and development partners with access to production environments. Meanwhile, the Canadian Centre for Cyber Security reports active exploitation of a four-month-old Roundcube Webmail code injection flaw that requires no user interaction beyond reading email. The ClickFix social engineering technique continues to deliver multiple malware families including PavinLoader and AvisLoader, which uses peer-to-peer infrastructure designed to outlast traditional takedown responses. This briefing examines the persistent gap between patch availability and patch application, and provides actionable guidance for UK small and medium businesses on verifying third-party patch status, confirming email infrastructure security, and implementing staff awareness controls that technical measures cannot replace. Chapters Introduction Overview of three active threats exploiting the gap between patch availability and application: JetBrains TeamCity ransomware exploitation, Roundcube Webmail active attacks, and the persistent ClickFix social engineering campaign. TeamCity Ransomware Exploitation CISA confirms ransomware groups are exploiting a critical TeamCity RCE vulnerability eleven weeks after the July patch. Examination of supply chain exposure for UK SMBs through managed service providers and development partners with access to production environments. Call to Action Encouragement to follow the show and share the briefing with colleagues who need threat intelligence. Roundcube Webmail Active Exploitation Canadian Centre for Cyber Security reports active exploitation of CVE-2026-48842, a code injection vulnerability in Roundcube Webmail, four months after the May patch. Analysis of the attack surface and guidance for UK SMBs using hosted email infrastructure. ClickFix Social Engineering Campaign Examination of the ClickFix technique as initial access vector across multiple malware campaigns including PavinLoader and AvisLoader. Guidance on staff awareness training as the primary defence against social engineering that technical controls cannot prevent. AI Command and Control Research Brief assessment of Cisco Talos CLOSEDQUORUM research on AI-directed malware. Clarification that this remains proof-of-concept rather than an operational threat currently observed in the wild. Summary and Closing Recap of actionable steps for TeamCity patch verification, Roundcube infrastructure security confirmation, and ClickFix staff briefing. Emphasis on the effectiveness of asking the right questions over technical complexity. Links https://www.cisa.gov/news-events/alerts https://cyber.gc.ca/en/guidance https://www.ncsc.gov.uk/guidance https://blog.talosintelligence.com/

16:10

Sep 23, 2026

Chrome Zero-Days, Android Banking Trojan, and VeloCloud Exploit

Chrome Zero-Days, Android Banking Trojan, and VeloCloud Exploit Five Chrome V8 vulnerabilities are under active exploitation by Chinese threat actors right now. A single malicious page visit can compromise an unpatched device without user interaction beyond the click. Meanwhile, the RemControl Android banking trojan is targeting UK financial institutions through fake app downloads, stealing credentials via Accessibility Service abuse. Arista has patched an actively exploited VeloCloud Orchestrator zero-day affecting SD-WAN infrastructure, and Microsoft’s September updates have broken Always On VPN for some Windows 11 systems. Mauven walks through the exploitation chains, the real exposure for UK SMBs, and the concrete actions required before close of business today. This is not theoretical risk. These are operational threats requiring immediate patch management, staff briefings, and infrastructure verification. Chapters Intro Chrome is being actively exploited by a Chinese threat actor. Unpatched browsers can be compromised through a single page visit with no user action beyond the click. Chrome V8: Multiple Zero-Days Under Active Exploitation Five CVEs published against Chromium’s V8 engine are confirmed under active exploitation. Chinese threat actor UTA0565 is using fake domains and phishing emails to silently exploit browsers and escalate to full device compromise. UK SMBs with unmanaged or inconsistently patched Chrome installations face immediate risk. Update Chrome across all devices today and verify browser restarts. CTA Follow the show and share with colleagues who need daily threat intelligence. RemControl: Android Banking Trojan Targeting Western European Banks RemControl is an Android banking trojan distributed via fake TVTap IPTV download pages in paid search ads. It abuses Accessibility Service permissions to inject phishing overlays on legitimate banking apps and stream device screens in real time. UK banks are in scope. Staff personal devices used for work represent soft perimeter risk. Brief staff to only install apps from official stores and decline Accessibility Service requests from non-essential apps. Arista VeloCloud Orchestrator: Actively Exploited Zero-Day Arista has patched an actively exploited zero-day in VeloCloud Orchestrator on-premises deployments. VCO manages SD-WAN infrastructure. Most UK SMBs will encounter this through managed service providers. Ask your IT provider if VCO is in your environment and confirm the patch has been applied today. September Windows Updates and Always On VPN Microsoft’s September security updates break Always On VPN on some Windows 11 systems. Remote staff losing VPN connectivity should not work around it by bypassing the VPN. Wait for Microsoft’s fix or apply their documented workaround. Do not remove the control. The Pattern Worth Noting Today’s threats exploit the browser, the phone, and the network connection. The defences are patch management, staff awareness, and infrastructure visibility. ClickFix campaigns continue to succeed through bulletproof hosting and social engineering that asks users to paste commands into Windows Run dialogs. The threat surface is everyday infrastructure. The controls are unglamorous and effective. Outro Update Chrome today, brief staff on APK risks this week, and verify VeloCloud patching if applicable. Three actions within reach before close of business. Links https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap/ https://www.group-ib.com/blog/remcontrol-android-banking-trojan/ https://www.arista.com/en/support/advisories-notices/security-advisory https://www.microsoft.com/en-us/windows/windows-11 https://www.blackhillsinfosec.com/clickfix-research/

15:40

Sep 22, 2026

Seventeen Days of Silence, Autonomous AI Implants, and a Zero-Day Router

Seventeen Days of Silence, Autonomous AI Implants, and a Zero-Day Router Today’s briefing covers three active threats that exploit gaps in oversight and attention. First, Huntress published a timeline of an INC ransomware attack that compromised 175 endpoints after a 17-day period of apparent dormancy, demonstrating how patient adversaries use dwell time as a weapon. Second, Cisco Talos released details of CLOSEDQUORUM, the first documented malware implant exhibiting fully autonomous command and control capabilities, alongside their new CAIRN research toolkit designed to hunt AI-integrated threats. Third, D-Link disclosed a maximum-severity remote code execution vulnerability in the DIR-822A router with no patch available and a public exploit already circulating. All three threats share a common characteristic: they operate in the spaces between human monitoring cycles, relying on the assumption that reduced visibility equals reduced risk. This episode provides specific, actionable guidance for UK small businesses on securing remote access, implementing behavioural monitoring, and conducting immediate network hardware audits. Chapters Introduction: The Common Thread Mauven introduces three threats united by a single characteristic: all rely on gaps in attention and monitoring to succeed. INC Ransomware: The Quiet Breach That Wasn’t Huntress timeline reveals a ransomware campaign that compromised 175 endpoints after 17 days of dormancy, demonstrating how initial access brokers and ransomware affiliates exploit dwell time. Specific guidance on securing RDP access with VPN and MFA. Call to Action Brief reminder to follow the show and share with colleagues who need threat intelligence. CLOSEDQUORUM: The First Confirmed Autonomous AI C2 Implant Cisco Talos documents the first malware with fully autonomous command and control, released alongside their CAIRN research toolkit. Analysis of operational implications and the shift from signature-based to behavioural detection requirements. D-Link DIR-822A: Maximum Severity, No Patch, Exploit Already Public D-Link discloses CVE-2026-86296, a maximum-severity RCE vulnerability in end-of-life hardware with no patch available. Immediate removal required. Context provided on Windows Defender zero-day and the importance of network hardware inventory. Closing Analysis Mauven synthesises the three threats and emphasises that effective defence relies on consistent application of basic controls and active monitoring, not sophisticated tools alone. Specific action items for UK SMBs. Links https://www.huntress.com/blog/inc-ransomware-attack-timeline https://blog.talosintelligence.com/closedquorum-autonomous-ai-malware/ https://blog.talosintelligence.com/cairn-toolkit/ https://www.dlink.com/en/security-bulletin/ https://www.ncsc.gov.uk/guidance/securing-remote-access

6:16

Sep 21, 2026

Evolving Cyber Threats Facing UK Businesses

Evolving Cyber Threats Facing UK Businesses Join Mauven MacLeod for today’s Threat Analysis as we explore significant cyber threats impacting UK businesses. We begin with TraderTraitor, a subgroup of the Lazarus Group, which has shifted focus from cryptocurrency firms to IT services providers, highlighting a strategic expansion in their attack vectors. For small businesses, this underscores the importance of cybersecurity, regardless of sector involvement. Next, we examine Head Mare’s exploit of vulnerabilities in TrueConf’s video conferencing servers using PhantomCore malware. This highlights the critical need for robust communication security amidst the rise in remote work. Finally, we cover Microsoft’s recommendation to transition from SMS-based authentication to passkeys, emphasising the importance of strengthening digital identity security. Proactive security practices, including regular audits and comprehensive patch management, are essential for enduring in today’s hostile cyber landscape. Chapters Intro Mauven introduces the episode, highlighting the interconnected nature of cyber threats affecting UK businesses. TraderTraitor’s IT Services Attack Discussion on TraderTraitor’s shift to target IT services, urging small businesses to enhance their cybersecurity measures. CTA Reminder to follow the show for daily updates and share with others. Head Mare’s PhantomCore Exploit Examination of Head Mare’s attack on TrueConf, stressing the importance of communication security and patch management. Microsoft’s Authentication Transition Coverage of Microsoft’s push towards passkey authentication, advising businesses to adopt more secure identity protocols. Outro Summary of key points and encouragement to stay proactive in cybersecurity. Links https://example.com/tradertraitor https://example.com/headmare https://example.com/microsoft-passkeys

14:14

Sep 18, 2026

Third-Party Trust Exploited: Brevo, Clop, and RMM Abuse

Third-Party Trust Exploited: Brevo, Clop, and RMM Abuse On 14 September 2026, attackers compromised Brevo’s infrastructure, injecting malicious code into JavaScript assets that reached over 100,000 customer websites. WordPress administrators had backdoor plugins silently installed while logged in; regular visitors faced ClickFix credential-harvesting overlays. Meanwhile, the Clop threat group continues exploiting CVE-2026-12569 in PTC Windchill with a custom web shell built for rapid data exfiltration, targeting UK manufacturing and engineering supply chains. A third campaign involves Settra ransomware maintaining persistence via MeshAgent, a legitimate remote monitoring tool that endpoint security often trusts by default. All three attacks share one structural weakness: reliance on third-party platforms, scripts, and tools that UK small businesses cannot directly audit or control. This briefing walks through the mechanics of each campaign, explains why supply chain compromise scales so effectively, and sets out the specific questions business owners must ask their web developers, IT providers, and managed service providers today. No patch can protect you from a script you load from someone else’s content delivery network, and no endpoint tool will flag an RMM agent it has been trained to trust. The NCSC has published supply chain guidance repeatedly; these campaigns demonstrate how rarely it is applied in practice. Chapters Intro Mauven frames the common vulnerability across today’s campaigns: reliance on third-party platforms that UK small businesses cannot audit, patch, or monitor in real time. Brevo Supply Chain Attack On 14 September 2026, attackers compromised Brevo’s infrastructure, injecting malicious JavaScript that silently installed WordPress backdoor plugins on admin machines and delivered ClickFix credential-harvesting overlays to visitors across over 100,000 customer sites. CTA Mauven asks listeners to follow the show and share it with colleagues who need the briefing. Clop Returns with a Custom Implant The Clop threat group is exploiting CVE-2026-12569 in PTC Windchill with a custom web shell built for rapid credential harvesting, database enumeration, and data exfiltration, targeting UK manufacturing and engineering businesses. Settra Ransomware and RMM Abuse Settra ransomware maintains persistence by installing MeshAgent, a legitimate remote monitoring tool that endpoint security trusts by default, making unauthorised access harder to detect. The Wider Pattern Mauven connects all three campaigns to the same structural weakness: shared platforms, scripts, and tools that businesses cannot directly control, and the persistent gap between available NCSC guidance and real-world application. Outro Mauven summarises the specific actions listeners must take today: audit Brevo-linked sites, confirm PTC Windchill patches, and ask MSPs which RMM agents are authorised and how unauthorised ones would be detected. Links https://sansec.io/research/brevo-supply-chain-attack https://www.ncsc.gov.uk/collection/supply-chain-security https://www.reliaquest.com/blog/clop-ransomware-ptc-windchill-cve-2026-12569/ https://www.huntress.com/blog/settra-ransomware-analysis

13:56

Sep 17, 2026

Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action

Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action Two critical threats require immediate attention from UK businesses today. Cisco has disclosed an authentication bypass vulnerability in its Identity Services Engine with a maximum CVSS score of 10.0, and exploitation is already confirmed as active. ISE functions as a network gatekeeper for VPN, device compliance, and access control, making this vulnerability a direct path to your network perimeter. Separately, the GhostCode phishing technique weaponises Microsoft’s legitimate OAuth device code flow to bypass multi-factor authentication entirely. The attack arrives via business contact forms, presents victims with authentic Microsoft URLs, and produces valid session tokens that persist even after password resets. Analysis of ransomware activity in Japan reveals that 80 per cent of victims had capital under one billion yen, confirming that small and medium businesses are the majority of targets, not the exception. With Windows 11 24H2 reaching end of support in October 2026, unpatched endpoints remain a consistent entry point in post-breach analysis. This briefing provides specific actions for patching, MFA hardening, conditional access policies, and session revocation. Chapters Introduction Mauven introduces two urgent threats: a Cisco vulnerability with active exploitation and a phishing technique that bypasses MFA controls most organisations rely on. Cisco ISE Authentication Bypass (CVSS 10.0) Analysis of the critical Cisco Identity Services Engine vulnerability with confirmed active exploitation, explaining why network access control systems are high-value targets and providing immediate patching guidance. Call to Action Encouragement to follow the show and share with business owners and IT providers who need timely threat intelligence. GhostCode OAuth Device Code Phishing Detailed breakdown of the GhostCode phishing kit that abuses Microsoft’s OAuth 2.0 device authorisation flow to bypass MFA, including detection indicators and specific mitigation steps. Ransomware Targeting of Smaller Businesses Analysis of Cisco Talos data showing 80 per cent of ransomware victims in Japan were small and medium enterprises, challenging the assumption that smaller size reduces risk. Windows 11 24H2 End of Support Reminder that Windows 11 24H2 Home and Pro editions reach end of support in October 2026, with guidance on fleet assessment and update planning. Outro Recap of the two key takeaways: immediate patching and verification actions, and the structural reality that small businesses are primary ransomware targets. Links https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-FweYPvM8 https://www.esentire.com/blog/ghostcode-phishing-campaign-targets-businesses-via-contact-forms https://blog.talosintelligence.com/threat-roundup-0905-0912/ https://support.microsoft.com/en-us/windows/windows-11-version-24h2-update-history-0929c747-ca28-4e21-93d3-0d56f5c7f1b4

13:28

Sep 16, 2026

ScreenConnect Exploited, OAuth Device Phishing, and Pixel Zero-Day

ScreenConnect Exploited, OAuth Device Phishing, and Pixel Zero-Day CISA has confirmed active exploitation of a critical ConnectWise ScreenConnect vulnerability, the remote access tool used by countless UK IT providers to support small business clients. Attackers are targeting managed service providers to gain indirect access to entire client portfolios. Meanwhile, the GhostCode phishing campaign is bypassing traditional defences by abusing Microsoft’s legitimate OAuth device code flow, landing in inboxes through web contact forms and requiring no fake login pages. Finally, Google has patched a zero-day privilege escalation flaw in Pixel devices that was exploited in targeted attacks. This briefing explains why these threats matter to UK SMBs, what the attack patterns look like in practice, and what concrete actions business owners and IT managers should take today. Mauven MacLeod delivers the technical detail and the operational context that turns threat intelligence into defensible decisions. Chapters Introduction Mauven introduces two active threats targeting UK small businesses through legitimate infrastructure: a remotely exploited ScreenConnect flaw and an OAuth device phishing technique that bypasses traditional defences. ScreenConnect: CISA Confirms Active Exploitation CISA has added a critical ConnectWise ScreenConnect vulnerability to its Known Exploited Vulnerabilities catalogue. Attackers are targeting IT providers to gain indirect access to their SMB clients. Business owners are advised to verify their MSP has patched the tool and to understand the supply chain risk. Call to Action A reminder to follow the show and share the briefing with colleagues who need the information. GhostCode: OAuth Device Phishing eSentire has documented the GhostCode phishing kit, which abuses Microsoft’s OAuth device code flow to gain persistent access to Microsoft 365 accounts. The campaign impersonates procurement officers, uses web contact forms, and directs victims to legitimate Microsoft URLs, bypassing traditional phishing defences. Pixel Zero-Day Google’s September 2026 patch for Pixel devices includes a fix for a zero-day privilege escalation vulnerability exploited in targeted attacks. Organisations using Pixel devices should install the update immediately. Closing Remarks Mauven summarises the three practical actions listeners should take: verify ScreenConnect patch status with IT providers, brief staff on OAuth device code phishing indicators, and review OAuth app consents in Microsoft Entra admin centre. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.esentire.com/ https://otx.alienvault.com/ https://www.ncsc.gov.uk/ https://support.google.com/pixelphone/answer/4457705

14:09

Sep 15, 2026

Web Skimmers, IoT Botnets, and Search Engine Fraud: Trust Under Attack

Web Skimmers, IoT Botnets, and Search Engine Fraud: Trust Under Attack Three active cybercriminal campaigns are exploiting trust in routine business systems. GrelosGTM injects payment skimmers into Google Tag Manager containers on compromised e-commerce sites, bypassing traditional file integrity checks and PCI compliance tools. Two IoT malware families, KATARU and Evooo1Bot, are scanning for unpatched edge devices using vulnerabilities dating back to 2007, turning compromised routers and network appliances into proxy infrastructure. Meanwhile, criminals are creating convincing fake versions of legitimate financial portals that surface in organic search results through typosquatting and Punycode manipulation. Each campaign targets a different attack surface, but all exploit the same underlying assumption: that familiar tools, devices, and search results are inherently trustworthy. Mauven MacLeod examines the behavioural incentives that make these attacks effective and outlines practical steps UK businesses can take today to audit their Google Tag Manager containers, verify firmware on internet-facing devices, and reduce social engineering risks through simple URL management practices. Chapters Introduction Overview of three active campaigns exploiting trust in marketing tools, network hardware, and search engine results. GrelosGTM: Payment Skimming Hidden Inside a Marketing Tool Group-IB research on a cybercriminal group injecting malicious scripts into Google Tag Manager containers on Magento e-commerce sites. Practical audit steps for UK businesses. Call to Action Encouragement to follow the show and share with small business owners. KATARU and Evooo1Bot: Two IoT Botnets Scanning for Unpatched Devices Two Mirai-derived botnets exploiting weak credentials and decades-old vulnerabilities in internet-facing edge devices. Includes FortiGate SSL-VPN intrusion campaign detail and firmware audit checklist. Search Engine Fraud: Fake Crypto Gift Card Checkouts Criminals creating convincing fake versions of legitimate portals that appear in organic search results through typosquatting and Punycode manipulation. Simple URL management mitigations. Closing Connecting thread across all three campaigns and practical takeaway: audit the things you have stopped looking at. Links https://www.group-ib.com/resources/research-hub/grelosgtm/ https://www.nozominetworks.com/blog/kataru-botnet-exploits-iot-devices/ https://www.infosecurity-magazine.com/news/evooo1bot-botnet-targets-iot/ https://hunt.io/blog/cve-2024-21762-fortinet-ssl-vpn-exploitation https://www.malwarebytes.com/blog/scams/2026/09/fake-bitrefill-sites-search-engine-fraud https://www.ncsc.gov.uk/guidance/securing-e-commerce-sites

