224 articles
SCKit hit 288 hosts across 48 organisations via ScreenConnect on the 11th of November. Luna Moth is back at law firms. And a Check Point zero-day is being exploited for root access right now.
Read more →
Attackers are hijacking the same tool your IT provider uses to fix your computers. And if you have a Synology NAS, your files may already be exposed.
Read more →
Two active campaigns are turning legitimate remote access tools against the businesses they're supposed to protect. Here is what that means for UK SMBs.
Read more →
Your MSP's remote management platform may be the door attackers walk through. Two stories today that every UK small business owner should hand to their IT provider.
Read more →
Attackers are actively exploiting Barracuda email gateways for root access. Chrome has its eighth zero-day this year. Turla is reading government email. Three things that need your attention today.
Read more →
Three threats converge today: backup software being weaponised against MSP clients, hotel reservation phishing with surgical personalisation, and Microsoft bouncing legitimate email from domains with weak authentication.
Read more →
Three confirmed, actively exploited vulnerabilities. SonicWall VPNs, Apple devices, WordPress sites. If you use any of these, read this before Friday.
Read more →
APT29 is targeting mobile devices via compromised websites. Exposed refrigeration controllers are running spam infrastructure. And email-based phishing hit 7.3 billion detections in Q3 2026.
Read more →
Three threats with direct UK SMB exposure today: APT29 mobile watering holes, a patched Zyxel network switch zero-day, and a phishing kit that defeats MFA without touching your password.
Read more →
Three threats converging today: a patched WordPress flaw now actively exploited, APT29 zero-click mobile attacks, and a cascade of AI developer platform compromises that every business using AI tools needs to understand.
Read more →
Attackers are inside WordPress sites right now. CISA confirmed it. If your business runs WordPress and you haven't patched, you're already in trouble.
Read more →
The NCSC says AI-assisted attacks on UK critical infrastructure are coming by 2028. The Node-RED ICS exploit is already here. Two stories, one message.
Read more →
A perfect 10.0 CVSS router flaw and a WordPress plugin vulnerability that hands attackers your entire server. Both published this week. Both fixable today.
Read more →
Ivanti zero-days chained in the wild since October. FortiMail unauthenticated file write being actively exploited. Over 1,000 GitLab servers still unpatched and under attack. This is not a quiet Monday.
Read more →
More than 20 CVSS 10.0 vulnerabilities dropped overnight, most of them targeting the cheap routers sitting in UK small business offices right now.
Read more →
CISA has added a max-severity GitLab vulnerability to its exploited catalogue. Drupal Commerce is also being actively attacked. Here is what that means if you run either platform.
Read more →
Two actively exploited vulnerabilities confirmed yesterday. One can take your firewall offline. The other lets attackers own your development pipeline without a password.
Read more →
Three threats converging today. PHP2Shell exploit chains confirmed in the wild, a Cisco firewall zero-day crashing SSL VPNs, and Q3 incident data showing vishing against IT helpdesks is on the rise.
Read more →
Unauthenticated attackers can take over your WordPress site right now. Plus: a Linux kernel flaw confirmed as actively exploited. Here is what to do.
Read more →
Three threats landing today that UK SMBs cannot afford to ignore: a CISA-confirmed critical Brotli exploit, a breach of a major UK domain registrar, and Teams being weaponised for social engineering at scale.
Read more →
Two threats are running hot today: PHP2Shell is now CISA KEV-confirmed and linked to Lazarus Group, and Microsoft Teams external chat is being weaponised at scale. Here is what that means for your business.
Read more →
Attackers are exploiting PHP in the wild today. 953 online stores are quietly stealing your customers' card details. Both problems are fixable this week.
Read more →
PHP2Shell is being exploited right now. Three quarters of the web runs PHP. If you have a website, this is your problem.
Read more →
Attackers are now using AI agents to run their post-breach operations. This week's intelligence explains what that means for your business.
Read more →
A banking trojan, a supply chain hit on AI tooling, and a bootkit that kills your AV before you know it's there. Here is what matters today.
Read more →
Attackers were inside PHP servers before the patch existed. And if your IT provider uses ConnectWise, read the ConnectWise section carefully.
