582 articles · Page 7 of 30
Fifteen minutes for Microsoft 365. Fifteen for your firewall. Thirty for a weekly review process. Here is the practical logging guide your IT provider should have given you.
Read more →
Two financially-motivated threat groups are running active campaigns that should concern every UK business with a helpdesk, a SaaS stack, or customers whose data you hold.
Read more →
Attackers can brute-force their way into any WordPress account in minutes. A Windows kernel flaw hands them SYSTEM privileges. Both need fixing today.
Read more →
Blockchain-based C2 infrastructure, an actively exploited cPanel flaw, and an extortion gang that now shows up in person. Mauven explains what the advisories are not telling you.
Read more →
Joomla has three privilege escalation flaws scored 9.8. Ghost CMS is already being exploited across 700 websites. SharePoint needs patching now.
Read more →
Three separate threats with direct SMB exposure landed today. One targets Microsoft 365 credentials, one hits developers and their clients, and one is already being exploited in the wild.
Read more →
You do not need a six-figure SOC to spot attackers. You need the same thing Clifford Stoll had in 1986: curiosity, logs, and a refusal to ignore what looks wrong.
Read more →
Seven hundred-plus websites turned into traps. One fake CAPTCHA. One click. Full device compromise. This is ClickFix, and it is coming for your team.
Read more →
MFA is not the safety net you think it is. The FBI confirmed it this week. Here is what UK SMBs need to do right now.
Read more →
A 75-cent billing error. One stubborn astronomer. A KGB spy ring. The Cuckoo's Egg is 37 years old and its lessons still embarrass most UK small businesses.
Read more →
Drupal's being actively exploited right now. 15,000 attempts, 65 countries, CISA confirmed. If your site runs Drupal, you have a deadline of 27 May.
Read more →
Vendors want to sell you fear. Consultancies want to sell you compliance. The most effective security tool costs nothing. It is the willingness to say: that looks wrong.
Read more →
Active exploitation of Drupal's SQL injection flaw began within 48 hours of disclosure. If your website or your supplier's runs Drupal, this is not a drill.
Read more →
A social engineering phone call. A password reset. £300 million in losses. The M&S DragonForce attack is the most expensive lesson in UK retail cyber security history.
Read more →
GoGetSMS sold SIM verification bypass on the open web for years. Europol shut it down. UK banks still rely on the control it defeated.
Read more →
Three WordPress plugins just handed attackers the keys to your website. CVSS 9.8. No login required. Here is what to do before Friday.
Read more →
A malware-signing service is making ransomware harder to detect. npm packages with millions of downloads are compromised. And Cisco just patched a perfect-10 vulnerability.
Read more →
TPM plus PIN BitLocker is one Group Policy change, one command per device, and a Tuesday of user communication. The whole job fits in two weeks. Here is how.
Read more →
A USB stick defeats BitLocker. Three WordPress plugins hand attackers full admin access. The intelligence is clear. Here is what to do about it.
Read more →
Microsoft calls CVE-2026-41615 information disclosure. It is an MFA bypass. The Authenticator app leaks work account tokens after one user tap.
Read more →