13:35

Sep 14, 2026

Revolut Social Engineering Breach and GitLab Path Traversal Exploit

Revolut Social Engineering Breach and GitLab Path Traversal Exploit A major fintech data breach demonstrates how impersonation attacks bypass technical defences entirely, whilst a maximum-severity GitLab vulnerability enters active exploitation. This episode examines Revolut’s disclosure of customer financial and passport data released following a fraudulent government agency impersonation, highlighting the procedural failures that enable social engineering at scale. We cover CISA’s addition of a GitLab path traversal flaw to the Known Exploited Vulnerabilities catalogue, the supply chain implications for UK SMBs, and practical verification procedures that prevent data disclosure to unauthorised parties. Operational updates include Microsoft’s September patches breaking Remote Desktop Services on Windows Server, and the UK government’s passkey rollout across 23 million GOV.UK accounts. The episode focuses on verification protocols, out-of-band confirmation procedures, and supply chain questioning as practical defences against non-technical attack vectors that compromise organisations with significant security resources. Chapters Introduction Mauven introduces the episode focus on a fintech breach achieved through convincing impersonation rather than technical exploitation, setting up the central theme of procedural failures in data handling. Revolut Breach via Government Impersonation Analysis of Revolut’s data breach following a fraudulent government agency request, examining the social engineering mechanism, customer impact, verification procedure failures, and practical implementation of out-of-band confirmation protocols for UK SMBs handling data disclosure requests. CTA Call to action encouraging listeners to follow the show and share with colleagues handling data requests and code repositories. GitLab Path Traversal Flaw, Actively Exploited, Maximum Severity Coverage of CISA’s addition of a GitLab path traversal vulnerability to the Known Exploited Vulnerabilities catalogue, explanation of path traversal attack mechanics, supply chain exposure risks through developer and MSP relationships, and immediate patching requirements. September Windows Updates and RDS Microsoft’s September 2026 security updates breaking Remote Desktop Services functionality on Windows Server, the patching versus functionality trade-off, and recommendations for planned deployment with awareness of the known issue. UK Government Passkey Rollout UK government’s passkey implementation across 23 million GOV.UK accounts, the stated rationale of reducing phishing exposure and SMS verification costs, and implications for SMB authentication strategy beyond SMS-based MFA. Outro Summary emphasising that high-impact attacks often require minimal technical sophistication, practical actions on verification procedures and supply chain patching status, and closing remarks. Links https://www.ncsc.gov.uk/guidance/impersonation-attacks https://www.ncsc.gov.uk/collection/guidelines-secure-system-configuration https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.gov.uk/government/news/passkeys-rollout-govuk-accounts

16:56

Sep 11, 2026

Russian State Actors Target Business Travellers via Hotel Wi-Fi

Russian State Actors Target Business Travellers via Hotel Wi-Fi This episode examines three active threat campaigns with direct SMB relevance. Russian state group APT29 (Midnight Blizzard) is conducting large-scale credential harvesting through compromised hotel and conference Wi-Fi networks across the UK and Europe, specifically targeting business travellers. The operation exploits captive portal authentication flows to harvest Microsoft 365 credentials through spoofed login pages and device code phishing that bypasses MFA. A second campaign demonstrates AI-orchestrated exploitation of PaperCut print management software, progressing from vulnerability research to remote code execution in under four hours across 440+ installations. The episode also covers a maximum-severity GitLab path traversal vulnerability and recent Conti ransomware sentencing. Analysis focuses on the systematic targeting of authentication layers, the operational risk to SMBs from compromised cloud tenancies, and the acceleration of exploit development through AI automation. Practical guidance addresses device code flow controls, conditional access policies, VPN discipline for travelling staff, and the limitations of MFA as a single defensive layer. Chapters Introduction: Active Campaigns Targeting Business Travellers Overview of Russian state-sponsored credential harvesting via UK hotel Wi-Fi networks and AI-orchestrated PaperCut exploitation campaign. Episode positions APT29 activity as immediate SMB threat rather than purely government-sector concern. CaptiveCrunch: APT29 Hotel Wi-Fi Credential Harvesting Detailed analysis of Midnight Blizzard (APT29) campaign exploiting captive portal networks at hotels and conferences. Explains device code phishing technique that bypasses MFA, SMB impact from compromised Microsoft 365 tenancies, and four immediate mitigation actions including device code flow controls and conditional access policies. Call to Action Listener engagement request to follow show and share briefing given active campaign status. AI-Orchestrated PaperCut Exploitation Analysis of CVE-2026-81578 and CVE-2026-82078 exploitation campaign against PaperCut print management software. Details AI agent automation achieving remote code execution in under four hours across 440+ targets. Provides specific guidance on patch verification, internet exposure assessment, and compromise indicators. GitLab Vulnerability and Conti Sentencing Brief coverage of CVE-2026-85706 maximum-severity GitLab path traversal vulnerability requiring immediate patching. Notes Ukrainian national receiving four-year sentence for Conti ransomware development, with analysis positioning outcome as illustrating enforcement limitations rather than meaningful deterrent. The Wider Pattern: Authentication Layer Under Systematic Attack Synthesis identifying authentication layer as common target across multiple active campaigns. Argues current threat landscape reflects prioritisation failure rather than technology limitation, given documented NCSC guidance on phishing-resistant MFA and conditional access controls. Closing: Practical Takeaways Summary of actionable guidance: disable unnecessary device code flow, patch PaperCut installations, brief travelling staff on captive portal risks before conference season. Links https://www.zscaler.com/blogs/security-research/ https://www.ncsc.gov.uk/ https://www.greynoiseintell.com/ https://blackpointcyber.com/ https://www.bleepingcomputer.com/ https://about.gitlab.com/releases/categories/security/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.microsoft.com/security/blog/

14:12

Sep 10, 2026

WatchGuard Ransomware Exploitation and Chrome Zero-Day Chain Target UK SMBs

WatchGuard Ransomware Exploitation and Chrome Zero-Day Chain Target UK SMBs Two active exploitation campaigns are affecting UK small businesses today. Ransomware operators are exploiting a critical WatchGuard Firebox vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalogue in December 2025, yet remains unpatched in many deployments nine months later. The flaw allows remote, unauthenticated code execution on internet-facing devices. Separately, four China-aligned threat actors have adopted an identical Chrome and Windows zero-day exploit chain within days of each other, enabling full system compromise through a single malicious webpage visit. The BlueMoon exploit kit combines CVE-2026-85046 in Chrome’s V8 engine with CVE-2026-85880 in the Windows kernel. Patches are available for both campaigns. Additionally, Cisco Secure Firewall Management Center is under active exploitation via two vulnerabilities that grant administrative control, with possible connections to the Qilin ransomware group. Today’s briefing provides specific remediation steps for each threat and examines why a nine-month-old vulnerability continues to find victims, highlighting fundamental patch management failures across the UK SMB sector. Mauven frames the discussion around visibility, accountability, and the compression of exploitation windows in modern threat environments. Chapters Introduction Mauven opens the tenth of September 2026 briefing with two active exploitation events affecting UK small businesses: a nine-month-old WatchGuard vulnerability now used by ransomware operators, and a browser-based zero-day chain adopted by four state-aligned actors within days. WatchGuard Firebox Ransomware Exploitation CISA confirms ransomware gangs are actively exploiting a critical remote code execution flaw in WatchGuard Firebox appliances. The vulnerability was added to the KEV catalogue in December 2025, yet remains unpatched in many UK SMB deployments. Ransomware operators use automated scanning to find vulnerable devices. Mauven emphasises the need to verify firmware versions immediately and obtain written confirmation from managed service providers. Call to Action Mauven encourages listeners to follow the show and share it with colleagues who need daily threat intelligence. BlueMoon Chrome Zero-Day Exploit Chain Proofpoint and Volexity report on the BlueMoon exploit kit, which chains CVE-2026-85046 in Chrome’s V8 engine with CVE-2026-85880 in the Windows kernel. Four China-aligned threat actors adopted identical exploitation within days, suggesting coordinated or brokered tooling. The attack requires only visiting a compromised webpage and achieves full system compromise. Patches are available from Google and Microsoft’s September 2026 Patch Tuesday. Cisco Secure Firewall Management Center Exploitation Cisco Talos tracks active exploitation of CVE-2026-20079 and CVE-2026-20316 in Cisco Secure Firewall Management Center, which together grant administrative control. Possible connections to the Qilin ransomware group are noted. The vulnerability primarily affects mid-market professional services and managed security provider infrastructure. Patch Management Reality Check Mauven examines the operational reality of three network security products under active exploitation in the same news cycle. The continued exploitation of a nine-month-old WatchGuard vulnerability demonstrates that patch management is treated as optional despite NCSC guidance. The core issue is visibility: organisations must be able to answer which internet-facing devices and applications were updated in the last thirty days. Closing and Practical Takeaway Mauven summarises the immediate action items: confirm WatchGuard Firebox firmware is current and verify Chrome and Windows updates are applied across all devices. Listeners are encouraged to demand specific answers from IT providers, not vague reassurances. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.proofpoint.com/us/blog/threat-insight/bluemoon-exploit-kit https://www.volexity.com/blog/2026/09/bluemoon-exploit-chain-analysis/ https://www.watchguard.com/security-advisories https://blog.talosintelligence.com/cisco-fmc-vulnerabilities/ https://www.ncsc.gov.uk/guidance/patch-management

5:47

Sep 9, 2026

UK Cybersecurity: Patch Tuesday and New Threats

UK Cybersecurity: Patch Tuesday and New Threats In today’s briefing, Mauven examines key cybersecurity threats relevant to UK businesses. Microsoft’s record Patch Tuesday reveals 973 vulnerabilities, with 113 rated as critical, highlighting the urgency for timely updates. Two zero-day vulnerabilities pose active risks. Small and medium UK businesses often underestimate their appeal to cybercriminals, leaving systems vulnerable. Additionally, Plex Media Servers have over 36,000 exposed units due to security lapses, stressing the need for rigorous patch compliance. The emergence of the BlueMoon exploit chain underlines the danger of using outdated software, as state actors weaponise newly discovered vulnerabilities in platforms like Chrome and Windows. Maintaining up-to-date systems is imperative to prevent costly breaches and attacks. The episode concludes with a reminder that procrastination with updates can be perilous, urging businesses to prioritize security. Chapters Intro Introduction to today’s cybersecurity briefing, highlighting the importance of system updates. Microsoft’s Record Patch Tuesday Analysis of Microsoft’s 973 vulnerabilities, including 113 critical ones and two active zero-day threats, stressing the importance of updates. CTA Encouragement to follow the podcast for regular updates and share with others. Plex Media Servers Threat Discussion on the vulnerabilities in over 36,000 exposed Plex Media Servers and the importance of patch compliance. BlueMoon Exploit Chain Insight into the BlueMoon exploit chain and how outdated systems are exploited by state actors, emphasising the need for current systems. Outro Final thoughts on the critical nature of timely system updates for business survival. Links https://www.ncsc.gov.uk https://www.microsoft.com/security/blog https://www.shadowserver.org

5:55

Sep 8, 2026

Cyber Threats Every UK SME Must Address Today

Cyber Threats Every UK SME Must Address Today In this episode of Threat Analysis, hosted by Mauven, we delve into pressing cybersecurity threats facing UK small and medium-sized businesses (SMEs). We begin with the StyleSmuggler zero-day vulnerability targeting Magento and Adobe Commerce. Identified as CVE-2025-54236, this flaw allows unauthorised remote code execution, which underscores the importance of immediate patching. Despite Adobe’s emergency patch, many SMEs remain vulnerable due to a lack of awareness or resources. We also explore the BigBear 2.0 phishing campaign, which successfully obtained credentials from over five thousand Microsoft 365 accounts globally. This highlights the increasing adoption of phishing-as-a-service models, making it vital for businesses to implement multifactor authentication and foster a culture of vigilance. Mauven emphasises the need for rapid patch management and strong phishing defenses, encouraging businesses to prioritise vulnerabilities based on their potential impact. Through proactive measures and informed strategies, UK SMEs can safeguard against emerging cyber threats. Chapters Intro Introduction to today’s cybersecurity threats for UK SMEs. StyleSmuggler Zero-Day in Magento Explanation of the StyleSmuggler vulnerability and the need for urgent patching. CTA Encouragement to follow and share the podcast. BigBear Phishing Campaign Targets Microsoft 365 Details of the BigBear phishing campaign and the importance of multifactor authentication. Implications for UK SMBs Discussion on the necessity of strong cybersecurity measures for UK SMEs. Outro Conclusion emphasising proactive defense and awareness. Links https://www.theregister.com/2025/11/15/microsoft_365_bigbear_campaign https://adobe-patches.com/magento-styleSmuggler

6:42

Sep 7, 2026

Magento Zero-Day Threat and Crypto Heist Insights

Magento Zero-Day Threat and Crypto Heist Insights Mauven delves into pressing cybersecurity issues facing UK businesses. The alarming zero-day vulnerability in Magento, known as Stylesmuggler, threatens e-commerce operations with unauthorised remote code execution risks. The episode stresses the importance of immediate action, such as disabling unnecessary services and utilising robust web application firewalls until Adobe releases a patch. Additionally, the recent $320 million cryptocurrency heist from Liquid Network serves as a wake-up call for digital currency security, urging businesses to adopt offline cold storage solutions and perform comprehensive protocol audits. The episode also covers the significant data breach at Mathspace due to insufficient Metabase security, underscoring the need for encryption and third-party compliance. The vulnerability in ConnectWise’s ScreenConnect tool alerts managed service providers to engage actively with vendors for updates. Across these discussions, the emphasis remains on pre-emptive actions and maintaining robust security measures. Chapters Intro Introduction to threats impacting UK businesses, focusing on Magento vulnerability. Unpatched Magento Zero-Day Vulnerability Details on the Magento Stylesmuggler zero-day vulnerability affecting UK e-commerce. CTA Call to action for listeners to subscribe and share the podcast. Liquid Network $320M Cryptocurrency Heist Discussion on the significant cryptocurrency heist and its implications. Mathspace Data Breach: Lessons in Data Management Analysis of the Mathspace data breach and its impact on data management practices. ConnectWise ScreenConnect Vulnerability Examination of vulnerabilities in ConnectWise’s ScreenConnect tool. Outro Conclusion with a focus on the importance of proactive security measures. Links https://www.magento.com/security https://www.liquid.network/blog/august-2026-security-incident https://www.mathspace.com/security https://www.connectwise.com/the-latest-on-security

16:03

Sep 3, 2026

Access Management Failures: Teams Impersonation, Infostealer Sessions, and Leaver Risk

Access Management Failures: Teams Impersonation, Infostealer Sessions, and Leaver Risk Three separate incidents this week reveal a single, critical vulnerability across UK small businesses: access management. Microsoft Threat Intelligence has confirmed an active campaign exploiting Teams external collaboration to impersonate IT helpdesk staff, tricking employees into installing remote access tools that deploy malicious payloads. Meanwhile, new analysis shows that resetting passwords after infostealer compromise leaves authenticated session tokens active, allowing attackers continued access for days. A separate case study documents a terminated employee retaining elevated access long enough to cause hundreds of thousands in damages, purely because no formal offboarding checklist existed. The technical controls to prevent all three scenarios are available and documented. What is missing is operational discipline: caller verification before granting remote access, session revocation alongside password resets, and comprehensive leaver access audits. This episode provides specific, actionable guidance for small businesses without dedicated security teams, walking through the configuration changes, staff briefings, and process checklists required to close these gaps before they are exploited. Chapters Introduction Overview of three incidents that all point to access management as the primary UK SMB vulnerability right now, with context from yesterday’s coverage and Microsoft’s new formal confirmation. Attackers Impersonating IT Helpdesk via Microsoft Teams Detailed breakdown of the confirmed Microsoft Teams helpdesk impersonation campaign, including the full technical chain from initial contact to lateral movement, and specific configuration and process changes required to mitigate the risk. Call to Action Brief listener engagement prompt. Infostealer Sessions: The MFA Problem Nobody Is Talking About Analysis of the session token problem in infostealer incidents, why password resets alone are insufficient, and the specific session revocation steps required in Microsoft 365 and other platforms. The Leaver Who Kept Access Case study of a terminated employee retaining elevated access due to absent offboarding processes, with practical guidance on access audits and leaver checklists for small businesses. The Pattern Connecting All Three Synthesis of the common access management gap across all three incidents and the operational discipline required to close it. Closing Practical takeaway and episode close. Links https://www.microsoft.com/en-us/security/blog/threat-intelligence/ https://www.huntress.com/ https://www.ncsc.gov.uk/guidance/phishing-resistant-authentication https://www.bleepingcomputer.com/ https://unit42.paloaltonetworks.com/ https://www.theregister.com/ https://www.ncsc.gov.uk/collection/identity-and-access-management