Read more →
PHP2Shell is live, exploits are circulating, and your website might already be a target. Here is the data, stripped of vendor noise.
Read more →
The NCSC published an urgent PHP alert today. PoC exploits are already circulating before the patch dropped. If you run a website, this is your first call of the day.
Read more →
Plex is a media server. It is also, right now, an actively exploited attack vector. CISA confirmed four vulnerabilities yesterday. Here is what you need to know.
Read more →
Three stories today that UK SMBs cannot afford to file away. One is a supply chain attack on software you probably have installed. One is a CVSS 9.8 RCE that is already being exploited in the wild. One is a cautionary tale from Wales that has your name on it.
Read more →
Two stories this week. One hits your website. One hits your network. Both are being actively exploited right now. Here is what to do.
Read more →
Vendor credentials used as master keys into client environments. NetScaler RCE actively exploited in the wild. Two stories, one lesson.
Read more →
Three threats converge today: a confirmed zero-day in BeyondTrust remote support tools, AI-orchestrated exploitation of PaperCut print management software, and a ransomware cartel with growing UK exposure.
Read more →
Three stories today that share a common thread: edge devices, legacy data, and the gap between what advisories say and what they mean for your organisation.
Read more →
CISA confirmed active exploitation of backup and email gateway vulnerabilities this week. If your MSP uses Ahsay CBS, the clock is already ticking.
Read more →
Law enforcement took down the CoGUI phishing empire today. Meanwhile, Ivanti Connect Secure is being actively exploited right now. Here is what both mean for your business.
Read more →
CISA confirmed active exploitation of two critical flaws on the 13th of October 2026. Here is the plain-English breakdown and your action list.
Read more →
Ransomware gangs now threaten your family. PDFs from any source can hijack your server. And Microsoft just dropped 1,411 patches in a single Tuesday. Here is what to do.
Read more →
Three stories today that UK SMBs cannot ignore: a fresh UK retail breach, critical NetScaler zero-days being exploited in the wild, and a catastrophic reminder of what weak passwords cost.
Read more →
Three critical threats in one day: GitLab's CI/CD engine has a max-severity RCE flaw, Artifactory is being actively exploited via chained CVEs, and a global retailer has taken systems offline.
Read more →
Attackers don't need your password if the software already has one baked in. Three this-week CVEs show exactly how that plays out.
Read more →
Recent threats StyleSmuggler and ClingSTUN present significant risks to UK SMBs.
Read more →
Understand the latest threats targeting UK SMBs and learn how to protect your business effectively.
Read more →
BPFDoor and AVERAT campaigns blend with legitimate mail traffic to infiltrate network-edge systems. Is your defence up to scratch?
Read more →
UK businesses must act swiftly on critical Citrix and Ahsay security threats. Ensure your systems are not gateways for attacks.
Read more →
Actively exploited FortiMail and Dell vulnerabilities present critical threats requiring immediate patches.
Read more →
Cisco and Zimbra vulnerabilities threaten UK businesses. Discover what you need to secure your systems today.
Read more →
Today, we discuss new malware loaders and critical vulnerabilities affecting UK SMBs.
Read more →
Latest security breaches highlight the urgent need for updates. Act now to protect your business.
Read more →
ValleyRAT spreads as adware and TeamViewer urges patching severe flaws. SMBs should take note.
Read more →
New critical vulnerabilities in Netcore devices could pose a serious threat to UK SMB networks. Here’s what to do.
Read more →
Delve into the latest UK cyber threats, including OpenAI's GPT-6.1 developments and Kiteworks vulnerability patches.
Read more →
Urgent: Citrix zero-days require immediate action from UK SMBs. Your network could be at risk.
Read more →
Active exploitation of Citrix vulnerabilities and the ShinyHunters mass exploitation campaigns target UK businesses.
Read more →
New critical vulnerabilities in WSO2 and Adobe products put UK SMBs at risk. Here's what you need to know.
Read more →
Understanding CVE-2026-93952 and how OpenSUpdater hides in recompiled 7zip files is essential for UK SMB security.
