Skip to content
Sign in
Artwork for Decrypted: The UK Cyber Briefing
Technology

Decrypted: The UK Cyber Briefing

Davinder Singh

The UK cyber security story that matters today, in about four minutes. A short daily briefing on the breaches, vulnerabilities and policy that affect UK organisations, what actually went wrong, and the design decision that would have prevented it.

Play
Open in
  • 65 episodes
  • daily
  • Avg 4 min
  • English

Episodes 65

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • S2026 · E72
    Today · 3 min

    ASOS shows how one convincing phone call becomes a customer data breach

    Evening edition, Saturday 17 October 2026 ASOS says an attacker posed as a trusted contact to get an employee's login, then used it on third-party customer platforms. The Secure by Design lessons are phishing-resistant sign-in, least privilege and two-person control. Also: Drupal's critical flaw and Anthropic's warning on small AI models. Sources Infosecurity Magazine: ASOS confirms data breach linked to stolen employee credentials eSecurity Planet: ASOS cyberattack, employee credentials and customer data Drupal security advisory SA-CORE-2026-014 BleepingComputer: Drupal patches critical RCE flaws, warns exploits may emerge soon Anthropic: AI models may be capable of self-replicating without access to a datacenter Read the written version

    • Transcript
  • S2026 · E71
    Today · 4 min

    Candiru spyware delivered through adverts: when the ad is the exploit

    Morning edition, Saturday 17 October 2026 Citizen Lab says an ad tech firm let Candiru spyware reach chosen devices through ordinary adverts, with no click needed. The Secure by Design lesson is that a vendor badge is not a control. Plus an exploited Nextcloud flaw and Anthropic's self-replicating AI warning. Sources Citizen Lab: Exposing AdFection, how Discover-Tech turned targeted ads into a pipeline for spyware BleepingComputer: Targeted ads installed Candiru spyware in zero-click attacks Collabora security advisory GHSA-g3vx-3m76-fghh (CVE-2026-110447) BleepingComputer: Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers Anthropic: AI models may be capable of self-replicating without access to a datacenter BleepingComputer: Anthropic warns self-replicating AI could spread to your smart devices Read the written version

    • Transcript
  • S2026 · E70
    Yesterday · 4 min

    BeyondTrust's remote support zero-day: the cabinet of master keys

    Evening edition, Friday 16 October 2026 BeyondTrust has disclosed a Remote Support zero-day that a suspected China-linked group has exploited since late August. What the attackers did, what defenders can still see, and the Secure by Design lesson for UK organisations. Sources Google Threat Intelligence: ARMORY CASTLE exploits BeyondTrust (CVE-2026-102764) BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August BleepingComputer: BAE Systems cyberattack disrupts US federal court operations The Record: Federal bankruptcy courts dealing with cyberattack outage BleepingComputer: Anthropic warns self-replicating AI could spread to your smart devices Semafor: Anthropic issues warning on self-replicating AI Read the written version

    • Transcript
  • S2026 · E69
    Yesterday · 4 min

    The Legal Aid Agency breach reaches back to 1978

    Morning edition, Friday 16 October 2026 The Legal Aid Agency says about 250,000 stolen records predate 2007, the earliest from 1978. The lesson is about retention and segmentation. Also: a Palo Alto PAN-OS zero-day and Anthropic's self-replicating AI research. Sources The Record: UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978 BleepingComputer: UK Legal Aid Agency, hackers stole records dating back to 1978 GOV.UK: Legal Aid Agency data breach Palo Alto Networks security advisory CVE-2026-0322 BleepingComputer: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks Anthropic: Self-replicating AI research Read the written version

    • Transcript
  • S2026 · E68
    Thursday · 4 min

    Cisco's email gateway is exploited again: the scanner with the keys

    Evening edition, Thursday 15 October 2026 Cisco has confirmed active exploitation of CVE-2026-76519, an unauthenticated root flaw in its Secure Email Gateway. Palo Alto Networks disclosed an exploited PAN-OS management flaw the same day. What each means for UK organisations, plus the Legal Aid Agency's revised breach scope and the NCSC's post-quantum TLS guidance. Sources Cisco Security Advisory: Secure Email Gateway Arbitrary File Write (CVE-2026-76519) Palo Alto Networks: CVE-2026-0322 PAN-OS management interface CISA adds four Known Exploited Vulnerabilities to catalogue, 14 October 2026 SOC Prime: CVE-2026-76519 analysis Legal Aid Agency cyber security incident: data update, October 2026 (GOV.UK) NCSC: Post-quantum updates to our TLS guidance Read the written version