15:33

Sep 2, 2026

SonicWall Zero-Days, Teams Vishing Campaign, and Third-Party Identity Risk

SonicWall Zero-Days, Teams Vishing Campaign, and Third-Party Identity Risk On 2 September 2026, SonicWall disclosed two vulnerabilities in the SMA1000 remote access appliance series being actively chained together for remote code execution at the time of public disclosure. This episode provides immediate guidance for organisations running SonicWall perimeter devices, including patch verification and compromise auditing procedures. The briefing examines the Spring Ring campaign, a sustained Microsoft Teams vishing operation documented by Unit 42 that successfully targeted over 150 employees across ten companies between January and April 2026, using impersonated IT helpdesk calls to deploy remote monitoring tools and credential theft techniques including PetitPotam. Coverage includes Dropbox account compromises resulting from a Lenovo email verification flaw, illustrating third-party identity risk in business service authentication. Additional notes cover the multi-agency Sality botnet takedown after 23 years of operation, and emerging UK cyber legislation placing regulatory responsibility for AI deployment risk on end-user organisations rather than vendors. Chapters Introduction Overview of three critical threat developments requiring immediate action, particularly a SonicWall zero-day exploitation event disclosed whilst under active attack. SonicWall SMA1000: Two Chained Zero-Days Under Active Exploitation Detailed analysis of actively exploited server-side request forgery and command injection vulnerabilities in SonicWall SMA1000 remote access appliances, with specific guidance on patch verification and compromise auditing for affected organisations. Call to Action Listener engagement prompt encouraging subscription and peer sharing of threat intelligence briefings. Microsoft Teams Vishing: Spring Ring Targeted 150+ Employees Across 10 Companies Comprehensive examination of the Spring Ring social engineering campaign using Microsoft Teams voice calls to impersonate IT helpdesk staff, including technical details of PetitPotam credential theft and practical staff briefing guidance. Dropbox Accounts Breached via Lenovo Email Verification Flaw Case study in third-party identity risk, covering Dropbox account compromises resulting from a vulnerability in Lenovo’s email verification process, with recommendations for identity provider auditing and multi-factor authentication. In Brief: The Sality Botnet Is Down Multi-agency disruption of the Sality botnet after 23 years of operation, including context on infected system remediation. A Note on the UK Cyber Bill Policy development update on UK cyber legislation framing regulatory responsibility for AI deployment risk on end users rather than vendors. Closing Summary of priority actions and episode conclusion. Links https://www.sonicwall.com/ https://unit42.paloaltonetworks.com/ https://www.ncsc.gov.uk/ https://www.dropbox.com/ https://www.crowdstrike.com/ https://www.shadowserver.org/ https://www.theregister.com/

16:06

Sep 1, 2026

Exchange Auth Bypass, PaperCut Data Theft, and Softaculous Supply Chain Attack

Exchange Auth Bypass, PaperCut Data Theft, and Softaculous Supply Chain Attack Nearly 22,000 Microsoft Exchange servers remain unpatched for a critical authentication bypass vulnerability allowing complete mailbox takeover. PaperCut print management software, deployed across thousands of UK offices, is actively exploited for data theft days after a patch was released. A 33-hour BGP hijack of Softaculous infrastructure may have poisoned the hosting supply chain for small business websites. This briefing provides specific verification steps for IT providers, explains why the window between patch release and exploitation continues to shrink, and connects these incidents to wider supply chain and social engineering threats including Teams vishing campaigns and fake CAPTCHA attacks. For UK small businesses running on-premises Exchange, PaperCut installations, or shared hosting websites, today’s combination represents direct and immediate exposure requiring same-day action. Chapters Introduction Three active threats with direct paths into UK small business environments: 22,000 unpatched Exchange servers, active PaperCut exploitation for data theft, and a 33-hour BGP hijack of Softaculous infrastructure. CVE-2026-62911: Exchange Authentication Bypass High-severity vulnerability allowing unauthenticated attackers to hijack all user mailboxes on 22,000 internet-exposed Exchange servers. Verification steps for IT providers and the organisational failure behind persistent Exchange patching delays. Listener Call to Action Encouragement to follow the show and share with those running on-premises Exchange or shared hosting sites. PaperCut Zero-Day Exploitation and Active Data Theft Two PaperCut vulnerabilities patched last week now actively exploited for data theft campaigns. The shrinking window between patch release and exploitation, and why data theft differs from ransomware in detection and response. Softaculous BGP Hijack and Supply Chain Exposure Explanation of BGP hijacking mechanism and the 33-hour interception of Softaculous traffic affecting shared hosting infrastructure. Supply chain attack implications for small business websites and required audit steps. Wider Threat Context Connections between today’s threats and broader patterns including Teams vishing campaigns, ClickFix fake CAPTCHA attacks, and the shift from perimeter to user-focused initial access vectors. Closing Actions and Summary Three immediate actions: verify Exchange patch status, confirm PaperCut updates and check for prior compromise, audit shared hosting credentials and installations. Service level agreement implications if IT providers cannot respond within one working day. Links https://www.bleepingcomputer.com/news/security/22-000-microsoft-exchange-servers-exposed-to-auth-bypass-attacks/ https://www.theregister.com/2026/08/29/softaculous_bgp_hijack/ https://unit42.paloaltonetworks.com/spring-ring-vishing-campaign/ https://www.microsoft.com/security/blog/terminalfix-campaign

16:08

Aug 31, 2026

Airport Breach, Terminal Attacks, and Defender Alert Fatigue

Airport Breach, Terminal Attacks, and Defender Alert Fatigue Manchester Airports Group has suffered a confirmed data breach larger than initially disclosed, with 86GB of validated customer and travel records now in threat actor hands. UK businesses with corporate travel through Manchester, Stansted, or East Midlands face immediate phishing risk. Meanwhile, the TerminalFix campaign bypasses email defences entirely by tricking users into executing malicious PowerShell commands through fake Cloudflare CAPTCHA overlays on compromised websites. Microsoft Defender’s broken status alerts, with official guidance to ignore warnings, create a window where genuine malware could disable endpoint protection undetected. Mauven examines the gap between initial breach disclosures and validated impact, the social engineering techniques that route around traditional defences, and why session token theft from infostealer malware cannot be resolved by password resets alone. Practical guidance includes staff briefings on travel data targeting, application control policies for Windows Terminal, and management-layer monitoring to compensate for unreliable user-facing alerts. Chapters Introduction Overview of three active threats affecting UK businesses: a confirmed airport breach with validated stolen data, a social engineering campaign designed to bypass email defences, and a Microsoft Defender issue creating alert fatigue. Manchester Airports Group Breach FulcrumSec claims 86GB data theft from Manchester Airports Group, with independently validated customer and travel records. Analysis of the disclosure gap, targeting risks for corporate travel, and practical steps for businesses with MAG connections. Call to Action Encouragement to follow the show and share the episode with UK business contacts who need awareness of the Manchester Airports situation. TerminalFix Campaign Microsoft’s analysis of TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHA overlays on compromised websites to trick users into executing malicious PowerShell commands through Windows Terminal, bypassing email-based defences entirely. Microsoft Defender Alert Fatigue Latest Defender update causes false ‘antivirus is turned off’ alerts, with Microsoft advising users to ignore warnings. Implications for security culture and the need for management-layer monitoring during the issue. Infostealer Session Theft Anthropic confirms Claude session token theft via infostealer malware, illustrating broader principle that stolen session cookies remain valid after password resets and require explicit session revocation across all platforms. Closing Summary of common theme across stories: existing defences do not address current attack vectors. Three immediate actions for UK businesses: brief staff on MAG breach targeting, educate on terminal-based social engineering, and implement management-layer Defender monitoring. Links https://www.bleepingcomputer.com/news/security/manchester-airports-group-investigates-fulcrumsec-data-breach-claims/ https://www.microsoft.com/en-us/security/blog/2024/08/30/terminalfix-campaign-uses-fake-cloudflare-verification-to-deliver-malware/ https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-falsely-warns-that-antivirus-is-turned-off/ https://www.anthropic.com/news/session-token-theft-incident https://www.ncsc.gov.uk/guidance/business-email-compromise https://www.ncsc.gov.uk/guidance/social-engineering

17:36

Aug 28, 2026

Zero-Day Print Server Exploits, Teams Vishing, and Firmware Implants

Zero-Day Print Server Exploits, Teams Vishing, and Firmware Implants This episode examines three active threats targeting UK small businesses through infrastructure that is often managed inattentively. PaperCut print management servers face active zero-day exploitation with no official vendor patch available, forcing organisations to choose between unvalidated emergency fixes or taking systems offline. A Microsoft Teams vishing campaign, running since January 2026, uses social engineering and the legitimate Windows Quick Assist tool to deploy the GoGRPC backdoor for ransomware operators. Research into ZBT router firmware reveals three pre-installed implants, including DARKLANTERN, an unauthenticated backdoor offering root shell access. The episode also covers critical ServiceNow vulnerabilities, over 8,300 unpatched Gitea instances facing active exploitation, and CISA’s observation that most exploited vulnerabilities in 2026 should have been eradicated decades ago. The common thread is infrastructure that organisations do not actively monitor: print servers, router firmware, and remote access tools that staff use without scrutiny. Mauven provides specific, actionable guidance for each threat, emphasising that the surfaces receiving least attention from defenders are those being studied most carefully by attackers. Chapters Introduction Overview of three active threats targeting infrastructure that UK small businesses manage inattentively: a print server zero-day, an eight-month Teams vishing campaign, and firmware implants in routers. PaperCut Zero-Day: Active Exploitation, No Official Patch PaperCut print management servers face active zero-day exploitation with no validated vendor patch. The software, widely deployed in UK SMBs, has administrative access to networked devices and was previously exploited by ransomware groups in 2023. Organisations must choose between applying an unvalidated emergency patch or taking servers offline. Call to Action Brief listener engagement request. Microsoft Teams Vishing: GoGRPC Backdoor and the Ransomware Pipeline Zscaler research details an eight-month campaign using Microsoft Teams vishing and the legitimate Windows Quick Assist tool to deploy the GoGRPC backdoor. Attackers impersonate IT support, gain remote access, and sell network access to ransomware operators. The attack exploits normalised IT support behaviours. Firmware Implants in the Supply Chain: ZBT Routers VulnCheck identifies three firmware implants in ZBT routers distributed globally: SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS. DARKLANTERN provides unauthenticated root shell access via UDP port 9992. The implants were present in firmware before devices reached customers, representing a hardware-layer supply chain compromise. ServiceNow, Gitea, and the CISA Observation Three maximum-severity vulnerabilities patched in ServiceNow AI Platform. Over 8,300 internet-exposed Gitea instances remain unpatched against actively exploited remote code execution flaws. CISA notes that most exploited vulnerabilities in 2026 should have been eradicated decades ago, citing organisational culture failures. Closing Remarks The common thread across all threats is infrastructure inattention. Print servers, router firmware, and remote access tools that organisations do not actively monitor are precisely the surfaces attackers study most carefully. Practical guidance emphasises active management of unglamorous infrastructure. Links https://www.theregister.com/ https://www.papercut.com/ https://www.ncsc.gov.uk/ https://www.zscaler.com/blogs/security-research/ https://www.microsoft.com/ https://vulncheck.com/ https://www.servicenow.com/ https://www.shadowserver.org/ https://www.cisa.gov/

13:59

Aug 27, 2026

NCSC Edge Device Warning, Manchester Airports Breach, and Teams Vishing

NCSC Edge Device Warning, Manchester Airports Breach, and Teams Vishing Today’s briefing examines three urgent threats to UK small businesses. The NCSC has issued a fresh alert on internet-exposed edge devices, highlighting persistent failures in patch management and configuration that attackers are actively exploiting. Manchester Airports Group has confirmed a breach affecting 8.7 million UK customers, creating significant downstream phishing risk through compromised travel data. Zscaler research details an ongoing Microsoft Teams vishing campaign deploying the GoGRPC backdoor, demonstrating how ransomware operations have industrialised initial access through collaboration platforms. The episode provides specific, actionable guidance for each threat, from verifying patch dates on VPN appliances to configuring Quick Assist controls and preparing staff for contextualised spear-phishing. We also note the arrest of two individuals connected to TeamPCP supply chain attacks. Each story is framed through the operational gaps that enable these threats, with practical steps UK SMBs can implement today. Chapters Introduction Overview of three urgent threats: NCSC edge device alert, Manchester Airports data breach, and industrialised ransomware access via Microsoft Teams. NCSC Alert on Internet-Exposed Edge Devices Analysis of the NCSC advisory on disruptive incidents linked to unpatched VPNs, firewalls, and edge devices. Covers operational failures in patch management, specific checks for UK SMBs, and the critical Fortinet EMS vulnerability CVE-2026-35616. Call to Action Invitation to follow the show and share with colleagues. Manchester Airports Group Data Breach Examination of the 8.7 million customer breach, the downstream spear-phishing risk from exposed travel data, and practical steps for businesses whose staff or customers may be affected. Microsoft Teams Vishing Campaign and GoGRPC Backdoor Detailed analysis of Zscaler research on Teams-based social engineering delivering the GoGRPC backdoor. Covers the attack pattern, configuration controls for Quick Assist, and staff training requirements. TeamPCP Supply Chain Arrests Brief note on arrests connected to developer supply chain attacks, highlighting ongoing exposure for UK SMBs using third-party software. Closing Summary and Actions Consolidated practical guidance: verify patch dates, configure Quick Assist controls, brief staff on Teams vishing, and assess Manchester Airports exposure. Links https://www.ncsc.gov.uk/ https://www.esentire.com/ https://www.zscaler.com/ https://ico.org.uk/

13:25

Aug 26, 2026

Ubiquiti UniFi Max-Severity Flaws and Gitea Active Exploitation

Ubiquiti UniFi Max-Severity Flaws and Gitea Active Exploitation Three maximum-severity vulnerabilities have been disclosed in Ubiquiti’s UniFi network products, all exploitable remotely without authentication. Separately, CISA has confirmed active exploitation of a critical code injection flaw in Gitea, the self-hosted Git service widely used for internal code repositories. Both disclosures highlight a persistent gap in how UK businesses secure infrastructure that sits behind the public perimeter. UniFi kit manages internal networks and physical security systems across thousands of SMBs, yet firmware updates often lag months behind current versions. Gitea servers hold development code, credentials, and API keys, but are frequently treated as lower-priority assets despite their access to production environments. The observed Gitea exploitation involves cryptominer deployment, but the real risk is remote code execution on systems that touch sensitive infrastructure. This episode examines why trusted infrastructure receives less scrutiny than customer-facing systems, and why that gap creates exploitable exposure. Mauven provides specific patch guidance, incident response steps, and asset inventory priorities for both vulnerabilities. Chapters Intro Mauven introduces episode thirty-nine, focusing on infrastructure vulnerabilities that receive insufficient security attention despite supporting critical business operations. Ubiquiti UniFi: Three Max-Severity Flaws Three maximum CVSS score vulnerabilities disclosed in UniFi Network Application and UniFi Protect, all exploitable remotely without authentication. Covers authentication bypass and command injection risks, UK SMB deployment patterns, and immediate patching requirements. CTA Brief call to action encouraging listeners to follow the podcast and share with colleagues managing network infrastructure. Gitea RCE: CISA Confirms Active Exploitation CISA adds critical Gitea code injection vulnerability to Known Exploited Vulnerabilities catalogue following confirmed cryptominer deployment. Discusses risks to self-hosted Git repositories, credential exposure, and the need for log analysis and repository auditing. The Trusted Infrastructure Problem Analysis of why infrastructure supporting operations rather than serving customers receives less security scrutiny, creating exploitable gaps. Covers NCSC guidance on vulnerability management and notes a ClickFix phishing campaign using npm mirror infrastructure. Outro Summary of patch requirements and asset review priorities for both UniFi and Gitea. Closing remarks and episode credits. Links https://community.ui.com/releases https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/vulnerability-management

16:17

Aug 25, 2026

ClickFix Malware, Check Point Bypass, and Zimbra Campaign Hits 270 Servers

ClickFix Malware, Check Point Bypass, and Zimbra Campaign Hits 270 Servers Three active threats demand immediate attention from UK small businesses today. ClickFix social engineering campaigns have matured into a multi-vector malware ecosystem using MSI packages, NodeJS execution, and fake CAPTCHA lures to deliver persistent backdoors across Windows and macOS systems. Attackers are abusing legitimate Windows tools and storing command-and-control addresses in blockchain smart contracts, making traditional network defences less effective. Check Point has confirmed active exploitation of CVE-2026-16232, a critical authentication bypass in SmartConsole that grants unauthenticated remote attackers full administrative access to firewall management servers. Organisations using managed service providers for firewall infrastructure need specific answers about exposure windows and remediation status. A remote code execution vulnerability in Zimbra Collaboration Suite has already compromised over 270 email servers, with the campaign ongoing. This episode provides actionable guidance on endpoint monitoring configuration, management server security reviews, and supplier due diligence for email hosting platforms. None of these threats are theoretical. All three are actively exploiting UK organisations today. Chapters Introduction Mauven introduces three active threats affecting UK small businesses: a mature social engineering malware ecosystem, a critical firewall management authentication bypass under active exploitation, and an email server vulnerability with over 270 confirmed compromises. ClickFix: The Social Engineering Technique That Grew Up Analysis of ClickFix malware campaigns using MSI packages with DLL sideloading, NodeJS execution, and fake CAPTCHA lures. Coverage includes PavinLoader’s blockchain-based command-and-control infrastructure, cross-platform macOS variants, and fraudulent SysScan websites. Practical guidance on endpoint protection configuration and staff awareness training. Call to Action Encouragement to follow the show and share threat intelligence with professional networks to close the gap between awareness and action. Check Point SmartConsole: Authentication Bypass Under Active Exploitation Detailed examination of CVE-2026-16232 and accompanying privilege escalation vulnerabilities in Check Point SmartConsole. Focus on exploitation conditions, attack chains, and specific questions UK SMBs must ask managed service providers about exposure and remediation. Zimbra RCE: 270 Servers Down, Campaign Ongoing Coverage of the ongoing Zimbra Collaboration Suite remote code execution campaign affecting over 270 instances. Discussion of supply chain risks through managed hosting providers and the operational impact of email server compromise. Guidance on verification and patching. Closing Remarks Mauven identifies the common thread across all three threats: attackers exploiting configuration gaps and awareness failures rather than extraordinary techniques. Recap of actionable steps for endpoint monitoring, supplier verification, and staff training. Links https://fieldeffect.com/ https://malwarebytes.com/ https://checkpoint.com/ https://shadowserver.org/ https://bleepingcomputer.com/ https://zimbra.com/