Read more →
Three active threat campaigns UK SMBs cannot ignore today: TeamCity under ransomware fire, Roundcube being exploited in the wild, and ClickFix spreading through fake CAPTCHAs.
Read more →
Chrome has four V8 vulnerabilities under active exploitation. A new Android banking trojan is targeting Western European banks. And the ClickFix technique is still running campaigns through bulletproof hosting. Here is what matters.
Read more →
INC ransomware, an autonomous AI-driven implant, and an unpatched D-Link zero-day. Today's brief covers the three threats that actually matter this Tuesday.
Read more →
Zyxel and Gigatech vulnerabilities are actively exploited. Take immediate action to safeguard your business.
Read more →
Five perfect-score vulnerabilities in common small business routers. No authentication required. Exploits already public. What are you waiting for?
Read more →
UK SMBs should be aware of North Korea's Lazarus campaigns and supply chain vulnerabilities.
Read more →
Cisco's identity security product has a maximum-severity zero-day being exploited in the wild. If your network uses Cisco kit, this is not a drill.
Read more →
Two high-impact campaigns landed this week. One hit 100,000 sites through a trusted marketing platform. The other is Clop, back with a purpose-built data theft implant.
Read more →
A perfect-10 Cisco zero-day is being actively exploited. Simultaneously, GhostCode is stealing Microsoft 365 credentials through business contact forms. Both land on UK SMBs today.
Read more →
A CISA-confirmed remote access exploit and a sophisticated OAuth phishing kit are both in active use. Here is what to do before the end of the day.
Read more →
Attackers are already inside WooCommerce shops. One human operator hit an SSH bastion in eight seconds. Here is what that means for your business today.
Read more →
Google Tag Manager abused to steal payment data from UK Magento sites. Two new IoT botnets scanning for unpatched edge devices. Today's brief covers both.
Read more →
A fintech breach via impersonation and an actively exploited GitLab flaw. Both are problems your business could be facing right now.
Read more →
CISA's KEV list grew by six this week. Two of the entries sit in technology that UK small businesses use every single day.
Read more →
APT29 weaponising hotel Wi-Fi. AI-assisted attackers compromising 440 PaperCut servers in hours. Today's briefing covers two campaigns UK SMBs cannot afford to ignore.
Read more →
A Russian-speaking attacker used hundreds of AI agents to compromise 440 servers in 48 hours. Your router might be next. Here is what to do today.
Read more →
Two confirmed active exploitation events, one patched months ago and still being hit. If you run WatchGuard or Chrome, read this before you do anything else today.
Read more →
Citrix/NetScaler and Google Chrome face active exploits targeting authentication bypass and arbitrary code execution.
Read more →
Unpatched Plex servers and active Windows exploits pose a serious risk to UK SMBs.
Read more →
Stay informed: critical vulnerabilities in Adobe and Microsoft require immediate attention.
Read more →
Urgent: New zero-days in Microsoft Defender and Chrome. Get protected today!
Read more →
CRITICAL CVEs in D-Link and Adobe systems are actively exploited. UK SMBs, are you patched?
Read more →
Unpatched Magento RCE and BigBear phishing target UK SMBs. Act now to protect your business.
Read more →
Mage zero-day and a $320M cyber-heist highlight key threats for UK SMBs.
Read more →
Three converging threats today: Teams helpdesk impersonation, infostealer session hijacking that defeats MFA, and a real-world case of what happens when you forget to revoke a leaver's access.
Read more →
Attackers are inside Switchvox phone systems and SonicWall VPN gateways without needing a single credential. Here is what that means for your business today.
Read more →
SonicWall is patching zero-days under active exploitation. Attackers are impersonating your IT helpdesk on Teams. And Dropbox accounts were breached through a hardware vendor's identity flaw.
Read more →
Three stories landing on the same day: an Exchange auth bypass leaving 22,000 servers open, PaperCut zero-days actively stealing data, and a BGP hijack that poisoned a hosting supply chain for 33 hours.
Read more →
Two PaperCut vulnerabilities are being actively exploited right now. CISA added them to its Known Exploited Vulnerabilities catalogue yesterday. Here is what you need to do.
