Your Firewall Has a Front Door. Attackers Found It in May 2026.
Palo Alto's GlobalProtect VPN has a confirmed authentication bypass under active exploitation. If you haven't patched, your network perimeter is already open.
Read more →All Articles
668 articles · Page 13 of 34
FortiClient Servers Are Delivering Malware, AI Is Running the Attacks, and WordPress Just Handed Out Admin Rights: Your Threat Brief for 29 May 2026
Fake Fortinet patches, AI-driven database raids, and a WordPress plugin handing out admin rights to strangers. Three stories that matter this week.
Read more →
Threat Analysis: FortiClient EMS Exploitation, Phoenix PhaaS, and AI-Assisted Attacks, What UK SMBs Need to Know
Three active threats converge today: a FortiClient EMS zero-day delivering infostealers, a PhaaS kit with MFA bypass, and AI-assisted espionage campaigns lowering the barrier for every attacker downstream.
Read more →
Set Up Security Logging for Your Small Business in 60 Minutes: A Step-by-Step Guide
Fifteen minutes for Microsoft 365. Fifteen for your firewall. Thirty for a weekly review process. Here is the practical logging guide your IT provider should have given you.
Read more →
Threat Analysis: BlackFile Extortion, ShinyHunters Data Theft, and the Voice Phishing Wave Hitting UK Businesses
Two financially-motivated threat groups are running active campaigns that should concern every UK business with a helpdesk, a SaaS stack, or customers whose data you hold.
Read more →
Threat Analysis: Blockchain C2, LiteSpeed cPanel Exploit, and SRG's Physical Pivot, What UK SMBs Need to Know
Blockchain-based C2 infrastructure, an actively exploited cPanel flaw, and an extortion gang that now shows up in person. Mauven explains what the advisories are not telling you.
Read more →
Joomla, Ghost CMS, and SharePoint: Three Patches Your Business Cannot Afford to Skip This Week
Joomla has three privilege escalation flaws scored 9.8. Ghost CMS is already being exploited across 700 websites. SharePoint needs patching now.
Read more →
Threat Analysis: OAuth Device Code Phishing, Laravel Supply Chain Compromise, and an Actively Exploited Drupal Flaw
Three separate threats with direct SMB exposure landed today. One targets Microsoft 365 credentials, one hits developers and their clients, and one is already being exploited in the wild.
Read more →
Why the Boring Stuff Catches the Bad Guys: Anomaly Detection for Businesses That Cannot Afford a SOC
You do not need a six-figure SOC to spot attackers. You need the same thing Clifford Stoll had in 1986: curiosity, logs, and a refusal to ignore what looks wrong.
Read more →
Ghost CMS and ClickFix: The Web Trap Your Staff Will Fall For
Seven hundred-plus websites turned into traps. One fake CAPTCHA. One click. Full device compromise. This is ClickFix, and it is coming for your team.
Read more →
Threat Analysis: Kali365 MFA Bypass and Laravel Supply Chain Compromise, What UK SMBs Need to Know
MFA is not the safety net you think it is. The FBI confirmed it this week. Here is what UK SMBs need to do right now.
Read more →
The Cuckoo's Egg: How a 75-Cent Error Became the First Cyber Espionage Case
A 75-cent billing error. One stubborn astronomer. A KGB spy ring. The Cuckoo's Egg is 37 years old and its lessons still embarrass most UK small businesses.
Read more →
Drupal Is Being Actively Exploited Right Now: What UK Small Businesses Need to Do Today
Drupal's being actively exploited right now. 15,000 attempts, 65 countries, CISA confirmed. If your site runs Drupal, you have a deadline of 27 May.
Read more →
Curiosity Is a Security Control: Why the Most Expensive Tool in Cyber Security Is Free
Vendors want to sell you fear. Consultancies want to sell you compliance. The most effective security tool costs nothing. It is the willingness to say: that looks wrong.
Read more →
Threat Analysis: Drupal SQL Injection Under Active Exploitation, Ubiquiti Max-Severity Flaws, and The Gentlemen Ransomware's UK Reach
Active exploitation of Drupal's SQL injection flaw began within 48 hours of disclosure. If your website or your supplier's runs Drupal, this is not a drill.
Read more →
The M&S DragonForce Attack One Year On: What a Phone Call to IT Support Cost a Billion-Pound Retailer
A social engineering phone call. A password reset. £300 million in losses. The M&S DragonForce attack is the most expensive lesson in UK retail cyber security history.
Read more →
Operation SIMCARTEL: The SIM Farm That Made a Mockery of UK SMS Verification
GoGetSMS sold SIM verification bypass on the open web for years. Europol shut it down. UK banks still rely on the control it defeated.
Read more →
Threat Analysis: Fox Tempest Malware-Signing Service, Supply Chain npm Attacks, and a Maximum-Severity Cisco Flaw
A malware-signing service is making ransomware harder to detect. npm packages with millions of downloads are compromised. And Cisco just patched a perfect-10 vulnerability.
Read more →
How To Roll Out TPM Plus PIN BitLocker On A Windows 11 Fleet
TPM plus PIN BitLocker is one Group Policy change, one command per device, and a Tuesday of user communication. The whole job fits in two weeks. Here is how.
Read more →
Microsoft Calls It Information Disclosure. The Rest of Us Call It MFA Bypass.
Microsoft calls CVE-2026-41615 information disclosure. It is an MFA bypass. The Authenticator app leaks work account tokens after one user tap.
Read more →