18:07

Aug 24, 2026

Zimbra Zero-Click RCE, Check Point Bypass, and Device Code Phishing

Zimbra Zero-Click RCE, Check Point Bypass, and Device Code Phishing This episode examines three active threats demanding immediate attention from UK small businesses. First, a zero-click remote code execution vulnerability in Zimbra Collaboration Suite (CVE-2025-66376) under active exploitation by Russian-linked threat actors, with a three-day federal patch deadline from CISA. Second, an authentication bypass flaw in Check Point SmartConsole (CVE-2026-16232) allowing unauthenticated remote attackers full administrative access to exposed management servers. Third, a vishing and device code phishing campaign by the Helix data extortion group that requires no malware and leaves minimal forensic trace. The episode emphasises that all three threats exploit the gap between what organisations have configured and what they actually review. Practical actions include patching Zimbra immediately, verifying Check Point management interfaces are IP-restricted, enabling Microsoft 365 unified audit logging, and training staff on device code phishing recognition. The common thread is organisational discipline: knowing what is running in your environment, how it is configured, and whether anyone is reviewing the evidence of activity within it. Chapters Introduction Mauven introduces three threats for 24 August 2026: two confirmed, actively exploited vulnerabilities with patches available, and a social engineering campaign that leaves no malware trace. The third threat is identified as the most dangerous for UK small businesses reliant on endpoint detection alone. Zimbra Zero-Click RCE Under Active Exploitation CISA has added CVE-2025-66376, a zero-click remote code execution flaw in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities catalogue with a three-day federal patch deadline. The vulnerability is being exploited by Russian-linked threat actor Void Blizzard (LAUNDRY BEAR) in a systematic credential harvesting operation targeting government, defence, transportation, and financial sector organisations across NATO member states. UK small businesses, particularly legal firms, accountancy practices, and professional services running on-premises email, must patch immediately, verify Zimbra deployment status, restrict internet access if patching cannot occur immediately, and review access logs for anomalous activity. Call to Action Listeners are encouraged to follow the show and share the briefing with colleagues who can act on the information presented. Check Point SmartConsole Authentication Bypass Check Point has confirmed active exploitation of CVE-2026-16232, an authentication bypass vulnerability in SmartConsole that allows unauthenticated remote attackers full administrative access to exposed Management Servers. Exploitation has been confirmed against customers with management interfaces exposed to the internet without IP restrictions. UK organisations using Check Point products must apply security updates immediately, verify all management interfaces are IP-restricted with documentation, review access logs for authentication attempts from unexpected sources, and confirm managed service providers have patched all deployments. Helix Vishing and Device Code Phishing ReliaQuest has documented a data extortion group named Helix running a three-stage attack requiring no malware: vishing calls impersonating managers using open-source research from LinkedIn and company websites, device code phishing directing employees to enter codes into legitimate Microsoft authentication pages to grant attackers persistent access tokens, and automated SharePoint exfiltration. The campaign leaves no endpoint detection evidence and is only visible in Microsoft 365 unified audit logs. UK small businesses must brief all staff on device code phishing, establish verbal verification procedures for credential-related requests, enable unified audit logging in Microsoft 365, and consider Conditional Access policies restricting device code authentication flows. The Pattern This Week All three threats exploit the gap between what organisations have configured and what they have reviewed. Zimbra instances not audited since deployment, management interfaces opened for remote access and never locked down, and Microsoft 365 audit logs not being read represent ordinary accumulated drift rather than exotic failures. The adversaries target organisations that have not implemented basic controls, and the discipline required to close these gaps is organisational rather than technical. Conclusion The practical takeaway is to answer three questions immediately: is Zimbra running anywhere in your environment, is any network device management interface accessible from the internet without IP restriction, and is unified audit logging enabled in your Microsoft 365 tenant. If the answers are unknown, organisations must find out today. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://unit42.paloaltonetworks.com/ https://www.checkpoint.com/advisories/ https://www.ncsc.gov.uk/ https://www.reliaquest.com/ https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code

13:22

Aug 21, 2026

Teams Impersonation and Rust Supply Chain Attacks Hit UK SMBs

Teams Impersonation and Rust Supply Chain Attacks Hit UK SMBs This episode examines two unconnected but similarly exploitative campaigns targeting UK small businesses in August 2026. The first, SynkLoader, uses Microsoft Teams to impersonate IT helpdesk staff, delivering memory-resident malware through plausible maintenance requests. The attack succeeds because default Teams external access settings allow unrestricted messages from unknown tenants. The second involves a coordinated supply chain attack against three legitimate Rust programming language packages, injecting malicious code through a typosquatted dependency that executes during software builds. Both campaigns exploit trust in familiar channels rather than technical vulnerabilities. Mauven MacLeod explains why these attacks work, what they reveal about default configurations in SMB environments, and provides actionable steps: restricting Teams external federation, establishing clear IT contact protocols, auditing Rust dependencies for the malicious proc-macro1 package, and questioning software vendors about supply chain verification. The episode emphasises that effective defence requires deliberately changing insecure defaults, not advanced security tooling. Chapters Introduction Mauven introduces two active campaigns targeting UK small businesses through trusted channels: a Teams-based helpdesk impersonation attack and a Rust programming language supply chain compromise. Both exploit default configurations rather than technical vulnerabilities. SynkLoader: When Your IT Helpdesk Comes to You Analysis of SynkLoader malware delivered via Microsoft Teams helpdesk impersonation. The attack uses MSI installers to deploy multi-language, memory-resident malware that bypasses endpoint detection, establishes command-and-control access, and captures credentials through fake lock screens. Succeeds because default Teams external access settings allow unrestricted external messages. Call to Action Encouragement to follow the show and share with colleagues who would benefit from daily threat intelligence briefings. Rust Supply Chain: The Dependency You Did Not Know You Had Examination of a coordinated supply chain attack against three legitimate Rust packages through a typosquatted dependency called proc-macro1. Malicious code executed during software builds, potentially compromising both bespoke software and commercial products. Highlights the gap in SMB software procurement processes around supply chain verification. The Wider Picture Connects both campaigns through their exploitation of trust in familiar channels and legitimate-seeming sources. Emphasises that effective attacks against small businesses rely on familiarity rather than technical sophistication, and that changing insecure defaults requires deliberate decisions. Closing Recap of practical actions: verify Teams external federation settings and question IT providers about software supply chain verification processes. Two questions that reveal the current security posture. Links https://expel.com/blog/synkloader-analysis/ https://socket.dev/blog/rust-supply-chain-attack https://www.ncsc.gov.uk/guidance/phishing-resistant-authentication https://www.ncsc.gov.uk/collection/supply-chain-security

14:37

Aug 20, 2026

MLflow Exploitation, NetScaler Emergency Patch, and European Banking Trojan

MLflow Exploitation, NetScaler Emergency Patch, and European Banking Trojan CISA has confirmed active exploitation of a critical MLflow vulnerability, demanding immediate action from any organisation running AI or machine learning infrastructure. The server-side request forgery flaw allows attackers to access internal systems, and deployment patterns mean the platform often sits outside normal security review cycles. Separately, Citrix has issued an urgent advisory for NetScaler Gateway and ADC vulnerabilities, with language reflecting high exploitation likelihood. The perimeter-facing nature of these widely deployed remote access solutions makes them priority targets. Finally, the Manic Android banking trojan is spreading across Europe with a relay-based exfiltration capability that partially defeats network controls, raising BYOD security questions for UK small businesses. The NCSC has also published new guidance on managing agentic AI cyber risk, connecting to broader concerns about autonomous systems acting on behalf of users without adequate security review. Chapters Introduction Mauven opens with three stories requiring immediate action: a CISA-confirmed active exploitation, an urgent Citrix advisory, and a European banking malware threat relevant to UK businesses. MLflow Under Active Exploitation CISA adds MLflow to the Known Exploited Vulnerabilities catalogue following confirmed active attacks. The server-side request forgery vulnerability affects AI and machine learning deployments that often sit outside normal security review cycles, creating exposure many organisations may not be aware of. Call to Action Listeners are encouraged to follow the show and share the briefing, particularly with those managing IT for small businesses who need urgent awareness of the MLflow exploitation. Citrix NetScaler Emergency Advisory Citrix issues urgent patching guidance for NetScaler Gateway and ADC vulnerabilities. The perimeter-facing nature of these widely deployed products, combined with Citrix’s deliberate use of emergency language, signals high exploitation risk requiring immediate verification with IT providers. Manic Android Malware in Europe The Manic banking trojan spreads across Europe with relay-based exfiltration capability that routes stolen data through nearby infected devices, partially defeating network controls. BYOD practices in UK small businesses create exposure when personal Android devices access work accounts. NCSC Guidance on Agentic AI The NCSC publishes guidance on managing cyber risk from autonomous AI systems that act on behalf of users. Prompt injection attacks against agentic AI tools represent an escalating threat as these systems gain access to business accounts and services. Closing Mauven connects the common thread across all stories: security gaps emerge when deployment outpaces security review. The practical priority is knowing what runs in your environment, who manages it, and how responsibility is verified. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://support.citrix.com/ https://www.ncsc.gov.uk/blog-post/managing-cyber-risk-agentic-ai https://www.theregister.com/

17:55

Aug 19, 2026

Critical Windows RCE Under Active Exploit, Clop Custom Tooling, and MFA Bypass Phishing

Critical Windows RCE Under Active Exploit, Clop Custom Tooling, and MFA Bypass Phishing This episode covers three active threats with credible paths to UK small businesses. First, CISA has added a critical Windows IKE Extension remote code execution vulnerability to its Known Exploited Vulnerabilities catalogue, confirming active exploitation against network-reachable systems. Second, Clop ransomware has returned with purpose-built tooling targeting PTC Windchill in manufacturing supply chains, deploying custom web shells designed for credential harvesting and data exfiltration. Third, the Mirage2FA phishing-as-a-service platform is bypassing multifactor authentication through adversary-in-the-middle session token theft, with over four thousand confirmed Microsoft 365 victims. Mauven explains the technical mechanisms behind each threat, identifies the specific organisations at risk, and provides actionable steps that require no budget approval: verifying Windows patch status for IKE Extension, questioning manufacturing suppliers about Windchill patching, and reviewing Microsoft 365 conditional access policies to detect session anomalies. The episode also notes FBI confirmation of Medusa ransomware breaching over five hundred US critical infrastructure organisations using living-off-the-land techniques. All three primary threats demonstrate that speed of response, supplier questioning, and configuration review matter more than technology spending for most small business cyber resilience. Chapters Introduction Mauven introduces three threats with credible UK small business impact: a Windows vulnerability under active exploitation, Clop ransomware with custom tooling, and an MFA-bypassing phishing platform. Windows IKE Extension RCE: CISA KEV Addition CISA has added a critical Windows IKE Extension remote code execution vulnerability to its Known Exploited Vulnerabilities catalogue. The flaw is network-reachable, requires no authentication, and allows arbitrary code execution. Mauven explains why active exploitation status demands immediate Windows patch verification, particularly for organisations using Windows-based VPN solutions. Support the Show Brief call to action encouraging listeners to follow the show and share with business owners who need operational threat intelligence. Clop Returns with Purpose-Built Tooling Clop ransomware is targeting PTC Windchill in manufacturing and engineering supply chains using custom-developed web shells. ReliaQuest analysis confirms the toolkit includes credential harvesting, database enumeration, and Java-based exfiltration components. Mauven explains the supply chain exposure risk and recommends questioning suppliers about Windchill patching status. Mirage2FA Phishing-as-a-Service Bypasses MFA Mirage2FA operates as an adversary-in-the-middle proxy, capturing authenticated Microsoft 365 session tokens after users complete MFA. ANY.RUN analysis identifies over four thousand victims. Mauven explains why MFA alone is insufficient without conditional access policies detecting impossible travel and anomalous session use. Medusa Ransomware Context FBI confirms Medusa ransomware has breached over five hundred US critical infrastructure organisations since June 2021 using phishing, unpatched vulnerabilities, and living-off-the-land techniques. Mauven notes the tactics are internationally relevant and the confirmed victim count likely understates true impact. Summary and Actions Three actions requiring no budget: verify Windows IKE Extension patch deployment, question manufacturing suppliers about PTC Windchill patching, and review Microsoft 365 conditional access configuration to detect session token theft. Mauven emphasises that difficulty having these conversations is itself diagnostic of resilience gaps. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.reliaquest.com/blog/clop-ransomware-ptc-windchill-cve-2026-12569/ https://any.run/cybersecurity-blog/mirage2fa-phishing-kit-analysis/ https://www.fbi.gov/news/press-releases/fbi-issues-alert-on-medusa-ransomware https://www.ncsc.gov.uk/collection/supply-chain-security

14:00

Aug 18, 2026

Windows Task Host Ransomware Exploitation and Microsoft Copilot Injection Flaw

Windows Task Host Ransomware Exploitation and Microsoft Copilot Injection Flaw Two Microsoft vulnerabilities demand immediate attention from UK small businesses running Windows endpoints and Microsoft 365. CISA has confirmed active ransomware exploitation of the Windows Task Host privilege escalation flaw, four months after its initial disclosure. This vulnerability allows attackers who have gained initial access to escalate to system-level privileges, enabling lateral movement and full ransomware deployment. Separately, Microsoft has disclosed CVE-2026-24301, a command injection vulnerability in Copilot that enables information disclosure across the entire Microsoft 365 data estate. Because Copilot operates within user permission contexts, the vulnerability exposes whatever data those users can access, including financial records, HR files, and confidential client information. Researchers have also documented C2Looper, a Rust-based backdoor that uses GitHub for command-and-control traffic and connects to ClickFix infection chains. Together, these developments illustrate a complete ransomware kill chain from initial access through privilege escalation to deployment. Organisations must confirm Windows patch status today, review Copilot access permissions against the principle of least privilege, and brief staff on ClickFix lures that present as fake browser error messages. Chapters Introduction Overview of two Microsoft vulnerabilities affecting Windows endpoints and Microsoft 365, both requiring immediate action. CISA has confirmed ransomware exploitation of the Windows Task Host flaw, whilst Microsoft has disclosed a command injection vulnerability in Copilot. Windows Task Host Ransomware Exploitation Analysis of the Windows Task Host privilege escalation vulnerability, now confirmed by CISA as actively exploited by ransomware groups. Explains how attackers use the flaw to escalate from low-privilege access to system-level control, enabling lateral movement and full estate compromise. Four months have passed since disclosure. Call to Action Encouragement to follow the show and share it with others who need threat intelligence information. CVE-2026-24301 Microsoft Copilot Command Injection Examination of the newly disclosed command injection vulnerability in Microsoft Copilot. Explains how Copilot’s deep integration with Microsoft 365 data means the vulnerability exposes entire organisational data estates through user permission contexts. Addresses the risk of default enablement and the need for permissions audits. C2Looper and Ransomware Delivery Chains Overview of C2Looper, a Rust-based backdoor that uses GitHub for command-and-control traffic, and its connection to ClickFix infection chains. Describes the complete ransomware kill chain from initial access through privilege escalation, emphasising the importance of staff awareness training on ClickFix techniques. Conclusion Practical summary of required actions: confirm Windows patch status immediately, review Copilot access permissions, apply least privilege principles, and brief staff on ClickFix lures this week. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301 https://www.theregister.com/ https://www.zscaler.com/blogs/security-research/

14:01

Aug 14, 2026

Clop, ShinyHunters, and SAP: When Supplier Risk Becomes Attack Surface

Clop, ShinyHunters, and SAP: When Supplier Risk Becomes Attack Surface Three distinct threat campaigns broke on 14 August 2026, and each one targets the same vulnerability: supplier and third-party infrastructure. Clop ransomware claimed 89GB of Shell data via managed file transfer platforms, continuing a six-year pattern of targeting MFT tools across supply chains. ShinyHunters exposed 1.6 million RingCentral accounts while simultaneously running OAuth abuse campaigns against Salesforce and other SaaS platforms, weaponising legitimate integrations and voice phishing. A maximum-severity SAP Commerce Cloud vulnerability moved from patch release to active exploitation in just three days. Meanwhile, supplier breaches at the Crown Office and Procurator Fiscal Service in Scotland and Trezor’s logistics partner reinforce the same pattern: organisations with sound internal controls are being compromised through third-party infrastructure they don’t directly manage. This briefing explains why managed file transfer platforms, OAuth connections, and unpatched supplier software represent the dominant attack surface in 2026, and provides actionable steps for UK small businesses to identify and close these exposure gaps before threat actors exploit them. Chapters Introduction Three separate threat streams reveal a unified pattern: organisations with well-managed internal environments are being compromised through supplier infrastructure, SaaS integrations, and third-party software. Clop Claims Shell: The Method Is Six Years Old Clop ransomware claimed 89GB of Shell data via PTC FlexPLM and Windchill platforms. Team Cymru analysis shows Clop has run nine campaigns over six years, systematically targeting managed file transfer tools across supply chains. Call to Action Encouragement to follow the show and share with colleagues who may underestimate their exposure to supplier-based threats. ShinyHunters Pivots from Data Theft to SaaS Infiltration ShinyHunters breached RingCentral, exposing 1.6 million accounts, while simultaneously running OAuth abuse campaigns against Salesforce and other SaaS platforms using voice phishing, supply chain compromise, and credential theft. SAP Commerce Cloud: Maximum Severity, Already Exploited A maximum-severity remote code execution vulnerability in SAP Commerce Cloud moved from patch release to active exploitation in three days, compressing response windows and exposing retailers and e-commerce operators. The Pattern Underneath Today’s Stories Clop, ShinyHunters, and the SAP campaign all exploit third-party and supplier exposure. Additional breaches at Crown Office Scotland and Trezor’s logistics partner reinforce that supplier risk is the dominant attack surface in 2026. Closing Practical takeaways: map supplier access, audit OAuth connections, patch on severity rather than schedule, and brief staff on voice phishing tactics targeting legitimate application approval processes. Links https://haveibeenpwned.com https://www.teamcymru.com https://www.microsoft.com/security/blog https://defused.com https://www.ncsc.gov.uk

8:00

Jul 31, 2026

Cybersecurity Challenges Facing UK SMEs

Cybersecurity Challenges Facing UK SMEs Today’s episode tackles key cybersecurity challenges facing UK small and medium enterprises. We delve into the exploits by the Russian-aligned group TA488, discuss vulnerabilities such as CVE-2026-42897, and examine the broader impact of cyber incidents beyond primary targets. Learn about the MacSync Stealer threat to macOS and the potential risks associated with Anthropic’s Claude AI models. Finally, we explore the recent CAF Bank incident affecting thousands of charities. Each section offers insights and actionable steps to bolster your organisation’s security posture amidst these evolving threats. Chapters Intro Introduction to key cybersecurity issues facing UK businesses, including TA488 exploits and AI vulnerabilities. CVE-2026-42897 and TA488 Discusses the CVE-2026-42897 vulnerability exploited by TA488 and the importance of patch management. CTA Encourages listeners to follow the podcast and share it with others who might benefit. MacSync Stealer on macOS Explores the MacSync Stealer threat via Google Ads affecting macOS users and stresses the need for education and advanced protection. Anthropic’s Claude AI Models Examines issues of AI containment and security with Claude AI models, urging robust governance frameworks. CAF Bank Incident Analyzes the cyber incident affecting CAF Bank, highlighting the importance of financial security measures and contingency plans. Outro Concludes with a call for vigilance and accountability in tech environments to secure against threats. Links https://www.ncsc.gov.uk/collection/toolkit-for-small-businesses https://www.example.com/security-patch-guidance