Read more →
A confirmed UK breach, a sophisticated CAPTCHA-based attack chain, and Microsoft telling you to ignore your own antivirus. Today's briefing covers all three.
Read more →
Three threats, no comfortable answers. PaperCut is being exploited right now, your helpdesk impersonators have a new backdoor, and your office router may already be compromised.
Read more →
Three vulnerabilities confirmed actively exploited in 48 hours. One lets attackers read, modify, or delete any file without a password. The data speaks for itself.
Read more →
The NCSC is warning about internet-exposed systems again. Manchester Airports Group has lost 8.7 million customer records. And Teams vishing is now a structured initial access business.
Read more →
Ubiquiti and Gitea vulnerabilities confirmed exploitable today. If your network runs UniFi or self-hosted Git, this is not one to park for next week.
Read more →
Three active threats converging today: ClickFix malware delivery, a Check Point firewall bypass being exploited in the wild, and a Zimbra RCE campaign that has already claimed 270 servers.
Read more →
Two actively exploited vulnerabilities and a sophisticated vishing campaign targeting Microsoft 365. Today's briefing covers what the advisories are not telling you.
Read more →
A Teams-based phishing loader and a coordinated Rust supply chain attack are active today. Both have direct exposure paths for UK small businesses.
Read more →
Three distinct threats landed today. One is CISA-confirmed actively exploited. One is knocking on Europe's door via Android. None of them care how small your business is.
Read more →
Three threats converging today: a CISA-confirmed Windows RCE being exploited right now, Clop back with purpose-built data-theft tooling, and a phishing-as-a-service platform with over 4,000 confirmed victims.
Read more →
CISA has confirmed ransomware gangs are exploiting a Windows Task Host flaw. Separately, Microsoft Copilot has a command injection vulnerability that can leak your data. Both affect UK SMBs today.
Read more →
Publicly available exploits, unpatched routers, and WordPress plugins with nine-point-nine CVSS scores. This week's threat brief is not comfortable reading.
Read more →
Three separate threat streams converging today, and UK SMBs sit in the blast radius of all of them.
Read more →
Latest cyber threats and vulnerabilities impacting UK SMBs this July.
Read more →
Unpack today's critical vulnerabilities threatening small businesses: IBM, Spikster, and WordPress under fire.
Read more →
Outlook email vulnerabilities and npm package risks highlight threats facing UK SMBs.
Read more →
Newly discovered vulnerabilities expose UK businesses to unauthorised access and serious risks. Here's what you need to know.
Read more →
Discover critical security flaws in IBM WebSphere impacting UK small businesses. Act now to secure your operations.
Read more →
Flying Eagle Android RAT and Dysphoria Botnet expose UK businesses to mobile fraud and sophisticated C2 threats.
Read more →
FortiOS and VeloCloud vulnerabilities expose UK SMBs to critical risks. Don't wait, take action now.
Read more →
Helpdesk Hijackers exploit Teams, while WordPress vulnerabilities threaten site security. Act fast!
Read more →
Critical vulnerabilities in Microsoft Defender and Java Spring Boot pose risks to UK SMBs. Update now.
Read more →
Fastjson and Cl0p ransomware exploitations are active. Know the risks and defensive steps.
Read more →
Microsoft Exchange and Azure vulnerabilities demand immediate attention from UK SMEs.
Read more →
Mistic backdoor linked to ransomware, and the FortiBleed campaign highlight growing risks. Learn how to protect your SMB.
Read more →
Exploited vulnerabilities in SharePoint and Oracle put small businesses at risk. Act fast to secure your infrastructure.
Read more →
New AI vulnerabilities like Dolphin X Stealer and rogue ChatGPT agents are targeting UK businesses. Here’s the analysis.
Read more →
UK SMBs face critical cybersecurity threats from re-extortion ransomware and an exploited Langflow RCE flaw.
Read more →
WordPress and Oracle flaws threaten UK SMBs. Here's what you need to do now to secure your business.
Read more →
A critical VPN flaw exploited by Qilin ransomware poses risks to UK SMBs. Urgent action required.
Read more →
Three active threats UK SMBs need to act on today: a critical ServiceNow RCE, passkey enrolment vishing, and a large-scale FortiGate credential harvesting campaign.