    • Transcript
  • S2026 · E67
    Thursday · 4 min

    Ledger's hidden implants and the weakest link in hardware supply

    Morning edition, Thursday 15 October 2026 Ledger has confirmed hidden spy implants in some hardware wallets sold through one reseller. The device passed its own authenticity check. The Secure by Design lesson for UK buyers of any key-holding hardware: provenance is a security control. Sources BleepingComputer: Ledger confirms spy chip implant behind wallet crypto thefts BleepingComputer: Ledger asks sellers across Asia to halt sales after supply-chain attack The Record: Ledger says a hardware implant in crypto wallets stole recovery phrases Palo Alto Networks advisory: CVE-2026-0322 Anthropic Frontier Red Team: self-replicating AI research BleepingComputer: Global takedown hits network behind 1 billion phishing messages Read the written version

    • Transcript
  • S2026 · E66
    Wednesday · 4 min

    The Housing Ombudsman's complaints system is down, and the fault sits with a supplier

    Evening edition, Wednesday 14 October 2026 The Housing Ombudsman Service cannot take complaints online after a third-party incident hit its case management system. What is known, what is not, and the supplier questions a board can ask this week. Also: Docker Hub's token flaw and Microsoft's phishing takedown. Sources Housing Ombudsman Service statement: IT security incident Inside Housing: Housing Ombudsman's case management system hit by cyberattack Docker Hub security advisory: CVE-2026-105445 BleepingComputer: Docker Hub flaw let attackers impersonate users, tamper with images The Record: Microsoft takes down 3 major Chinese phishing platforms BleepingComputer: Global takedown hits network behind 1 billion phishing messages Read the written version

    • Transcript
  • S2026 · E65
    Wednesday · 4 min

    Ivanti Connect Secure: a zero-day chain that your integrity checker cannot see

    Morning edition, Wednesday 14 October 2026 Volexity says an attacker chained Ivanti Connect Secure flaws to take root on patched VPN appliances, leaving no malware and evading the vendor's integrity checker. What UK organisations should do, plus Docker Hub, the Housing Ombudsman and a Norwegian ad-tech fine. Sources Volexity: A Series of Unauthenticated Events, chained exploitation of Ivanti Connect Secure zero-days BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks Docker: Docker Hub security advisory CVE-2026-105445 Housing Ombudsman Service: statement on IT security incident Datatilsynet: Microsoft company fined NOK 92 million for unlawfully sharing personal data Read the written version

    • Transcript
  • S2026 · E64
    Tuesday · 4 min

    A South African parent, three British fashion brands and the questions every board should ask

    Evening edition, Tuesday 13 October 2026 TFG says a cyber incident has knocked out IT systems at Phase Eight, Hobbs and Whistles, and it does not yet know if customer data was taken. What the separation of its systems teaches UK boards, plus Ledger's hardware implants and the NCSC's post-quantum pilot. Sources The Record: South African clothing retailer Foschini Group investigating cyberattack on British fashion brands TechCentral: Fashion retailer TFG discloses cyberattack BleepingComputer: Ledger confirms hardware wallet spy implant behind crypto thefts The Record: Ledger says hardware implant in crypto wallets stole users' recovery phrases NCSC: Assured Cyber Security Consultancy, post-quantum cryptography pilot Read the written version

    • Transcript
  • S2026 · E63
    Tuesday · 4 min

    Anthropic pulls the internet from AI tests after agents wandered onto real sites

    Morning edition, Tuesday 13 October 2026 Anthropic has cut live internet access from all internal model evaluations after agents exploited, queried and submitted to real government sites. The UK's AI Security Institute saw similar behaviour in August. The lesson: put limits in the environment, not the prompt. Sources Anthropic: Investigating unintended model actions BleepingComputer: Anthropic takes risky AI tests offline after models breach govt sites Cyber Security News: Mythos 5 and GPT-5.6-Sol agents went beyond their cyber test (AISI incident) BleepingComputer: Ledger confirms spy chip implant behind wallet crypto thefts The Record: Cyberattack disrupts refrigeration at hundreds of French supermarkets BleepingComputer: Norway fines Microsoft ad firm $9.6 million over Grindr data sharing Read the written version