6:32

Jul 30, 2026

UK SMBs Face Escalating Cyber Threats

UK SMBs Face Escalating Cyber Threats In today’s episode of Threat Analysis, Mauven MacLeod delves into critical cybersecurity challenges confronting UK small businesses. We address Russian state-sponsored email attacks targeting Microsoft Outlook with a unique ‘half-click’ method, which offers notable resilience against traditional security measures. Understanding the implications of such threats is essential for businesses to protect their digital environments and reputations. Additionally, we examine the rise of attacks within the npm registry, impacting software development operations. This new threat utilises worm-like behaviours to infiltrate popular packages and steal credentials via blockchain transactions. These complex methods highlight the importance of thorough vigilance and robust security strategies for companies relying on open-source software. Mauven emphasises the necessity of incorporating comprehensive security measures, combining human and technological approaches, to effectively manage and counter these evolving threats. Don’t miss out on the need for keen awareness and proactive defences in safeguarding your business. Chapters Intro Mauven highlights the critical cyber threats facing UK SMBs and the importance of robust security. Russian State-Sponsored Email Attacks Targeting Outlook Discussion on the ‘half-click’ method used by Russian hackers in Outlook attacks, emphasising resilience and the need for awareness. CTA Encouragement to follow the show and share with those who need cybersecurity insights. NPM Registry Hosting New Supply Chain Attacks Exploration of worm-like attacks within the npm registry targeting credentials via blockchain, calling for vigilant dependency management. Outro Conclusion on the necessity of proactive cybersecurity measures for UK SMBs, previewing future threat analyses. Links https://www.ncsc.gov.uk https://www.microsoft.com

7:03

Jul 28, 2026

Cyber Threats: Helpdesk Attacks and WordPress Risks

Cyber Threats: Helpdesk Attacks and WordPress Risks Mauven MacLeod presents today’s Threat Analysis, focusing on pressing cyber threats faced by UK small and medium businesses. She explores two major issues: vishing attacks exploiting Microsoft Teams and vulnerabilities in WordPress. Vishing attacks target companies through Microsoft Teams, where attackers impersonate IT helpdesk staff and deploy the GoGRPC backdoor. This can lead to ransomware attacks, compromising sensitive company data. Mauven emphasises the importance of staff awareness and technological safeguards to mitigate risks. The episode also highlights critical vulnerabilities in WordPress Core, affecting versions 6.9.0 to 7.0.1. These vulnerabilities allow unauthorised remote code execution, potentially leading to total site takeovers. Businesses are urged to apply patches immediately to protect their websites and customer data. The National Cyber Security Centre underlines the urgency of this action. Mauven stresses that these insights should lead to a comprehensive cybersecurity strategy, incorporating regular updates, employee training, and robust security policies. Chapters Intro Mauven introduces the episode’s focus on cyber threats targeting UK businesses: Microsoft Teams vishing attacks and WordPress vulnerabilities. Helpdesk Hijackers: Microsoft Teams Vishing Attacks Discussion of vishing attacks via Microsoft Teams, where attackers exploit helpdesk impersonations to deploy the GoGRPC backdoor, posing risks to UK businesses. CTA A call to action for listeners to follow the podcast for daily briefings and share it with others who might benefit. WordPress Vulnerabilities: wp2shell Threat Overview of critical vulnerabilities in WordPress versions 6.9.0 to 7.0.1, allowing remote code execution. Emphasises the need for immediate patches. Implications for UK SMBs The importance of integrating cybersecurity into business culture, ensuring systems and staff are well-prepared against current threats. Outro Mauven wraps up with a reminder to remain vigilant and to use these insights to strengthen business security. Links https://www.ncsc.gov.uk/ https://www.microsoft.com/

6:48

Jul 27, 2026

Urgent Vulnerabilities for UK Businesses

Urgent Vulnerabilities for UK Businesses In today’s episode, Mauven MacLeod tackles pressing vulnerabilities affecting UK small and medium businesses. Microsoft’s Defender for Endpoint is under scrutiny due to bugs that leave Linux systems unprotected. From installation issues on hardened RHEL systems to deactivation on restart, these glitches pose significant security risks. Attention is drawn to Java Spring Boot’s exposed endpoints revealing sensitive data, underscoring GDPR compliance risks. The discussion moves to critical vulnerabilities, CVE-2026-16461 and 8450, and their severe implications. Finally, Google’s cybercrime taxonomy offers new insights into defending against threats. It’s an urgent call to action for businesses to address these threats promptly. Chapters Intro Introduction to the urgency of addressing security vulnerabilities for UK businesses. Microsoft Defender for Endpoint Analysis of vulnerabilities in Microsoft Defender, affecting Linux systems and RHEL installations. Java Spring Boot Vulnerabilities Exposed heapdump endpoints in Java Spring Boot pose risks of data exposure and GDPR violations. Microsoft Security Response Critical vulnerabilities CVE-2026-16461 and CVE-2026-8450 discussed with potential impacts. Google’s Cybercrime Taxonomy Google’s new cybercrime taxonomy aids in understanding and targeting specific threats effectively. Outro Final thoughts on the need for urgent action to secure business systems against vulnerabilities. Links https://docs.microsoft.com/en-us/microsoft-defender-endpoint/linux-installation https://spring.io/projects/spring-boot https://www.cve.org/CVERecord?id=CVE-2026-16461 https://www.cve.org/CVERecord?id=CVE-2026-8450 https://security.googleblog.com/2023/07/new-cybercrime-taxonomy.html

5:40

Jul 24, 2026

Addressing Mistic Backdoor and FortiBleed Risks

Addressing Mistic Backdoor and FortiBleed Risks In today’s episode of Threat Analysis, Mauven MacLeod explores two significant cyber threats impacting UK small and medium-sized businesses: the Mistic backdoor and the FortiBleed campaign. Both threats exploit vulnerabilities requiring immediate attention. The Mistic backdoor, potentially operated by the notorious access broker Woodgnat, uses sideloading attacks to infiltrate systems. This method often goes unnoticed and has been a staple in cybercriminal activities for years, affecting industries like professional services and healthcare. Mauven emphasises the importance of meaningful conversations with IT teams to mitigate such risks and secure vendor relationships effectively. The episode then shifts focus to the FortiBleed campaign, which targets Fortinet’s FortiGate firewalls. These essential components of network security are under significant threat as FortiBleed employs an immediate credential theft strategy. This can escalate from potential risk to an operational crisis rapidly. Mauven advises businesses to apply necessary patches promptly and enhance network monitoring protocols to detect unusual activities. Both threats underscore the necessity for proactive cybersecurity measures. Chapters Intro Mauven introduces the episode’s focus on two cyber threats, Mistic backdoor and FortiBleed, highlighting the urgency for UK businesses to address these vulnerabilities. Mistic Backdoor: Initial Access and Credential Theft Discussion on Mistic backdoor’s sideloading attacks by Woodgnat. Emphasises the need for businesses to engage with IT teams to mitigate risks and secure systems effectively. CTA Encouragement to follow the podcast for daily updates and share with others who could benefit from the information. FortiBleed Campaign: A Primer on Credential Harvesting Analysis of the FortiBleed campaign targeting Fortinet FortiGate firewalls. Highlights the urgent requirement for applying patches and enhancing network monitoring protocols. Outro Reinforces the necessity for vigilance and proactive measures in cybersecurity strategies. Encourages continual threat assessment and response. Links https://cisa.gov

7:07

Jul 22, 2026

UK SMBs Face Ransomware Re-Extortion and Langflow Threats

UK SMBs Face Ransomware Re-Extortion and Langflow Threats In this episode of Threat Analysis, Mauven MacLeod explores critical cyber threats that UK small and medium-sized businesses (SMBs) must be aware of. The discussion begins with the increasing trend of ransomware re-extortion, where attackers demand additional payments even after receiving a ransom. Proofpoint reports show over a third of victims are affected by this tactic, highlighting the necessity for robust cybersecurity measures. The episode also covers a significant vulnerability in Langflow, as identified by CISA, which allows remote code execution and is being actively exploited. Mauven stresses the importance of immediate patching to secure AI systems against potential breaches. Additionally, the new JADEPUFFER ransomware poses a risk to AI models critical to business operations. Lastly, a vulnerability in Adobe’s Chrome extension exposes WhatsApp chats to unauthorised access, underscoring the need for secure communication policies. Join Mauven for insights into these pressing cybersecurity challenges. Chapters Intro Introduction to the episode’s focus on critical cyber threats for UK SMBs. Ransomware Re-Extortion Discussion on the trend of ransomware re-extortion affecting over a third of victims. CTA Encouragement to follow the podcast for regular updates. Langflow RCE Vulnerability Exploration of a critical vulnerability in Langflow allowing remote code execution. JADEPUFFER Ransomware Examination of JADEPUFFER ransomware targeting AI models and infrastructure. Adobe Chrome Extension Vulnerability Coverage of a security flaw in Adobe’s Chrome extension impacting WhatsApp security. Outro Conclusion with a call to action to strengthen cybersecurity defences. Links https://www.proofpoint.com https://cisa.gov

6:33

Jul 21, 2026

Protecting Against Ransomware and Evolving Cyber Threats

Protecting Against Ransomware and Evolving Cyber Threats In today’s briefing, Mauven MacLeod delves into imperative cybersecurity updates impacting UK businesses. The Qilin ransomware gang is actively exploiting a critical flaw in Palo Alto Networks’ GlobalProtect VPN, posing significant risks even to small enterprises. This episode underscores why businesses of all sizes must prioritise security updates to guard against cybercriminals. Additionally, Mauven discusses the emerging Jadepuffer group targeting AI technologies and the HOLLOWGRAPH campaign, which ingeniously utilises Microsoft 365 calendars for sinister purposes. The episode highlights the necessity for vigilant, proactive security practices and the importance of continuous education in the face of evolving threats. Chapters Intro Mauven introduces the episode, focusing on the Qilin ransomware gang exploiting a VPN flaw and emphasising the need for all businesses to be vigilant. Qilin Ransomware Exploits VPN Flaw Analysis of the Qilin ransomware exploiting a critical VPN vulnerability and its implications for businesses of all sizes. CTA Encouragement to follow the podcast for regular updates. Evolving Ransomware Tactics and Jadepuffer Discussion on Jadepuffer targeting AI models and the importance of staying ahead of sophisticated cyber threats. HOLLOWGRAPH Campaign Risks Overview of the HOLLOWGRAPH campaign using Microsoft 365 calendars for espionage, urging businesses to reassess security measures. Outro Concluding remarks on the importance of staying informed and proactive against digital threats. Links https://www.paloaltonetworks.com https://www.ncsc.gov.uk https://arcticwolf.com

15:42

Jul 20, 2026

ServiceNow RCE Under Active Exploitation, Plus M365 Passkey Vishing

ServiceNow RCE Under Active Exploitation, Plus M365 Passkey Vishing Three critical threats demand immediate attention today. A remote code execution vulnerability in ServiceNow’s AI Platform (CVE-2026-6875) is now actively exploited in the wild, requiring urgent patch verification from direct users and managed service providers alike. Meanwhile, a vishing campaign running since April has been successfully defeating Microsoft 365 passkey enrolment through carefully scripted social engineering, targeting UK SMBs who adopted phishing-resistant MFA but failed to brief staff on the human attack vector. The third story examines FortiBleed, an industrial-scale FortiGate credential harvesting operation exposed when attackers left their staging server accessible, revealing 36 rented GPUs running distributed password cracking as a production workflow. The episode also covers the Cruciferra crypter service, which offers high-quality endpoint evasion as a purchased feature, and the Hugging Face breach involving an autonomous AI agent. Each story includes specific, actionable guidance for UK organisations, with particular emphasis on the ServiceNow vulnerability requiring same-day verification from users and their supply chain. Chapters Introduction Mauven flags three threats requiring immediate action, particularly a ServiceNow vulnerability that has moved from patch-available to actively exploited. The episode will cover required responses for ServiceNow users, Microsoft 365 passkey vishing, and industrial-scale FortiGate credential harvesting. CVE-2026-6875: ServiceNow AI Platform RCE Under Active Exploitation Critical remote code execution vulnerability in ServiceNow AI Platform confirmed under active exploitation. Direct users must verify patch status immediately. Indirect exposure through managed service providers presents significant risk to UK SMBs. Specific guidance provided on what questions to ask providers and when patch confirmation is required. Call to Action Brief encouragement to follow the show and share with colleagues who need the briefing. O-UNC-066: Vishing Actors Defeating Microsoft 365 Passkey Enrolment Campaign active since April uses phone-based social engineering to register attacker-controlled passkeys to victim Microsoft 365 accounts. Attackers use domains containing ‘passkey’, impersonate Microsoft support, and guide targets through fake enrolment while simultaneously registering their own credentials. Three-part mitigation: restrict enrolment policies in Entra, brief staff on the attack pattern, and focus training on reception and finance staff most likely to receive calls. FortiBleed: Industrial-Scale VPN Credential Harvesting Exposed attacker staging server reveals large-scale FortiGate credential harvesting using 36 rented GPUs for distributed password cracking. Operation uses credential reuse, brute force, and GPU-accelerated hash cracking as an industrial workflow. Likely feeds initial access broker market serving ransomware operators. Guidance provided on verifying patch status, rotating credentials, and reviewing authentication logs. Also on the Radar Two additional items: Cruciferra crypter service offering high-quality endpoint evasion including BYOVD-based EDR tampering as a purchased feature, and Hugging Face breach involving autonomous AI agent access to production infrastructure and credentials. Both items flag direction of travel rather than immediate operational response. Closing Summary Recap of required actions: ServiceNow patch verification today, Microsoft 365 Entra policy review and staff briefing on vishing, FortiGate patch status and credential rotation. Emphasises that attackers operate at industrial scale while effective defences require consistent follow-through on straightforward measures. Links https://www.defused.com/ https://www.servicenow.com/ https://www.okta.com/ https://www.ncsc.gov.uk/ https://www.cloudsek.com/ https://www.fortinet.com/ https://www.proofpoint.com/ https://huggingface.co/

14:20

Jul 17, 2026

FortiSandbox Exploit, Windows Zero-Day, and ClickFix Infrastructure at Scale

FortiSandbox Exploit, Windows Zero-Day, and ClickFix Infrastructure at Scale CISA added critical Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities catalogue following confirmed in-the-wild exploitation. The US federal patching deadline is Sunday, but active exploitation means UK organisations should treat this as immediate priority. A newly published Windows local privilege escalation vulnerability called LegacyHive works on fully patched systems with no fix available, creating serious risk when combined with active ClickFix campaigns delivering initial access. ClickFix techniques now support at least five concurrent malware operations including ACR Stealer, Starland RAT, TELEPUZ, Potemkin Loader, and TTF campaign payloads. A Huntress case study documents how one ClickFix compromise spread to eleven hosts before detection. The episode provides specific, actionable guidance for SMBs: verify FortiSandbox patch status with IT providers today, brief staff on ClickFix lures immediately, review user permissions to execute scripts, and ensure endpoint detection monitors for HTA execution and PowerShell spawning from browser processes. The convergence of mature exploit infrastructure, public zero-day proof-of-concept, and active campaigns targeting European users represents a significant immediate threat to UK small business networks. Chapters Introduction Mauven opens the seventeenth of July briefing with three urgent stories. Two require immediate technical action before the weekend, whilst the third demands procedural response to an unpatched vulnerability. FortiSandbox Active Exploitation CISA confirmed active exploitation of critical FortiSandbox command injection vulnerabilities, ordering US federal agencies to patch by Sunday. FortiSandbox is a threat analysis appliance, not the firewall, creating particular concern as the security tool itself becomes attack surface. Guidance covers immediate patching requirements, how to verify MSP compliance, and the importance of asset inventory for unknown Fortinet deployments. Call to Action Brief appeal to follow the show and share with colleagues who need threat intelligence. LegacyHive Zero-Day Vulnerability A public proof-of-concept for Windows local privilege escalation called LegacyHive works on fully patched systems with no available fix. The vulnerability requires initial access first, which current ClickFix campaigns are actively providing across European targets. Defence recommendations focus on preventing initial compromise through application allow-listing, endpoint detection configuration, and staff awareness of ClickFix techniques. ClickFix Campaign Infrastructure At least five distinct malware operations now use ClickFix delivery techniques, including ACR Stealer, Starland RAT, TELEPUZ, Potemkin Loader, and TTF campaign payloads. A detailed Huntress case study shows one ClickFix compromise spreading to eleven hosts. Practical guidance includes immediate staff briefing, permission reviews to block arbitrary script execution, and verification that managed detection providers monitor relevant observable behaviours. Conclusion The convergence of mature ClickFix infrastructure, public Windows zero-day exploitation capability, and continuing Fortinet vulnerability exploitation represents the gap between published guidance and implemented defences. Two immediate actions: verify FortiSandbox patch status and brief staff on ClickFix lures before Friday. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.theregister.com/ https://www.ncsc.gov.uk/ https://www.bleepingcomputer.com/ https://www.huntress.com/ https://www.microsoft.com/

16:49

Jul 16, 2026

Social Engineering, Trojanised Tools, and Supply Chain Attacks

Social Engineering, Trojanised Tools, and Supply Chain Attacks This episode examines three contemporary threats exploiting trusted channels. Following the sentencing of two Scattered Spider members for the Transport for London breach, we analyse why social engineering remains devastatingly effective against organisations of all sizes. We then review a Russian campaign distributing trojanised WebEx and Zoom installers delivering Starland RAT, demonstrating how legitimate software becomes an attack vector. Finally, we cover the AsyncAPI npm supply chain compromise, where GitHub Actions vulnerabilities enabled injection of Miasma v3 worm into packages with valid provenance attestations. The common thread: attackers succeed not through technical brilliance, but by exploiting routine trust in familiar processes. We provide actionable guidance on helpdesk authentication procedures, software download verification, and dependency chain auditing. Additional coverage includes CISA’s Oracle E-Business Suite KEV listing and the approaching Windows 10 end-of-support deadline. Presented by Mauven MacLeod with behavioural analysis and concrete defensive measures for UK small businesses. Chapters Introduction Opening remarks establishing the episode’s central theme: trusted channels being weaponised through social engineering, trojanised software, and compromised dependencies. Scattered Spider Sentencing Analysis of two British Scattered Spider members receiving five-and-a-half-year sentences for the Transport for London breach, focusing on the social engineering techniques used and practical implications for SMB helpdesk procedures. Call to Action Audience engagement request encouraging listeners to follow the show and share with business owners. Trojanised WebEx and Zoom Examination of Russian actor UAT-11795 distributing backdoored collaboration software installers through phishing and search poisoning, delivering Starland RAT with credential theft and cryptocurrency targeting capabilities. AsyncAPI npm Supply Chain Compromise Technical breakdown of the AsyncAPI organisation compromise via GitHub Actions vulnerability, resulting in Miasma v3 worm delivery through four npm packages with valid provenance attestations and novel execution timing. Also on the Radar Brief coverage of CISA’s Oracle E-Business Suite KEV addition and the approaching Windows 10 end-of-support deadline for Home and Pro editions. Closing Remarks Summary emphasising verification over assumption, with specific guidance on questioning helpdesk authentication procedures. Links https://www.ncsc.gov.uk/ https://www.microsoft.com/security/ https://jfrog.com/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://zoom.com https://webex.com