Read more →
FortiSandbox flaws are being actively exploited, a Windows zero-day with no patch is now public, and ClickFix attacks are hitting UK businesses daily. Here is what you need to know.
Read more →
CISA added a Microsoft SharePoint remote code execution flaw to its active exploitation list on 16 July 2026. Here is what UK small businesses need to do today.
Read more →
Five and a half years each for the TfL hackers. A Russian group hiding malware inside legitimate collaboration tools. And a supply chain worm loose in the npm ecosystem. Here is what today actually means.
Read more →
Two Microsoft zero-days are being actively exploited right now. One requires no login whatsoever. Here is what to do before close of business.
Read more →
SonicWall zero-days are being exploited in the wild. Microsoft patched 570 flaws in one go. Here is what actually matters for your business this week.
Read more →
Three stories today that UK SMBs cannot afford to ignore: SharePoint flaws being actively exploited, a sophisticated AiTM phishing operation, and a poisoned npm supply chain.
Read more →
Your MFA is not the safety net you think it is. Two new phishing kits are bypassing it right now, and AI is doing the heavy lifting for attackers.
Read more →
Attackers are executing arbitrary code on Joomla websites right now. CISA confirmed it. Here is what UK small businesses need to do today.
Read more →
The NCSC has joined a Nine-Eyes advisory on Russian state actors targeting poorly configured routers. Meanwhile, Progress ShareFile has ordered an emergency server shutdown over an undisclosed threat.
Read more →
Three stories today that together explain exactly how UK SMBs get compromised in 2026. One is a patched vulnerability nobody patched. One is a £3,900-a-month RAT. One is a CC field.
Read more →
A Defender zero-day with public exploit code, a Vidar infostealer surge hitting developer toolchains, and a quiet but significant change to Cyber Essentials Plus certification.
Read more →
CVSS 9.8. No authentication required. A WordPress plugin flaw published yesterday lets attackers run arbitrary code on your server. Here is what it means.
Read more →
Two max-severity vulnerabilities are being actively exploited right now. If your office runs Ubiquiti kit or any ColdFusion-backed web infrastructure, read this first.
Read more →
Fake IT support on Teams. Steganographic RAT delivery via phishing. And Capita signed a government cyber pledge. It has been that kind of day.
Read more →
A perfect-10 Adobe flaw exploited within two hours. Hundreds of unpatched RMM servers still exposed. Two stories your IT provider needs to hear today.
Read more →
CVE-2026-48282 is being exploited in the wild. Meanwhile, a criminal group called Pink is ringing your staff and talking their way past MFA. Here is what both mean for your business.
Read more →
Three active campaigns with direct UK SMB exposure: a sophisticated M365 phishing platform, a legal-lure ransomware framework, and a residential proxy botnet the FBI just cracked open.
Read more →
A maximum-severity flaw in SimpleHelp RMM is being actively exploited. Attackers are walking straight through your MSP's front door. Here is what that means for your business.
Read more →
Two threats. One kills your endpoint security before you know it's there. The other hands your Microsoft 365 to criminals on a subscription basis.
Read more →
Ransomware gangs are now exploiting a Windows Defender privilege escalation flaw confirmed by CISA. If your MSP uses SimpleHelp, you have a second problem to deal with today.
Read more →
The remote support tool your IT provider uses to fix your computers has a flaw that lets attackers walk straight in. No password required.
Read more →
Oracle's E-Business Suite is being actively exploited right now. And a new initial access broker is turning legitimate websites into malware delivery points.
Read more →
Today's focus: Supply chain attacks on npm packages and active zero-day exploitation in Cisco SD-WAN. Crucial for UK SMBs.
Read more →
WordPress plugin flaws and a Cisco exploit are high-risk for UK SMBs. Urgent updates recommended.
Read more →
Exploring recent threats: a new backdoor may be linked to ransomware, and a large-scale FortiGate campaign affects security.
Read more →
UK SMBs must be aware: Mistic backdoor linked to ransomware broker is active. What this means for your security.
Read more →
Lantronix and UniFi OS vulnerabilities demand immediate attention from UK SMEs to prevent breaches.