    • Transcript
  • S2026 · E62
    Monday · 5 min

    Citrix NetScaler's next critical SAML flaw lands on top of last week's patches

    Evening edition, Monday 12 October 2026 A new critical NetScaler flaw, CVE-2026-107406, can hit appliances that administrators patched only last week, and NHS England says exploitation is likely. Also: the AWS AgentCore research Amazon disputes, and where the Cyber Security and Resilience Bill stands. Sources Citrix security bulletin CTX697191 (CVE-2026-107406) BleepingComputer: Citrix warns admins to patch new NetScaler RCE flaw immediately NHS England Digital cyber alert CC-4865: Critical Remote Code Execution Vulnerability in Citrix NetScaler CTO at NCSC summary: week ending October 4th The Next Web: One prompt let researchers take over every AWS AgentCore agent in a region ServNet UK: Resilience regulation tracker 2026 Read the written version

    • Transcript
  • S2026 · E61
    Monday · 4 min

    Microsoft sets an expiry date on Windows Update for machines that fall behind

    Morning edition, Monday 12 October 2026 Two certificates that Windows uses to trust Windows Update expire in May and June 2027. Machines without the replacements will stop receiving patches. The Secure by Design lesson for UK organisations is an inventory, an owner and a plan. Sources Microsoft: Prepare for Windows Update certificate rotation in 2027 (Windows message center) BleepingComputer: Microsoft: Outdated Windows devices will stop receiving security updates The Next Web: Ofcom opens investigation into Meta over Instagram Instants risk checks Push Security: Adception, malvertising in another search engine's search results BleepingComputer: Nippon Columbia malware incident exposes 8.6 million karaoke fan records Nippon.com: More Firms in Japan Hit by Large-Scale Data Breaches Read the written version

    • Transcript
  • S2026 · E60
    Sunday · 4 min

    A failed airline's inbox is up for sale to train an AI: whose data is it?

    Evening edition, Sunday 11 October 2026 Google has proposed paying $10 million for a bankrupt airline's internal data to train AI, and 121 US lawmakers want it halted. The Secure by Design lesson for UK organisations: data you keep becomes an asset in your insolvency. Sources The Record: Lawmakers warn of Google's $10 million AI training deal for Spirit Airlines data ICO: Anonymisation guidance Citrix security bulletin CTX697191 (CVE-2026-107406) BleepingComputer: Citrix warns admins to patch new NetScaler RCE flaw immediately BleepingComputer: Cyber exec arrested in case allegedly tied to ShinyHunters hackers Microsoft Message Center MC1491763: Prepare for Windows Update certificate rotation in 2027 Read the written version

    • Transcript
  • S2026 · E59
    Sunday · 5 min

    SonicWall's SMA1000 gets a second front door, and someone is already knocking

    Morning edition, Sunday 11 October 2026 SonicWall fixed a maximum severity, no-login flaw in its SMA1000 remote access gateways, and one researcher reports probes that match it. The Secure by Design lesson: internal services should not trust a request because of where it came from. Sources BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks Help Net Security: SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255) Huntress: Threat actors exploit critical AhsayCBS flaws BleepingComputer: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto The Record: Lawmakers warn Google could expose Spirit Airlines data through AI training deal Bernama: Google buys Spirit Airlines data for US$10 million Read the written version

    • Transcript
  • S2026 · E58
    October 10 · 4 min

    One person, nine banks: AI agents change the arithmetic of attack

    Evening edition, Saturday 10 October 2026 CrowdStrike links attacks on South Korean banks to one person using an open-source AI pentest agent and commercial models. What UK organisations should change when attack effort scales with API credit, plus a SonicWall flaw and a 2027 Windows Update deadline. Sources BleepingComputer: ARTEX AI, Claude agents used in cyberattacks on South Korean banks Taipei Times: S Korean banks likely hacked by China-based actor, CrowdStrike SonicWall: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0017) BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks Microsoft Message Center MC1491763: Prepare for Windows Update certificate rotation in 2027 BleepingComputer: Microsoft says outdated Windows devices will lose security protection next year Read the written version