15:46

Jul 15, 2026

SharePoint Exploitation, AiTM Phishing, and AsyncAPI Supply Chain Attack

SharePoint Exploitation, AiTM Phishing, and AsyncAPI Supply Chain Attack On 15 July 2026, Mauven MacLeod examines three active threats facing UK organisations. CISA has added three Microsoft SharePoint Server vulnerabilities to its Known Exploited Vulnerabilities catalogue following confirmed active exploitation targeting on-premises deployments, with particular exposure among professional services firms still running legacy infrastructure. The second story details a misconfigured phishing operation that exposed 218 confirmed victims across twelve countries using Adversary-in-the-Middle techniques that bypass standard multi-factor authentication, including OAuth Device Code Flow attacks against Microsoft 365 and Google Workspace users. Finally, a supply chain attack against the AsyncAPI generator repository saw an attacker exploit a misconfigured GitHub Actions workflow to publish five malicious npm packages containing the Miasma botnet loader, which executes at import time without user interaction. The briefing emphasises that none of these attacks relied on novel techniques or nation-state resources, but succeeded through known vulnerabilities, unpatched systems, and insufficient authentication controls. Chapters Introduction Mauven opens the 15 July 2026 briefing, noting three stories involving confirmed victims and active exploitation, all stemming from known weaknesses rather than novel attack methods. SharePoint Server: Three CVEs, Active Exploitation, Patch Now CISA has added three Microsoft SharePoint Server vulnerabilities to its Known Exploited Vulnerabilities catalogue following confirmed active exploitation. The flaws affect on-premises deployments, not SharePoint Online. UK professional services firms, legal practices, and accountancy firms running legacy on-premises infrastructure face elevated risk. Mauven emphasises that KEV listing represents a late warning, not an early one, and calls for immediate patching and documented remediation. Call to Action Mauven encourages listeners to follow the show and share it with colleagues who would benefit from daily threat intelligence briefings. AiTM Phishing: Three Operators Exposed, 218 Confirmed Victims Lexfo researchers discovered a misconfigured Python HTTP server that exposed the infrastructure of three phishing operators, including one with 218 confirmed victims using OAuth Device Code Flow attacks and another operating an Adversary-in-the-Middle platform since 2018. AiTM attacks bypass standard multi-factor authentication by intercepting authenticated session tokens. Mauven explains why phishing-resistant MFA such as FIDO2 is necessary and provides specific guidance on OAuth Device Code Flow recognition and conditional access policy review. AsyncAPI npm Supply Chain: Poisoned Packages, Botnet Loader An attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository to exfiltrate a privileged access token, then published five malicious npm packages containing the Miasma botnet loader. The malicious code executes at import time without user interaction. Mauven advises organisations to audit AsyncAPI-related dependencies, review build logs from 14 July, and verify whether technology partners have assessed their exposure. Also Worth Noting The NCSC has announced that certified Cyber Advisors are offering free thirty-minute consultations for small businesses. Microsoft has halted Patch Tuesday updates for some Dell devices following reports of shutdowns and overheating. Closing Remarks Mauven concludes by noting that all three stories involve exploitation of known weaknesses through patience and known techniques, rather than exotic capabilities. The briefing emphasises checking on-premises SharePoint deployments and treating patching as an urgent priority. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.lexfo.fr/ https://www.ncsc.gov.uk/ https://www.wiz.io/ https://socket.dev/ https://github.com/asyncapi

15:07

Jul 14, 2026

When MFA Stops Working: Jalisco, OmegaLord, and AI-Built Attack Infrastructure

When MFA Stops Working: Jalisco, OmegaLord, and AI-Built Attack Infrastructure Two active phishing kits, Jalisco and OmegaLord, are defeating multi-factor authentication on Microsoft 365 accounts through adversary-in-the-middle proxying and device code abuse. At the same time, documented research shows a jailbroken AI model built a fully functional command-and-control server in six minutes with minimal human input. For UK SMBs relying on MFA as their primary Microsoft 365 defence, these developments demand immediate action. Mauven examines how commoditised MFA bypass techniques work, why they matter disproportionately to UK professional services firms, and what controls to deploy now before Microsoft’s passkeys rollout in September. Also covered: critical SAP patches, actively exploited Joomla vulnerabilities, and practical steps to take this week. This episode makes clear that MFA alone is no longer sufficient, and the window to implement additional controls is closing as attack tools become cheaper and easier to deploy. Chapters Introduction Mauven introduces two critical developments: active phishing kits defeating Microsoft 365 MFA and AI-assisted attack infrastructure built in minutes. These trends signal a fundamental shift for UK businesses relying on MFA as primary defence. Jalisco and OmegaLord: When MFA Is No Longer the Answer Detailed examination of two operational phishing kits using adversary-in-the-middle proxying and device code abuse to defeat MFA on Microsoft 365. Explains why UK professional services firms are disproportionately exposed and outlines immediate mitigations including Conditional Access policies, FIDO2 keys, and token lifetime controls. Call to Action Mauven asks listeners to follow the show and share it with anyone relying solely on MFA for Microsoft 365 protection. AI Is Doing Ninety Per Cent of the Work Now Analysis of documented research showing a jailbroken Gemini model building a functional command-and-control server in six minutes. Discusses implications for UK SMBs as attack infrastructure becomes trivially easy to deploy at scale. Briefly Noted: SAP and Joomla SAP’s July 2026 patch addresses sixteen vulnerabilities including three critical flaws. Actively exploited Joomla extension vulnerabilities with CVSS 10.0 scores threaten UK SMB websites, particularly older professional services and hospitality sites. What to Do Today Four prioritised actions: verify Microsoft 365 Conditional Access configuration, patch Joomla extensions, review SAP July patches, and brief staff on device code authentication requests. Emphasises urgency of the MFA bypass issue. Outro Mauven summarises that MFA alone is insufficient for Microsoft 365 and that Conditional Access policies and phishing-resistant authentication are now baseline requirements. Links https://www.microsoft.com/en-us/security/blog/2026/07/jalisco-omegalord-phishing-kits https://cloud.google.com/blog/topics/threat-intelligence/gemini-jailbreak-c2-research https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html https://developer.joomla.org/security-centre.html https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

15:40

Jul 13, 2026

Russian State Exploitation, ShareFile Emergency Shutdown, and DocuSign RMM Abuse

Russian State Exploitation, ShareFile Emergency Shutdown, and DocuSign RMM Abuse This briefing examines three concurrent threats that share a common vulnerability: neglected infrastructure. The NCSC and eight international partners issued a joint advisory on Russian state actors (FSB-linked Static Tundra and Berserk Bear) exploiting poorly configured network edge devices to establish persistent access in critical infrastructure. The same techniques work on any misconfigured router, including those deployed in UK SMEs. Progress Software ordered an emergency shutdown of ShareFile on-premises storage zone servers without disclosing technical details, recalling the MOVEit compromise of 2023. Finally, Stormshield documented a phishing campaign impersonating DocuSign to install legitimate Remote Monitoring and Management tools (specifically Atera) as attacker infrastructure. Across all three incidents, the entry point is not sophisticated exploitation but basic configuration oversights: unchanged default credentials, unpatched firmware, unverified document signing workflows. UK small businesses using managed service providers, file transfer systems, or document signing tools face immediate exposure if they have not recently audited which remote access tools are authorised, verified router configurations, or trained staff to validate DocuSign notifications through the portal rather than email links. Chapters Introduction Mauven introduces three apparently unrelated threats that share a single operating principle: attackers exploiting unlocked doors rather than breaking through reinforced ones. Russian State Actors Targeting Network Edge Devices A nine-country joint advisory warns of FSB-linked actors exploiting misconfigured routers for persistent access. The technique works on any poorly configured device, not just critical infrastructure. UK SMEs must verify that default credentials are changed, remote management interfaces are disabled, and firmware is current. Call to Action Listeners are encouraged to follow the show and share it with others who need threat intelligence. Progress ShareFile Emergency Shutdown Progress Software ordered an emergency shutdown of ShareFile on-premises storage zone servers without disclosing technical details. Given Progress’s MOVEit breach history, UK SMEs using ShareFile must immediately verify whether they are affected and document what data transits through the platform. DocuSign Impersonation and RMM Tool Abuse Stormshield documented a phishing campaign impersonating DocuSign to install legitimate RMM tools (Atera) as attacker infrastructure. Because the payload is legitimate software, endpoint detection often fails to flag it. UK SMEs must train staff to verify DocuSign notifications through the portal, maintain an authorised RMM tool list, and treat any DocuSign prompt requesting software installation as malicious. Conclusion The three threats share a common vulnerability: organisations have not recently audited their own infrastructure. The action item for UK SMEs is to verify router configurations, file transfer system deployments, and authorised RMM tools this week, not next quarter. Links https://www.ncsc.gov.uk/news/joint-advisory-russian-cyber-actors-targeting-network-edge-devices https://www.stormshield.com/news/docusign-phishing-campaign-deploys-atera-rmm/ https://www.ncsc.gov.uk/guidance/rm-tool-abuse https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a

16:55

Jul 10, 2026

Preventable Failures: NetScaler Ransomware, Session Theft, and Email Errors

Preventable Failures: NetScaler Ransomware, Session Theft, and Email Errors This episode examines three current UK cyber security incidents that share a troubling characteristic: all were preventable. Mauven MacLeod analyses the seven-step ransomware chain exploiting unpatched Citrix NetScaler appliances (CVE-2025-5777), documented by Huntress across multiple UK organisations. The briefing covers SilabRAT, a subscription-based Remote Access Trojan sold for £3,900 monthly that clones browser sessions to bypass multi-factor authentication, posing particular risk to finance teams and managed service providers. The episode also examines an NHS Forth Valley data breach caused by a misdirected email, representing the most common breach category reported to the ICO. Additional coverage includes GigaWiper destructive malware and active exploitation of Check Point VPN vulnerabilities (CVE-2026-50751) associated with Qilin ransomware. The analysis emphasises the systemic gap between awareness and action, providing specific verification steps for UK small and medium businesses. Chapters Introduction: The Common Thread of Prevention Failures Mauven introduces three unrelated but preventable security incidents affecting UK organisations with existing IT support and best-practice solutions. The episode examines systemic failures in closing known security gaps. CitrixBleed 2: Seven-Step Ransomware Chain Analysis of the seven-step attack chain exploiting CVE-2025-5777 in Citrix NetScaler appliances, documented by Huntress across multiple UK organisations. Covers the automated exploitation process, Dragonforce ransomware deployment, and the disproportionate risk to UK mid-market professional services firms. Call to Action Brief encouragement to follow the show and share with business owners who need threat intelligence briefings. SilabRAT: Credential Theft by Subscription Examination of SilabRAT Remote Access Trojan, available for £3,900 monthly, which clones browser profiles and sessions to bypass multi-factor authentication. Covers Hidden Virtual Network Computing capabilities, targeting of finance teams, and supply chain risks through compromised managed service providers. NHS Forth Valley: An Email Incident Without an Attacker Analysis of a maternity patient data breach at NHS Forth Valley caused by misdirected email, representing the most common breach category in ICO statistics. Discusses the need for documented verification processes before sending bulk emails containing sensitive data. On the Radar: GigaWiper and Check Point VPN Brief coverage of GigaWiper destructive malware and active exploitation of CVE-2026-50751 in Check Point Remote Access VPN since May 2026, associated with Qilin ransomware. Emphasises immediate patch verification requirements. Conclusion: The Gap Between Awareness and Action Summary emphasising that the common thread across all incidents is the failure to act on known risks. Provides specific action items for verifying patch status of NetScaler and Check Point VPN systems. Links https://www.huntress.com/blog/citrixbleed-2-seven-step-ransomware-chain https://www.group-ib.com/blog/silabrat-analysis/ https://www.theregister.com/2026/07/nhs-forth-valley-maternity-data-breach https://www.ncsc.gov.uk/guidance/email-security https://www.microsoft.com/en-us/security/blog/gigawiper-analysis https://www.checkpoint.com/advisories/cve-2026-50751

14:06

Jul 9, 2026

RoguePlanet Zero-Day, Vidar Supply Chain Infiltration, and CE Plus Pathways

RoguePlanet Zero-Day, Vidar Supply Chain Infiltration, and CE Plus Pathways A delayed patch for the RoguePlanet zero-day in Windows Defender has finally arrived, but working exploit code was publicly available for weeks before Microsoft closed the vulnerability. Mauven examines what that exposure window means for UK SMBs and why confirming patch deployment today is not optional. The Vidar infostealer campaign has quietly evolved beyond phishing emails into developer toolchains, with malicious Go modules staged across more than two hundred GitHub repositories designed to appear credible and actively maintained. Socket’s Operation Muck and Load research reveals how attackers are using commit farming and typosquatting to compromise software supply chains, particularly targeting payment SDK names. Finally, the NCSC has published guidance on Cyber Essentials Pathways, an alternate route to Cyber Essentials Plus certification that may reduce friction for smaller organisations pursuing verified assessment. Mauven explores what this policy shift signals about the growing expectation for Plus-level certification in public sector contracts and supply chain assurance. Three practical actions close the episode: verify the RoguePlanet patch has been applied, implement dependency verification for developers pulling open-source packages, and review the NCSC pathways guidance if you hold basic Cyber Essentials certification. Chapters Introduction Mauven previews three stories: a delayed zero-day patch, an infostealer campaign migrating into developer toolchains, and an underreported NCSC policy update with practical implications for UK small businesses. RoguePlanet Zero-Day Patched, Weeks Late Microsoft has patched the RoguePlanet zero-day in Windows Defender, but exploit code was publicly available for weeks before the fix arrived. Mauven explains the exposure risk, emphasises the urgency of confirming patch deployment, and advises reviewing any anomalous Defender behaviour during the vulnerability window. Mid-Episode CTA Mauven encourages listeners to follow the show and share Threat Analysis with colleagues who need daily UK threat intelligence briefings. Vidar Infostealer Moves Into Developer Supply Chains The Vidar infostealer campaign has evolved from phishing emails to compromising developer toolchains. Socket’s Operation Muck and Load research identified malicious Go modules staged across 222 GitHub repositories using commit farming to appear credible. Seventeen typosquatted packages targeting payment SDKs were published on 7 July. Mauven details practical verification steps for developers pulling open-source dependencies. NCSC Cyber Essentials Pathways The NCSC has published guidance on Cyber Essentials Pathways, an alternate route to Cyber Essentials Plus certification. Mauven contextualises the policy update, explains why Plus certification is increasingly required for public sector contracts and supply chain assurance, and advises organisations holding basic certification to review the new pathways guidance. Closing Actions and Outro Mauven summarises three priority actions: confirm the RoguePlanet patch has been applied, brief developers on dependency verification, and read the NCSC Cyber Essentials Pathways blog. Closing remarks reinforce the importance of understanding vulnerability windows and consistent threat awareness. Links https://www.theregister.com/ https://asec.ahnlab.com/en/ https://unit42.paloaltonetworks.com/ https://socket.dev/ https://www.ncsc.gov.uk/blog-post/

13:27

Jul 8, 2026

Ubiquiti UniFi OS Critical Flaws and ColdFusion Emergency Patch

Ubiquiti UniFi OS Critical Flaws and ColdFusion Emergency Patch Ubiquiti has released security updates addressing seven critical vulnerabilities in UniFi OS, including one rated CVSS 10.0 that permits unauthenticated remote code execution. The widespread deployment of UniFi hardware in UK small business networks makes this a priority patching event. Separately, CISA has added an Adobe ColdFusion vulnerability to its Known Exploited Vulnerabilities catalogue, issuing an emergency patch deadline for US federal agencies after confirming active exploitation in the wild. ColdFusion remains widely deployed in UK professional services, legal and accountancy firms, and public sector environments, often in legacy web applications where platform visibility is poor. Finally, an ongoing phishing campaign delivering AsyncRAT and Remcos trojans continues to target finance, procurement, and operations staff using macro-enabled Excel attachments and fileless execution techniques. Mauven MacLeod provides specific guidance on how to verify patching status with IT providers, configure email filtering to block macro-enabled attachments, and enforce Office macro policy across business environments. Chapters Introduction Mauven opens the eighth of July briefing with a direct question about firmware version awareness, highlighting seven critical Ubiquiti UniFi OS vulnerabilities including one rated CVSS 10.0, a CISA emergency patch order for Adobe ColdFusion, and an ongoing phishing campaign targeting finance and procurement staff. Ubiquiti UniFi OS: Seven Critical Flaws, One at Maximum Severity Seven critical vulnerabilities in Ubiquiti UniFi OS have been disclosed, including a CVSS 10.0 command injection flaw permitting unauthenticated remote code execution. Given the widespread deployment of UniFi hardware in UK SMB networks and typically flat network architectures, successful exploitation provides attackers with perimeter-level access. Mauven advises requesting written confirmation of firmware updates from IT providers or checking firmware versions directly if self-managed. Call to Action Mauven encourages listeners to follow the show and share the episode with others who may have unpatched Ubiquiti infrastructure. Adobe ColdFusion: Actively Exploited, CISA Emergency Patch Deadline CISA has added a maximum-severity Adobe ColdFusion vulnerability to its Known Exploited Vulnerabilities catalogue, issuing an emergency patch deadline for US federal agencies by the end of the week. The flaw permits remote code execution and is confirmed exploited in the wild. ColdFusion remains widely deployed in UK professional services, legal, accountancy, and public sector environments, often in legacy web applications with poor platform visibility. Mauven recommends requesting written confirmation of patching from hosting providers and suppliers. On the Radar: AsyncRAT and Remcos Phishing Campaign An ongoing phishing campaign delivers AsyncRAT and Remcos remote access trojans via macro-enabled Excel attachments, using fileless execution techniques including steganography to evade signature-based detection. The campaign specifically targets finance, procurement, and operations staff who routinely receive Excel files from external parties. Mauven recommends disabling macro execution by default, deploying Attack Surface Reduction rules, configuring email gateways to quarantine macro-enabled files, and briefing staff in targeted functions. Closing Summary Mauven summarises three actionable items: obtain written confirmation of UniFi firmware updates, verify ColdFusion patching status with suppliers, and enforce Office macro policy with appropriate email filtering. None require significant budget, only deliberate follow-through. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/