Read more →
An authentication bypass leaves a quiet signal: admin activity, not exploit traffic. Most small businesses are not watching for it.
Read more →
Ignoring IBM Langflow and WordPress plugin threats could sink your SMB. Here's what you need to know.
Read more →
Klue's Salesforce breach affects UK SMBs. Dive into supply chain vulnerabilities and AI risks.
Read more →
Analysing key cyber threats affecting UK businesses today. From supply chain attacks to AI risks, stay informed.
Read more →
Your developers' tools and your logging stack are both under active attack today. Here is what is actually happening and what to do about it.
Read more →
73,000 Fortinet VPN credentials leaked, Evil Corp's botnet dismantled, and WordPress plugin supply chain compromised again. Three stories that matter to UK small businesses today.
Read more →
Microsoft has confirmed a Defender zero-day with no patch in sight. If your business runs Windows, this is not a drill.
Read more →
Three active threats UK SMBs cannot ignore today: ransomware hiding in Microsoft's own infrastructure, a Joomla CMS exploit already in the wild, and an unpatched Defender zero-day.
Read more →
CISA confirmed active exploitation of a Joomla plugin flaw on Tuesday. Microsoft has no patch for its Defender zero-day. Two fires, one week. Here is what to do.
Read more →
DragonForce is hiding ransomware command traffic inside Microsoft Teams. Fortinet FortiSandbox has critical flaws being actively exploited. Here is what UK SMBs need to know today.
Read more →
Microsoft 365 Copilot has a critical vulnerability chain that lets an attacker steal your mailbox data with a single crafted URL. Cisco SD-WAN is under active exploitation. Both matter to UK SMBs right now.
Read more →
AI-powered phishing is scaling faster than organisations can train against it. Three stories today that UK SMBs cannot afford to ignore.
Read more →
A high-volume ransomware operation with Russian-speaking roots and an AI-powered phishing platform impersonating trusted brands. Both are active today.
Read more →
Three Windows zero-days, an Exchange Server exploit in the wild, and Ivanti Sentry bugs that score a perfect 10. Today's patches are not optional.
Read more →
Attackers bypassed Check Point VPN passwords in the wild before a patch existed. If your remote access still runs IKEv1, you are already compromised.
Read more →
Cisco SD-WAN and SolarWinds Serv-U are both being actively exploited this week. One has no patch. Here is the data, stripped of vendor spin.
Read more →
Two active campaigns are hitting organisations that look exactly like UK SMBs. One calls your staff pretending to be IT support. The other fakes LinkedIn and Indeed.
Read more →
CISA just added two actively exploited flaws to its KEV catalog. If you run WordPress or Magento, you are in the crosshairs today.
Read more →
Three separate threat streams converging today, and all three have direct exposure for UK SMBs and their IT suppliers.
Read more →
Three active threats converging on UK SMBs today: a mass phishing platform bypassing MFA, a RAT delivered via Microsoft Teams, and two unpatched maximum-severity router vulnerabilities.
Read more →
Three active threats that UK SMBs need to act on today: a Java RAT delivered via Microsoft Teams, a two-year-old Oracle flaw now on the CISA KEV list, and 33 malicious npm packages stealing cloud credentials.
Read more →
Attackers are actively exploiting a critical Windows Netlogon flaw. No login required. One packet and your domain controller is compromised.
Read more →
Patch windows have closed. Both the Windows Netlogon RCE and Palo Alto GlobalProtect auth bypass are now being exploited in the wild. Here is what that means for your business.
Read more →
Palo Alto's GlobalProtect VPN has a confirmed authentication bypass under active exploitation. If you haven't patched, your network perimeter is already open.
Read more →
Three active threats converge today: a FortiClient EMS zero-day delivering infostealers, a PhaaS kit with MFA bypass, and AI-assisted espionage campaigns lowering the barrier for every attacker downstream.
Read more →
Two financially-motivated threat groups are running active campaigns that should concern every UK business with a helpdesk, a SaaS stack, or customers whose data you hold.
Read more →
Blockchain-based C2 infrastructure, an actively exploited cPanel flaw, and an extortion gang that now shows up in person. Mauven explains what the advisories are not telling you.