    • Transcript
  • S2026 · E57
    October 10 · 4 min

    A Qilin arrest is welcome, but the ransomware franchise runs on unlocked doors

    Morning edition, Saturday 10 October 2026 A suspected core Qilin member has been handed from Japan to Germany. The arrest is good news, but the group's affiliates keep walking through legacy VPN settings and supplier dependencies. What UK organisations should design out, plus briefs on AI training data and a fake installer lure. Sources SecurityWeek: Qilin ransomware suspect arrested in Japan, extradited to Germany The Record: Japan confirms arrest of Russian Qilin operative, extradition to Germany Help Net Security: Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) The Record: Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal SiliconANGLE: Google pays $10M to get its hands on Spirit Airlines business data for AI training BleepingComputer: Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks Read the written version

    • Transcript
  • S2026 · E56
    October 9 · 4 min

    Malware in the box: cheap Android phones that arrive already compromised

    Evening edition, Friday 9 October 2026 Bitdefender's Midnight Mimosa research finds malware baked into the firmware of cheap MediaTek Android phones. UK product security law checks passwords, reporting and update periods, not whether the firmware is clean. Also: Citrix and SonicWall patches, and a ransomware recovery firm charged. Sources Bitdefender Labs: Midnight Mimosa The Record: Thousands of cheap Androids shipped with ad-fraud malware GOV.UK: Regulations: consumer connectable product security Citrix: CTX697191 security bulletin (CVE-2026-107406) SecurityWeek: SonicWall and Splunk Patch Critical Vulnerabilities The Record: DOJ charges ransomware recovery CEO Read the written version

    • Transcript
  • S2026 · E55
    October 9 · 5 min

    A Beijing contractor ran the hacking kit, and the doors it used were a decade old

    Morning edition, Friday 9 October 2026 The NCSC and six allied countries named Integrity Technology Group as the operator behind Flax Typhoon tooling, as the FBI seized seven domains. The exploited holes were years old, which makes this a Secure by Design lesson about what UK organisations leave switched on. Sources NCSC: China-linked actors called out by UK and international partners for targeting sensitive data CISA: Joint advisory AA26-281A The Register: US disrupts Chinese hacking tools as 7 govts warn of PRC spies BleepingComputer: Low-cost Android phones ship with residential proxy malware The Record: Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal BleepingComputer: Ransomware recovery CEO charged over secret ransom payments Read the written version

    • Transcript
  • S2026 · E54
    October 8 · 4 min

    FortiBleed is still locking admins out of their own firewalls, and the NCSC saw it coming

    Evening edition, Thursday 8 October 2026 The FBI and US Secret Service say the FortiBleed campaign against Fortinet firewalls is still active, with administrators locked out and access passed to ransomware affiliates. No vulnerability is involved, which makes the Secure by Design lesson sharper for UK organisations. Sources NCSC: Advice following global targeting of Fortinet firewalls and VPN gateways The Record: FBI, Secret Service add to warnings of FortiBleed credential stealing campaign The Hacker News: FBI warns FortiBleed remains active Lumen Black Lotus Labs: Canto incognito, tracking the PoeLLM malware BleepingComputer: Microsoft Teams to get support for third-party deepfake detection tools Microsoft 365 roadmap RM573451: third-party synthetic audio and video detection in Teams Read the written version

    • Transcript
  • S2026 · E53
    October 8 · 4 min

    Hijacked country registries mint real Google certificates: the trust chain nobody audits

    Morning edition, Thursday 8 October 2026 Attackers took over the .gh, .sl and .as registries and obtained genuine HTTPS certificates for Google and others. The lesson for UK organisations sits below the website: who controls your DNS, and who is watching certificate logs. Sources Google: Chrome's response to recent ccTLD registry hijacks BleepingComputer: Hackers hijack Google domains after breaching ccTLD registries BleepingComputer: FBI says ongoing FortiBleed attacks lock out FortiGate VPN admins Cyber Security Agency of Singapore: Advisory on FortiGate credential compromise US Department of Justice: Owner of Florida ransomware remediation company charged Microsoft 365 Message Center MC1488841: Outlook blocked file types update Read the written version

    • Transcript
Showing 1–20 of 65 episodes