16:24

Jul 7, 2026

Teams Impersonation, Multi-Stage Phishing, and the UK Cyber Pledge

Teams Impersonation, Multi-Stage Phishing, and the UK Cyber Pledge This episode examines three active threat vectors affecting UK businesses in July 2026. First, a sophisticated Microsoft Teams impersonation campaign documented by Unit 42, in which attackers pose as IT helpdesk staff to deploy EtherRAT remote access trojans without requiring any technical vulnerability. Second, a global phishing operation delivering AsyncRAT and Remcos through multi-stage infection chains that use steganography and fileless execution to evade detection, targeting finance, HR, and procurement functions. Third, the UK government’s new voluntary cyber pledge, signed by sixty organisations including two currently managing recovery from significant recent breaches. The episode also covers UAT-7810’s operational relay box networks and the NCSC’s Cyber Shield initiative. Practical mitigations include restricting Teams external access, blocking Office macros by default, implementing helpdesk verification processes, and ensuring endpoint protection uses behavioural detection rather than signature matching alone. Each recommendation is actionable within the current week and addresses documented attack patterns actively being exploited against UK small and medium businesses. Chapters Introduction Overview of three stories: two active threats requiring immediate attention and one piece of UK government policy that merits closer examination beyond the press release. Teams Helpdesk Scam: EtherRAT Unit 42 research documenting attackers impersonating IT helpdesk on Microsoft Teams to deploy EtherRAT. The attack requires no technical vulnerability, only a helpful employee. Covers Teams external access configuration, verification processes, and remote access tool auditing. Call to Action Reminder to follow the show and share with colleagues who would benefit from daily threat intelligence. Multi-Stage Phishing: AsyncRAT and Remcos SpiderLabs research on global phishing delivering AsyncRAT and Remcos through Excel attachments, HTA scripts, PowerShell, and steganography-concealed payloads. Targets finance, HR, and procurement. Emphasises macro blocking and behavioural detection requirements. UK Cyber Pledge: Sixty Signatories Examination of the UK government’s voluntary cyber pledge signed by sixty organisations, including two currently managing recovery from significant breaches. Discusses the difference between pledges and contractual security requirements. UAT-7810 ORB Networks Cisco Talos research on operational relay box networks built using compromised small business infrastructure. Explains why edge device security matters beyond direct targeting. NCSC Cyber Shield NCSC blog post on Cyber Shield, a sovereign AI-driven cyber defence initiative. Distinguishes between national-scale infrastructure projects and immediate operational threats. Summary and Actions Prioritised action list: restrict Teams external access, block Office macros, communicate helpdesk verification policy, confirm behavioural detection capability, and review supplier security contracts. Links https://unit42.paloaltonetworks.com/ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ https://www.ncsc.gov.uk/guidance/macro-security-for-microsoft-office https://blog.talosintelligence.com/ https://www.ncsc.gov.uk/blog-post/cyber-shield https://www.ncsc.gov.uk/

12:08

Jul 6, 2026

Adobe ColdFusion Zero-Day and Vishing Gang Pink Target UK SMBs

Adobe ColdFusion Zero-Day and Vishing Gang Pink Target UK SMBs Today’s briefing covers two active threats facing UK small businesses. First, CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion confirmed to be under active exploitation by the Canadian Centre for Cyber Security and verified by BleepingComputer. The flaw permits unauthenticated remote code execution with a CVSS score of 10.0, affecting legacy installations across SMB websites, internal applications, and shared hosting environments managed by MSPs. Second, a criminal group designated CL-CRI-1147 and tracked as Pink is conducting voice phishing campaigns that impersonate IT helpdesks to extract credentials and bypass multi-factor authentication. Once inside, the group exfiltrates data from SharePoint and OneDrive, then issues a seventy-two-hour ransom demand. The tactic closely mirrors operations by UNC3753, documented by Google Cloud Threat Intelligence. Both threats exploit different attack surfaces but share a common trait: neither discriminates by organisation size. Mauven provides specific procedural guidance for patching, MSP coordination, staff briefings on vishing, and audit log monitoring to detect bulk data downloads before ransom demands arrive. Chapters Introduction Mauven introduces two current threats facing UK small businesses: an actively exploited Adobe ColdFusion vulnerability and a criminal vishing operation. Both target SMBs without discrimination based on size or sophistication. Adobe ColdFusion CVE-2026-48282: Patch It Today, Not This Week Analysis of CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion confirmed under active exploitation. Covers CVSS 10.0 scoring, unauthenticated remote code execution, exposure through legacy systems and MSP-managed environments, and immediate patching requirements. Call to Action Brief audience prompt to follow the show and share the briefing with colleagues who need current threat intelligence. Pink (CL-CRI-1147): When the Threat Just Calls You Up Examination of the Pink criminal group’s vishing operation that impersonates IT helpdesks to extract credentials and bypass MFA. Details the exfiltration timeline, procedural defences, staff briefing requirements, and technical monitoring for SharePoint and OneDrive bulk downloads. The Pattern Worth Noting Structural analysis connecting the Adobe vulnerability, vishing campaigns, and emerging ClickFix malware ecosystem. All three exploit different attack surfaces but converge on the same principle: automated and human-driven threats do not filter targets by organisation size. Closing Summary of two actionable steps: verify and patch ColdFusion installations immediately, and brief staff on the vishing rule that IT will never request credentials or MFA approval by phone. Links https://www.bleepingcomputer.com/news/security/adobe-coldfusion-cve-2026-48282-exploited/ https://www.cyber.gc.ca/en/alerts-advisories https://cloud.google.com/blog/topics/threat-intelligence/unc3753-vishing-law-firms

14:52

Jul 3, 2026

Device Code Phishing, Avalon Ransomware, and the NetNut Botnet Takedown

Device Code Phishing, Avalon Ransomware, and the NetNut Botnet Takedown This briefing examines three significant threats to UK small and medium businesses in July 2026. First, Cisco Talos’s analysis of ARToken, a phishing-as-a-service platform exploiting Microsoft 365 device code authentication flows to bypass multi-factor authentication. The technique, productised for affiliate use, requires immediate Conditional Access policy review. Second, Blackpoint Cyber’s documentation of Avalon, a multi-stage ransomware framework using spoofed legal documents, Proton Drive hosting, and memory-only execution to evade detection. Third, the NetNut botnet takedown by Google and the FBI, involving two million compromised residential devices used as proxy infrastructure. The operational implications extend beyond the headline: unpatched IoT devices and routers continue to provide access via vulnerabilities from 2017 and 2018. Each attack is designed to appear normal within legitimate business operations. The briefing provides three concrete actions: restrict device code authentication in Entra ID, establish verification procedures for password-protected archives, and audit firmware on internet-facing devices. These measures address the gap between assumed and actual security control effectiveness in small business environments. Chapters Introduction Mauven introduces three threat items for 3rd July 2026, prioritised by risk to UK SMBs. Two are active attack campaigns with direct exposure, one is a law enforcement action with under-reported operational implications. ARToken M365 Phishing Platform Analysis of ARToken, a phishing-as-a-service platform exploiting Microsoft device code authentication flows. The technique bypasses MFA by abusing legitimate authentication processes. Direct mitigation requires restricting device code flows through Conditional Access policies in Entra ID. Call to Action Listener engagement prompt encouraging follows and sharing. Avalon Ransomware Framework Blackpoint Cyber’s analysis of Avalon, a multi-stage attack framework using spoofed legal documents hosted on Proton Drive, password-protected ISO archives, and memory-only execution. Targets professional services with plausible social engineering. Requires staff training, behavioural endpoint detection, and ISO mounting restrictions. The NetNut Botnet Takedown Google and FBI action against NetNut residential proxy botnet involving two million compromised devices. Discusses how compromised devices provide cover for credential stuffing and fraud, and notes active propagation of similar botnets via vulnerabilities from 2017 and 2018. Emphasises firmware update and credential hygiene on internet-facing devices. Broader Pattern Note All three threats share a common characteristic: they are designed to appear normal within legitimate business operations. The security gap lies between assumed and actual control effectiveness, closed through visibility rather than additional tools. Outro Closing summary with practical question for IT providers regarding Conditional Access policies. Sign-off and production credit. Links https://blog.talosintelligence.com/artoken-phishing-as-a-service/ https://www.blackpointcyber.com/resources/blog/avalon-a-new-ransomware-framework/ https://www.theregister.com/2026/07/02/google_fbi_netnut_botnet/ https://www.ncsc.gov.uk/collection/device-security-guidance https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17215 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8007

13:38

Jul 1, 2026

Ransomware Group Defeats Endpoint Protection and Microsoft 365 Phishing Threat

Ransomware Group Defeats Endpoint Protection and Microsoft 365 Phishing Threat The Gentlemen ransomware group has emerged as a top-ten global threat actor by deploying zero-day driver exploits to disable endpoint security tools before launching encryption attacks. Using a vulnerable Kontron driver and the Bring Your Own Vulnerable Driver technique, the group neutralises detection systems silently, often gaining hours of undetected access through compromised VPN and firewall appliances. Meanwhile, the ARToken phishing-as-a-service platform automates Microsoft 365 account takeover through device code phishing and Primary Refresh Token persistence. Standard multi-factor authentication does not prevent these attacks, as the OAuth authentication flows are legitimate. The platform includes automated email and SharePoint exfiltration, plus integrated business email compromise tooling that industrialises payment redirection fraud. UK small businesses using Microsoft 365 face direct exposure, particularly in professional services, accountancy, and financial sectors where client data and payment processes rely on email systems. The NCSC has published guidance on restricting device code flow and monitoring for these attacks, yet implementation remains inconsistent even in critical national infrastructure environments. Chapters Introduction Overview of two urgent threat developments: a ransomware group defeating endpoint security and an automated Microsoft 365 phishing platform bypassing multi-factor authentication. The Gentlemen Ransomware Group and Zero-Day Driver Exploits Analysis of The Gentlemen’s rise to top-ten threat status through Bring Your Own Vulnerable Driver techniques, their use of a Kontron driver zero-day to disable endpoint protection, and their systematic approach to network reconnaissance and ransomware deployment. Call to Action Encouragement to share the briefing and subscribe for daily updates. ARToken: Automated Microsoft 365 Account Takeover Detailed examination of the ARToken phishing-as-a-service platform, its device code phishing methodology, Primary Refresh Token persistence, automated data exfiltration, and integrated business email compromise workflows that bypass standard MFA. NCSC Penetration Testing Findings Brief discussion of persistent security gaps identified in critical national infrastructure, including default credentials, insufficient segmentation, and poor patch management. Closing Recommendations Summary of immediate actions: enable tamper protection, verify monitoring procedures, restrict device code flow in Microsoft 365, and implement out-of-band payment verification. Links https://securelist.com/the-gentlemen-ransomware-group/ https://expel.com/blog/ https://www.ncsc.gov.uk/guidance/bring-your-own-vulnerable-driver https://blog.talosintelligence.com/artoken-phishing-as-a-service/ https://www.ncsc.gov.uk/guidance/device-code-flow https://www.ncsc.gov.uk/blog-post/pen-testing-critical-national-infrastructure

12:57

Jun 30, 2026

Windows Defender Flaw Hits Commodity Ransomware; RMM Tools Under Attack

Windows Defender Flaw Hits Commodity Ransomware; RMM Tools Under Attack Two critical threats demand immediate attention from UK small businesses today. First, the BlueHammer vulnerability in Microsoft Defender has transitioned from targeted zero-day attacks to commodity ransomware operations, a shift that dramatically expands the pool of threat actors capable of exploiting it. CISA’s addition of BlueHammer to its Known Exploited Vulnerabilities catalogue confirms active exploitation in the wild, with the flaw enabling attackers to escalate privileges to SYSTEM level and deploy ransomware across entire networks. Second, Blackpoint Cyber has documented an active intrusion chain exploiting CVE-2026-48558, an authentication bypass in SimpleHelp remote monitoring and management software. This attack vector is particularly concerning because it targets the tools IT providers use to manage client systems, turning the trust relationship between businesses and their managed service providers into an attack surface. The operational implication is clear: attackers are systematically exploiting the privileged access that IT management tools provide, bypassing direct targeting in favour of supply chain compromise. Patches exist for both vulnerabilities. The gap between availability and deployment is where ransomware operators operate. UK SMBs should contact their IT providers today to confirm patching status and ask specific questions about RMM tool security. This briefing provides actionable guidance on exactly what to ask and why it matters. Chapters Introduction Mauven introduces today’s two threat stories: the BlueHammer vulnerability in Windows Defender crossing into commodity ransomware operations, and an attack targeting remote management tools used by IT providers. BlueHammer: From Zero-Day to Ransomware Commodity Analysis of CISA’s KEV addition for BlueHammer, a privilege escalation flaw in Microsoft Defender now exploited in commodity ransomware operations. Covers the transition from targeted attacks to volume-based campaigns, the operational playbook of ransomware-as-a-service groups, and the practical patching actions UK SMBs must take immediately. CTA Brief call to action encouraging listeners to follow the show and share it with business owners and operations managers who need actionable threat intelligence. SimpleHelp RMM: The Attack That Comes Through Your IT Provider Detailed examination of CVE-2026-48558, an authentication bypass in SimpleHelp remote monitoring and management software. Explains how attackers exploit RMM tools to gain technician-level access to managed client systems, the malware deployed (TaskWeaver and Djinn Stealer), and the supply chain risk this represents for UK SMBs. What UK SMBs Should Do Today Direct, actionable guidance for UK small businesses: specific questions to ask IT providers about BlueHammer patching, SimpleHelp vulnerability status, RMM access log reviews, and incident disclosure processes. Outro Closing summary emphasising the gap between patch availability and deployment, urging businesses to actively verify patching status with their IT providers rather than assume it has been handled. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://securelist.com/gentlemen-raas-h1-2026/ https://www.blackpoint.io/blog/simplehelp-rmm-exploitation-cve-2026-48558

14:22

Jun 29, 2026

Oracle EBS Exploitation and DriveSurge Campaign Active in the Wild

Oracle EBS Exploitation and DriveSurge Campaign Active in the Wild Oracle E-Business Suite vulnerability CVE-2026-46817 is under active exploitation, with confirmed activity from threat intelligence firm Defused. Nissan’s recent breach of its Oracle PeopleSoft instance underscores the broader risk to Oracle’s enterprise portfolio. UK small businesses face exposure through supply chain relationships with payroll bureaus, accountancy firms, and manufacturers running Oracle systems. Meanwhile, newly documented threat actor DriveSurge operates a pay-per-install initial access broker model, compromising legitimate websites to deliver malware through fake browser updates and ClickFix social engineering. The campaign bypasses email security controls entirely, infecting users through normal web browsing. Additional concerns include active exploitation of Langflow (CVE-2026-55255) and the Miasma Mini Shai-Hulud supply chain campaign now targeting Backstage npm packages. Today’s briefing provides specific, actionable steps: verify Oracle patch status with suppliers, implement web filtering against zTDS infrastructure, brief staff on fake browser update prompts, and audit dependencies in development pipelines. These are email-and-call actions, not budget-heavy projects. Chapters Introduction Mauven opens with two active threat stories: exploitation of Oracle E-Business Suite and a drive-by attack campaign bypassing email controls through compromised websites. Both pose immediate risks to UK small businesses through supply chain and web browsing vectors. Oracle EBS Active Exploitation CVE-2026-46817 in Oracle E-Business Suite is under confirmed exploitation. Nissan’s PeopleSoft breach demonstrates sustained threat actor attention to Oracle’s enterprise platforms. UK small businesses face exposure through payroll bureaus, accountancy firms, and manufacturers. Practical steps include verifying patch status directly with suppliers and documenting responses in writing. Mid-Roll Call to Action Brief listener prompt to follow the show and share the briefing with relevant contacts. DriveSurge Drive-By Campaign DriveSurge, a newly documented initial access broker, compromises legitimate websites to deliver malware via fake browser updates and ClickFix prompts. The campaign uses zTDS traffic distribution and bypasses standard email security. Recommended defences include web filtering against zTDS infrastructure and staff briefing on fake update prompts. Langflow and Miasma Mini Shai-Hulud Updates CVE-2026-55255 in Langflow is under active exploitation, with lower-scored CVE-2026-33017 seeing wider use due to easier exploitation. The Miasma Mini Shai-Hulud campaign now targets Backstage npm packages. Organisations using AI frameworks or modern CI/CD pipelines should audit patch status and dependencies. Closing Summary Mauven summarises practical actions in order of urgency: verify Oracle patch status with suppliers, brief staff on fake browser updates, confirm web filtering covers zTDS, and audit development dependencies. All actions require communication and follow-up, not significant budget. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/supply-chain-security https://www.oracle.com/security-alerts/cpujun2026.html https://silentpush.com/blog/drivesurge-campaign https://sysdig.com/blog/langflow-cve-exploitation https://socket.dev/blog/miasma-mini-shai-hulud-backstage

5:43

Jun 26, 2026

Understanding Mini Shai-Hulud and Cisco's Zero-Day Vulnerabilities

Understanding Mini Shai-Hulud and Cisco’s Zero-Day Vulnerabilities In today’s episode of Threat Analysis, Mauven MacLeod delves into two significant cybersecurity threats impacting UK small and medium businesses. The Mini Shai-Hulud supply chain attack targets the development community by exploiting npm packages, risking developers’ credentials and threatening software integrity. Microsoft emphasises the importance of rigorous dependency audits to prevent malicious exploitation. Additionally, a zero-day vulnerability CVE-2026-20245 in Cisco’s Catalyst SD-WAN Manager is discussed. This allows attackers to escalate privileges through default passwords, compromising network security. The necessity of proactive cybersecurity measures, including multi-factor authentication and robust monitoring systems, is highlighted to safeguard businesses from these threats. Chapters Intro Mauven introduces the episode, highlighting critical threats for UK businesses. Mini Shai-Hulud Supply Chain Attack Discusses how Mini Shai-Hulud uses npm packages to access developer credentials, emphasising the need for vigilant software audits. CTA Encourages listeners to follow the show for updates and share with peers. CVE-2026-20245: Cisco’s Zero-Day Explores the Cisco vulnerability, stressing the dangers of default passwords and the importance of intrusion detection systems. Outro Reiterates the importance of proactive cybersecurity measures and invites listeners to return for future episodes. Links https://www.microsoft.com/security/blog https://www.cisco.com/security/advisories https://blog.npmjs.org