Read more →
Joomla has three privilege escalation flaws scored 9.8. Ghost CMS is already being exploited across 700 websites. SharePoint needs patching now.
Read more →
Three separate threats with direct SMB exposure landed today. One targets Microsoft 365 credentials, one hits developers and their clients, and one is already being exploited in the wild.
Read more →
Seven hundred-plus websites turned into traps. One fake CAPTCHA. One click. Full device compromise. This is ClickFix, and it is coming for your team.
Read more →
MFA is not the safety net you think it is. The FBI confirmed it this week. Here is what UK SMBs need to do right now.
Read more →
Drupal's being actively exploited right now. 15,000 attempts, 65 countries, CISA confirmed. If your site runs Drupal, you have a deadline of 27 May.
Read more →
Active exploitation of Drupal's SQL injection flaw began within 48 hours of disclosure. If your website or your supplier's runs Drupal, this is not a drill.
Read more →
Three WordPress plugins just handed attackers the keys to your website. CVSS 9.8. No login required. Here is what to do before Friday.
Read more →
A malware-signing service is making ransomware harder to detect. npm packages with millions of downloads are compromised. And Cisco just patched a perfect-10 vulnerability.
Read more →
MFA bypass-as-a-service is now sophisticated enough to defeat most SMB defences. Vidar is back, rebuilt in Go, and harder to detect than ever.
Read more →
CISA confirmed active exploitation of a Microsoft Exchange vulnerability this week. UK small businesses running on-premise email need to act today.
Read more →
A days-old NGINX vulnerability is already being probed and exploited. Grafana's source code was stolen via a single access token. Two stories, one theme: patch windows are collapsing.
Read more →
NGINX powers roughly a third of the web. CVE-2026-42945 is being exploited right now. Here is what UK small businesses need to do before Friday.
Read more →
Three active threats converge today: an exploited Exchange zero-day, a surge in device code phishing targeting Microsoft 365, and a supply chain attack that caught OpenAI. All three have direct implications for UK SMBs.
Read more →
Three critical flaws landed overnight. WordPress sites, Microsoft Authenticator, and on-premises email are all in the frame. Here is the data, without the spin.
Read more →
Quantum computing could break encryption soon. UK SMBs must act now to secure data. Learn the steps to protect your business and gain a competitive edge.
Read more →
An initial access broker is using Microsoft Teams to own corporate networks in five minutes flat. A Linux kernel privilege escalation with working exploit code dropped today. Neither is theoretical.
Read more →
A wormable Windows Server flaw, a payment platform with a forgeable secret key, and 130 patches. Here is what matters to your business this week.
Read more →
A new ransomware operation with Qilin connections is accelerating. Supply chain attacks are poisoning developer tools and AI platforms. Here is what matters today.
Read more →
120 vulnerabilities. A critical Windows Netlogon flaw. A Windows DNS buffer overflow. This is not a drill. Here is what to do this week.
Read more →
Signed packages, a six-minute supply chain blitz, and ransomware using blockchain to hide its C2. Today's brief covers two threats that reach well beyond enterprise targets.
Read more →
AI is now writing zero-day exploits. Cloud infrastructure is being weaponised against your staff. And TrickMo just made its banking trojan significantly harder to detect.
Read more →
Attackers can own your WordPress store without a password. cPanel has fresh critical flaws. CISA just confirmed active exploitation of Ivanti. Three reasons to act today.
Read more →
APT28 is rewriting your router's DNS settings. Ivanti EPMM has a zero-day with active exploitation. And threat actors are abusing remote management tools to drop malware via phishing. Here is what UK SMBs need to know today.
Read more →
Attackers are inside Ivanti EPMM before patches existed. If your business manages mobile devices, this is not someone else's problem.
Read more →
A critical Palo Alto firewall flaw is being actively exploited with no patch yet available. If your MSP manages a PAN-OS device, ask them one question.
Read more →
State-sponsored actors had a month inside Palo Alto firewalls before the advisory came out. Storm-1175 is still moving. And your developers may have already run the poisoned package.
