650 articles · Page 11 of 33
Active exploitation of Drupal's SQL injection flaw began within 48 hours of disclosure. If your website or your supplier's runs Drupal, this is not a drill.
Read more →
A social engineering phone call. A password reset. £300 million in losses. The M&S DragonForce attack is the most expensive lesson in UK retail cyber security history.
Read more →
GoGetSMS sold SIM verification bypass on the open web for years. Europol shut it down. UK banks still rely on the control it defeated.
Read more →
Three WordPress plugins just handed attackers the keys to your website. CVSS 9.8. No login required. Here is what to do before Friday.
Read more →
A malware-signing service is making ransomware harder to detect. npm packages with millions of downloads are compromised. And Cisco just patched a perfect-10 vulnerability.
Read more →
TPM plus PIN BitLocker is one Group Policy change, one command per device, and a Tuesday of user communication. The whole job fits in two weeks. Here is how.
Read more →
A USB stick defeats BitLocker. Three WordPress plugins hand attackers full admin access. The intelligence is clear. Here is what to do about it.
Read more →
Microsoft calls CVE-2026-41615 information disclosure. It is an MFA bypass. The Authenticator app leaks work account tokens after one user tap.
Read more →
The NCSC's Windows guidance has recommended TPM plus PIN for years. Most UK organisations ignored it. YellowKey just changed what that decision costs.
Read more →
MFA bypass-as-a-service is now sophisticated enough to defeat most SMB defences. Vidar is back, rebuilt in Go, and harder to detect than ever.
Read more →
CISA confirmed active exploitation of a Microsoft Exchange vulnerability this week. UK small businesses running on-premise email need to act today.
Read more →
Europol have just published the closest thing to an honest map of organised cybercrime. Your security supplier has not mentioned it. Why?
Read more →
43% of UK businesses breached. Revenue impact doubled. Board engagement finally rising. Mauven MacLeod reads between the lines of the DSIT survey.
Read more →
A days-old NGINX vulnerability is already being probed and exploited. Grafana's source code was stolen via a single access token. Two stories, one theme: patch windows are collapsing.
Read more →
Two weeks ago we swallowed the 43% headline whole. Today, having read every page of the CSBS 2025/2026, here is what we should have told you the first time.
Read more →
NGINX powers roughly a third of the web. CVE-2026-42945 is being exploited right now. Here is what UK small businesses need to do before Friday.
Read more →
BitLocker is on, so we're fine. Five days after YellowKey dropped, that sentence has become a confession. Here is what the default actually protects against.
Read more →
Every business owner who chose the cheaper IT quote just made an insurance decision. They did not know that. Most of them still do not. That is the whole problem.
Read more →
Three active threats converge today: an exploited Exchange zero-day, a surge in device code phishing targeting Microsoft 365, and a supply chain attack that caught OpenAI. All three have direct implications for UK SMBs.
Read more →
Three critical flaws landed overnight. WordPress sites, Microsoft Authenticator, and on-premises email are all in the frame. Here is the data, without the spin.
Read more →