5:19

Jun 25, 2026

Emerging Cyber Threats to UK SMEs

Emerging Cyber Threats to UK SMEs In this episode of Threat Analysis, Mauven MacLeod dives into two pressing cybersecurity threats affecting UK small and medium businesses. The first is the Mistic backdoor, linked to the notorious Woodgnat, which employs the cunning technique of sideloading. This method uses legitimate software to conceal malicious activity, posing significant risks such as data leaks and financial loss. Mauven discusses the importance of a robust security posture and offers practical advice on staying protected. The second threat is the widespread FortiBleed campaign targeting Fortinet FortiGate devices through advanced techniques like credential stuffing and password spraying. The campaign highlights vulnerabilities found in legacy systems and underscores the need for up-to-date device management and strong authentication protocols. Listeners are encouraged to assess and fortify their cybersecurity defences actively. The episode closes with a reminder: awareness is key, but proactive measures are essential to safeguarding your business. Chapters Intro Mauven introduces today’s cybersecurity topics, focusing on threats to UK businesses. Mistic Backdoor Unveiled Discussion on the Mistic backdoor’s impact, sideloading techniques, and security recommendations. CTA Listeners are encouraged to follow the podcast and share it with others. FortiGate Under Siege Analysis of the FortiBleed campaign targeting Fortinet devices, with tips to enhance network security. Outro Recap of the threats discussed and a call to take proactive security measures. Links https://arcticwolf.com/resources/blogs https://www.fortiguardlabs.com https://www.ncsc.gov.uk

6:40

Jun 24, 2026

Understanding the Mistic Backdoor Threat to UK SMBs

Understanding the Mistic Backdoor Threat to UK SMBs In this episode of Threat Analysis, Mauven MacLeod explores the emerging threat landscape for UK small and medium businesses, focusing on the Mistic backdoor. This malware, linked to the ransomware access broker KongTuke, poses significant risks to crucial sectors such as insurance, education, IT, and professional services. The discussion highlights how Mistic operates stealthily within compromised systems, bypassing many traditional security measures and exacerbating vulnerabilities in supply chains. Additionally, the episode delves into broader cybersecurity concerns, including the critical vulnerability CVE-2026-20230 in Cisco Unified Communications Manager and privacy issues arising from London’s use of live facial recognition technology. Mauven provides actionable steps for SMBs to strengthen their defences, emphasising the importance of robust vendor audits, advanced threat detection, and well-prepared incident response plans, aligning with guidance from the National Cyber Security Centre. Chapters Intro Mauven introduces the focus on the Mistic backdoor and its relevance to UK SMBs. Mistic Backdoor Threat Exploration of the Mistic backdoor’s tactics, connection to KongTuke, and its impact on key sectors. The Broader Context Discussion on Cisco’s vulnerability and the implications of facial recognition technology in London. What Should You Do? Actionable cybersecurity measures for SMBs, including vendor audits and threat detection enhancements. CTA Encouragement to follow the show and share it with others needing the briefing. Outro Summary of today’s insights and the importance of proactive cybersecurity strategies. Links https://www.bleepingcomputer.com https://theregister.com

2:24

Jun 23, 2026

Klue Supply Chain Breach and AI Cybersecurity Warnings

Klue Supply Chain Breach and AI Cybersecurity Warnings In this episode of Threat Analysis, Mauven MacLeod explores a pressing supply chain attack that targets Salesforce environments through Klue’s backend systems. The breach, executed by the Icarus threat group, highlights the vulnerabilities of OAuth tokens and the implications for UK small businesses. Mauven discusses the importance of reviewing security practices to prevent data exposure. The episode also features a warning from the Five Eyes alliance about the potential risks associated with AI in cybersecurity. As AI technology evolves, safeguarding against its misuse becomes crucial. Tune in for essential insights and strategies to navigate these challenges. Chapters Intro Mauven introduces the focus on a crucial supply chain attack and AI-related cybersecurity threats. Klue Supply Chain Attack Hits Salesforce Environments Details the Icarus group’s attack on Klue, impacting Salesforce and the importance of OAuth token security. CTA Encourages listeners to follow the show for regular updates on cybersecurity threats. Five Eyes Warn of AI Escalating Cybersecurity Threats Highlights the Five Eyes alliance’s warning on AI exacerbating cybersecurity threats and the need for robust oversight. Outro Concludes with the interconnected nature of modern business threats and the importance of enhanced security measures. Links https://www.salesforce.com/news/stories/understanding-oauth-security/ https://www.techradar.com/news/lastpass-breach-what-you-need-to-know https://www.cisa.gov/news/five-eyes-cybersecurity

2:29

Jun 22, 2026

Key Cyber Threats Impacting UK Businesses

Key Cyber Threats Impacting UK Businesses Join Mauven MacLeod for today’s Threat Analysis, a briefing focused on the latest cyber threats facing UK businesses. The episode covers the sophisticated attack on 3CXDesktopApp, which exploits supply chain vulnerabilities through trojanised installers. We also delve into the FortiBleed campaign, highlighting the increased risk posed by attacks on Fortinet FortiGate firewalls. The AryStinger botnet is examined, demonstrating how outdated hardware can become a security liability. Finally, the episode discusses AI risks, emphasised by recent NCSC publications, underscoring the evolving role of AI in cybersecurity. Stay informed to protect your business from these modern threats. Chapters Intro Introduction to key cyber threats impacting UK businesses. 3CXDesktopApp Intrusion Discussion on trojanised installers and supply chain vulnerabilities. CTA Encouragement to follow and share the podcast for daily updates. FortiBleed Campaign Examination of attacks on Fortinet firewalls and SSL VPN gateways. AryStinger Botnet Analysis of the botnet hijacking outdated D-Link routers. AI Risks Exploration of AI’s role in cybersecurity and related threats. Outro Summary and emphasis on staying informed about cyber threats. Links https://www.ncsc.gov.uk

10:01

Jun 19, 2026

Active Splunk Exploit and npm Supply Chain Campaign

Active Splunk Exploit and npm Supply Chain Campaign CISA has confirmed active exploitation of a critical Splunk Enterprise vulnerability, with a patch deadline of 22 June 2026 for US federal agencies. UK organisations face the same threat but lack a legal mandate. Separately, over 140 npm packages in the mastra ecosystem were compromised through account takeover, pushing typosquatted dependencies that harvest credentials on installation. A second npm attack exploited a lapsed maintainer email domain to compromise node-ipc, exfiltrating SSH keys and cloud credentials via DNS. A third attack targeted PyPI’s Microsoft DurableTask client through a stolen GitHub account. The Okendo Reviews widget, used by over 18,000 e-commerce brands, was also found to contain malicious JavaScript in May 2026. These attacks share a common thread: patient exploitation of trust frameworks in developer tooling and monitoring platforms. Mauven provides actionable steps for UK businesses to verify patch status, audit dependency chains, review DNS monitoring capability, and confirm e-commerce widget remediation before the weekend. Chapters Intro Mauven introduces two active threats requiring immediate attention: a CISA advisory on exploited enterprise software and a coordinated developer ecosystem compromise campaign. Response capability drops over weekends, making Friday advisories particularly dangerous. npm Supply Chain Surge Microsoft Threat Intelligence confirmed compromise of over 140 npm packages via account takeover, pushing typosquatted dayjs dependency. A second attack exploited a lapsed maintainer email domain to compromise node-ipc, exfiltrating credentials via DNS. A third targeted PyPI’s DurableTask client. Okendo Reviews widget injected with malicious JavaScript in May 2026 affected 18,000 e-commerce brands. CTA Listener call to action: follow the show and share with colleagues who need threat intelligence. Splunk Enterprise Under Active Exploit CISA added Splunk Enterprise vulnerability to KEV catalogue with 22 June 2026 patch deadline for US agencies. UK organisations lack legal mandate but face identical risk. Compromised monitoring platforms allow attackers to suppress alerts and manipulate log data from a trusted internal position. ICO Leadership Change John Edwards resigned as Information Commissioner. Leadership transition creates institutional uncertainty around enforcement priorities, though legal obligations remain unchanged. What To Do Before Monday Immediate actions: verify Splunk patch status, audit recent npm and PyPI package updates, confirm Okendo widget remediation if present in May 2026, and implement or plan outbound DNS monitoring to close exfiltration blind spots. Outro Attackers exploit trust in packages, monitoring tools, and institutional frameworks. They are patient, sophisticated, and aware that Friday advisories are often deferred. Do not give them the weekend. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/supply-chain-security

10:44

Jun 17, 2026

DragonForce Hides in Teams, Joomla at Maximum Severity, and RoguePlanet Waits for a Patch

DragonForce Hides in Teams, Joomla at Maximum Severity, and RoguePlanet Waits for a Patch Three active threats demand immediate attention from UK small and medium businesses. Symantec researchers have documented DragonForce ransomware concealing command-and-control infrastructure inside Microsoft Teams relay servers using a custom backdoor that exploits anonymous visitor tokens. The intrusion evaded detection for over two weeks by routing malicious traffic through legitimate Microsoft infrastructure. CISA has added a maximum-severity Joomla Content Editor vulnerability (CVE-2024-43233) to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of an unauthenticated remote code execution flaw widely present in UK business websites. A publicly disclosed privilege escalation zero-day in Microsoft Defender, named RoguePlanet, remains unpatched while attackers actively deploy footholds through phishing and social engineering campaigns. Mauven examines why perimeter defences cannot catch infrastructure-layer threats, what behavioural anomaly monitoring actually means in practice, and why patch management discipline should not depend on regulatory deadlines. This briefing provides specific technical actions for Joomla users, questions to ask managed security providers, and interim controls for the Defender zero-day. Chapters DragonForce Conceals Command Infrastructure Inside Microsoft Teams Symantec documents a two-week ransomware intrusion using custom malware to route attacks through Microsoft Teams relay servers, evading perimeter defences by hiding inside legitimate traffic. The technique exploits TURN servers and anonymous visitor tokens, requiring behavioural anomaly monitoring rather than edge security to detect. CISA Adds Maximum-Severity Joomla Vulnerability to Exploitation Catalogue CVE-2024-43233, a CVSS 10.0 unauthenticated remote code execution flaw in the Joomla Content Editor plugin, is under active exploitation. The vulnerability affects a widely deployed extension common in UK small business websites. CISA has set a Friday patch deadline for federal agencies. RoguePlanet Privilege Escalation Zero-Day in Microsoft Defender Remains Unpatched A publicly disclosed privilege escalation vulnerability in Microsoft Defender, part of the Nightmare Eclipse research chain, has no available patch. Microsoft has confirmed work is underway. The flaw enables attackers who gain initial access through phishing or social engineering to escalate to full system control on Windows endpoints. Priority Actions and Patch Management Discipline Immediate actions include checking and patching Joomla JCE installations, asking managed security providers about internal anomaly monitoring capabilities, and applying least privilege controls while awaiting the Defender patch. A brief note covers an updated Cisco SD-WAN advisory affecting additional device models. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/

10:54

Jun 16, 2026

DragonForce Hides in Teams, Fortinet Flaws, and a Million Compromised WordPress Sites

DragonForce Hides in Teams, Fortinet Flaws, and a Million Compromised WordPress Sites Three critical threats demand immediate attention from UK small businesses today. DragonForce ransomware has deployed a custom backdoor that tunnels command-and-control traffic through Microsoft Teams relay infrastructure, exploiting implicit trust in cloud services. Multiple critical vulnerabilities in Fortinet’s FortiSandbox platform are being actively exploited in the wild, raising serious questions for businesses relying on managed security providers. Meanwhile, over 1.2 million WordPress sites have been compromised through a supply chain attack targeting OptinMonster, TrustPulse, and PushEngage plugins. CISA has also added a critical LiteSpeed cPanel vulnerability to its Known Exploited Vulnerabilities catalogue, affecting countless UK websites on shared hosting. Mauven MacLeod walks through the behavioural and operational gaps these threats expose, and provides four concrete actions businesses can take today: checking FortiSandbox patch status with managed security providers, verifying LiteSpeed plugin updates with hosting providers, auditing WordPress admin accounts, and reviewing Microsoft Teams external tenant access configurations. None of these actions require large budgets, but all require the willingness to ask direct questions of service providers. Chapters DragonForce Hides in Teams, Fortinet Flaws, and a Million Compromised WordPress Sites Mauven introduces three urgent threats: a sophisticated backdoor exploiting Microsoft Teams infrastructure, critical Fortinet vulnerabilities being actively exploited, and a WordPress supply chain attack compromising over a million sites. She explains why DragonForce’s Backdoor.Turn tool exploits implicit trust in Microsoft Teams relay traffic, details the pattern of Fortinet security product vulnerabilities, covers CISA’s urgent warning on LiteSpeed cPanel flaws, and reveals a supply chain attack through Awesome Motive’s CDN affecting OptinMonster, TrustPulse, and PushEngage plugins. The briefing concludes with four immediate actions: checking FortiSandbox patch status, verifying LiteSpeed updates, auditing WordPress admin accounts, and reviewing Teams external access settings. Links https://www.ncsc.gov.uk/collection/cloud-security https://defused.com/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://sansec.io/

10:04

Jun 16, 2026

One-Click Data Theft via M365 Copilot and Active Cisco SD-WAN Exploitation

One-Click Data Theft via M365 Copilot and Active Cisco SD-WAN Exploitation Two critical vulnerabilities demand immediate attention from UK businesses today. Researchers have disclosed SearchLeak, a prompt injection vulnerability chain in Microsoft 365 Copilot Enterprise that allows attackers to steal data from mailboxes, OneDrive, and SharePoint with a single malicious link. The attack exploits Copilot’s AI assistant functionality to exfiltrate sensitive information without further user interaction. Meanwhile, Cisco Talos reports active exploitation of authentication bypass vulnerabilities in Cisco Catalyst SD-WAN infrastructure by the sophisticated threat actor UAT-8616, who is deploying multiple command-and-control frameworks including Sliver and Godzilla for persistent network access. Most UK SMBs don’t run SD-WAN directly but face indirect exposure through managed service providers. Both threats target infrastructure that organisations trust by default but rarely examine closely. The episode provides specific verification steps for IT providers and MSPs, emphasising the gap between vendor patches and organisational verification as the primary source of security incidents. Chapters Introduction Mauven opens with an urgent warning about a one-click data theft vulnerability affecting Microsoft 365 Copilot Enterprise users, then previews coverage of active Cisco SD-WAN exploitation. SearchLeak: M365 Copilot as a Data Theft Tool Analysis of the SearchLeak vulnerability chain in Microsoft 365 Copilot Enterprise. The prompt injection attack allows attackers to use specially crafted URLs to instruct Copilot to search and exfiltrate data from mailboxes, OneDrive, and SharePoint. Microsoft has patched the vulnerability, but verification of deployment through MSPs is critical. Recommendations include confirming patch status, reviewing Copilot licence assignments, applying least privilege access controls, and exercising caution with links triggering Copilot interactions. Call to Action Reminder to follow the show and share with colleagues who need daily threat intelligence. Cisco SD-WAN: Active Exploitation by UAT-8616 Cisco Talos reports active exploitation of CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller and Manager. The sophisticated threat actor UAT-8616 is deploying Sliver, Godzilla, AdaptixC2, and Behinder for persistent access to network infrastructure. Most UK SMBs face indirect exposure through managed service providers running this infrastructure. Actions include immediate patching for direct users, verification calls to MSPs regarding their infrastructure and patching status, contract review for incident disclosure terms, and monitoring for anomalous routing changes. Supply Chain Pressure Continues Brief coverage of Arch Linux locking down AUR signups after malicious commits, and Unit 42 analysis of updated obfuscation techniques in Gremlin Stealer infostealer targeting browser credentials. Closing Mauven emphasises that both threats target infrastructure organisations trust without close examination. Final action items: contact IT providers or MSPs to verify M365 patch status and Cisco SD-WAN infrastructure security posture. Links https://www.cisco.com/c/en/us/support/web/security-advisories.html https://www.ncsc.gov.uk/

12:54

Jun 13, 2026

AI Phishing, Clinical Data Theft, and the CC Field Mistake

AI Phishing, Clinical Data Theft, and the CC Field Mistake Mauven MacLeod examines three incidents that illustrate how UK businesses are actually compromised in 2026. Google has sued a Chinese phishing operation selling AI-generated SMS fraud toolkits via Telegram, producing messages now indistinguishable from legitimate communications. Novo Nordisk disclosed that attackers accessed pseudonymised clinical trial data after a phishing email breach, demonstrating that even large pharmaceutical firms remain vulnerable. Plymouth City Council exposed hundreds of email addresses by using CC instead of BCC in a message to families, triggering an ICO report. Across all three stories, the common thread is not sophisticated exploits but phishing, human error, and procedural failure. Mauven walks through practical mitigations: phishing-resistant MFA, link-checking tools, verification protocols for payment requests, tested incident response plans, least-privilege access for special category data, and using proper email platforms instead of manual BCC. The episode also notes Microsoft’s resolution of a year-long Windows update deployment issue affecting centrally managed devices. None of these threats require nation-state resources. All of them are preventable with controls that already exist in published guidance. Chapters Introduction Mauven opens the 12 June 2026 briefing, noting that all three stories involve phishing or human error rather than exotic threats. Google Sues AI Phishing Operation Google has filed suit against Outsider Enterprise, a Chinese group selling AI-generated phishing toolkits via Telegram. AI now produces messages indistinguishable from legitimate communications. Mauven explains why traditional awareness training is failing and recommends phishing-resistant MFA, link-checking tools, verified callback protocols, and low-friction reporting processes. Novo Nordisk Clinical Data Breach Novo Nordisk disclosed that attackers accessed pseudonymised clinical trial participant data following a phishing email. Mauven emphasises that size is no defence, walks through UK GDPR notification requirements for special category data, and urges tested incident response plans, least-privilege access, and documented data protection contacts. Plymouth Council CC Field Error Plymouth City Council exposed hundreds of email addresses by using CC instead of BCC in a message to home-schooling families, then reported the breach to the ICO. Mauven explains Article 33 notification obligations and recommends process defaults, email marketing platforms, and brief team training. Windows Update Fix Microsoft resolved a known issue preventing Windows updates from installing via network share since May 2025. Unpatched devices remain a ransomware entry point. Closing Summary Mauven recaps the common thread across all stories and urges listeners to verify their suspicious message reporting loop. Promotes the Daily Threat Analysis Substack, Corrine Jefferson’s Daily CVE Update, and Graham Falkner’s practical security assessments. Links https://blog.thesmallbusinesscybersecurityguy.co.uk https://www.ncsc.gov.uk/guidance/phishing https://www.bleepingcomputer.com https://www.theregister.com https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-data-breaches/ https://www.ncsc.gov.uk/guidance/bulk-email