Read more →
A Palo Alto firewall zero-day is being actively exploited right now. And MuddyWater is using Microsoft Teams to walk through your front door. Both matter today.
Read more →
A fake Teams installer is dropping backdoors globally. A third-party analytics vendor handed ShinyHunters 119,000 email addresses. And UK romance fraud hit £102M last year. Three stories, one briefing.
Read more →
Three high-impact threats landed simultaneously on 4th May 2026. If your business uses MOVEit, runs Linux servers, or has developers using Python, read this now.
Read more →
CISA confirmed active exploitation of a Linux root access flaw this week. If your business runs Linux anywhere, including on a NAS or cloud VM, read this now.
Read more →
Unauthenticated attackers can upload malware or log in as your site admin right now. Two critical WordPress flaws. No patch excuses.
Read more →
44,000 hosting control panels confirmed compromised. A WordPress plugin is handing out admin access to anyone who asks. This week's threats are not theoretical.
Read more →
A supply chain attack on open-source security tooling and a Linux privilege escalation exploit with working code in the wild. Two threats. One uncomfortable Friday.
Read more →
A critical cPanel flaw is being actively exploited with ransomware already reported. TeamPCP is poisoning open-source security tools. The NCSC says a patch wave is coming. Today is not a quiet day.
Read more →
Public exploit code for a Linux root access flaw has defenders scrambling. If your business runs Linux anywhere, this is not a drill.
Read more →
A critical cPanel authentication bypass has been exploited since February. A new Linux root exploit dropped today. And 43% of UK businesses were compromised last year. Pick your priority.
Read more →
This week's threat brief covers a critical cPanel auth bypass requiring emergency patching, ClickFix phishing campaigns stealing credentials via PowerShell, and VECT ransomware that wipes files it cannot encrypt.
Read more →
Three active campaigns converge on UK small businesses this week: voice-driven extortion, poisoned developer packages, and OAuth phishing that bypasses MFA. Here is what they are not telling you.
Read more →
Nineteen critical flaws. One router model. All exploits published. If your office uses a Totolink A8000RU, you are already exposed.
Read more →
TeamPCP is back. Three concurrent package compromises in one week. Here is what UK businesses using Python or Node.js tooling need to do right now.
Read more →
Voice phishing plus credential harvesting. Malicious Python packages with 11 million monthly downloads. This is what active UK cyber threats look like today.
Read more →
CISA just added SimpleHelp remote support vulnerabilities to its actively-exploited list. If your IT provider uses it, attackers may already have a path in.
Read more →
A quiet day on the KEV and NVD feeds. Mauven explains why that is not the same as a safe day.
Read more →
61% of organisations were breached through their supply chain last year. Just 7% monitor beyond immediate suppliers. That is a structural failure, not bad luck.
Read more →
63% of UK SMBs faced cyber incidents in 2023. Learn how to prepare and protect your business assets effectively.
Read more →
Attackers are weaponising the same remote access tools your IT team uses. Sophos has the receipts. Here is what happened and what you need to do.
Read more →
Your cyber policy probably excludes losses from state-backed attacks. You may not have read that clause. If a nation-state campaign sweeps through your sector, it could void your cover entirely.
Read more →
Two working exploits in one week. One public, one confirmed in the wild. Neither fully patched. Here is what UK SMBs need to do right now.
Read more →
Scammers use virtual smartphones to deceive small businesses. Learn how to protect your business and prevent financial loss.
Read more →
AI-driven cyberattacks are here. Learn how to protect your UK small business from these sophisticated threats before it's too late.
Read more →
The TeamPCP campaign targets software supply chains. Learn how UK SMBs can protect themselves from these escalating threats.
Read more →
AI-driven threats are evolving fast. Is your business keeping up? Discover how to protect your enterprise from cutting-edge cybercriminal tactics.
Read more →
AiTM phishing is targeting small businesses. Discover how to protect your social media accounts from this new threat before it's too late!
Read more →
Law enforcement landed a hit on Tycoon2FA. Then Tycoon2FA got back up. That should tell you everything you need to know about identity attacks in 2026. If your plan begins and ends with MFA, you are still leaving the door open.
Read more →