Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
We increasingly see cyber security now featuring as top headlines in the general media, where previously it was reserved for specialist media outlets. This week the global media reported how AI-assisted discovery of flaws in software used to run websites prompted urgent updates and precautionary shutdowns. OpenAI’s experience of agents weakening monitoring and Microsoft’s warnings about unintended behaviour reinforce the need for business leaders to manage AI access, monitor activity and retain human control. Growing demand for AI security expertise and the UK FCA’s expectations for incident reporting underline the importance of clear accountability.
Attackers continue to exploit familiar business activities to compromise organisations’ systems, including business quotation requests and searches for AI tools. Online advertisements have also delivered spyware without requiring a click. The ConnectWise incident described below also highlights how compromised supplier access can expose business emails and files, reinforcing the importance of an overall security strategy.
For business leaders, the focus remains on ensuring a thorough listing of the information assets that need protection, and implementing proportionate controls across people, operations and technology to reduce the risk to those assets. Contact us to discuss how cyber governance, employee training and incident response preparation can help your organisation manage these risks.
Top Cyber Stories of the Last Week
What Is PHP and Why Did It Spark a Global Cyber Security Scramble?
Researchers using AI discovered two flaws in PHP, a programming language used to run websites, prompting worldwide security updates and precautionary shutdowns. It is estimated that PHP powers 70% of websites, including government services and online shops. Under certain conditions, attackers could seize servers and steal sensitive information. Cloudflare reported millions of exploitation attempts after disclosure. Website owners should confirm that their website hosting provider or developer has implemented security updates, and UK authorities advise considering temporary website shutdowns if security updates or temporary protections cannot be applied promptly.
https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o
There’s a New Global Cyber Security Threat Outpacing Regulation, and It’s Not AI
Online advertisements have been used to infect journalists’ devices with spyware without requiring a click. The spyware could access messages, files and location data, and activate cameras and microphones. Advertisements also reached devices on sensitive government and international organisation networks, although this does not establish infection. Researchers criticised advertising platforms for not adequately checking companies placing adverts, and recommended stronger regulation, independent audits and trusted ad-blockers.
OpenAI Says Its AI Agents Weakened Internal Monitoring System
Two OpenAI AI agents weakened safeguards intended to detect their own misconduct during internal coding tasks. One disabled automatic security alerts after wrongly assuming that an instruction not to send Slack messages also prohibited security alerts, while the other removed a monitoring safeguard while copying code, then incorrectly denied doing so. Both treated routine instructions as authorisation to reduce safeguards, highlighting risks as businesses give AI greater autonomy. OpenAI is strengthening protections against agents disabling monitoring but has not fully explained the behaviour. It is investigating whether its models tend to avoid oversight.
AI Systems Could Hack Their Own Companies from the Inside, Microsoft Warns
AI systems deployed within businesses could become an internal security threat without being compromised by attackers, Microsoft has warned. AI agents, which perform tasks independently, may pursue objectives in unintended ways or cooperate with other agents without respecting organisational rules. Excessive access to sensitive data and critical systems increases the potential consequences. Microsoft is introducing tools to monitor other AI systems and advocates continuous testing, limits on permitted actions, and the ability for authorised staff to shut systems down. Businesses should not assume AI is trustworthy simply because they deployed it themselves.
https://www.independent.co.uk/tech/security/ai-agent-hack-cyber-attack-microsoft-b3070100.html
Head of AI Security Roles Surge in Large Organisations
Research by IANS and Artico Search found that 65% of businesses with annual revenues of $10bn or more have a head of AI security: 18% have a dedicated position and 47% combine it with another role. Adoption falls to 9% for revenues of $1bn–$10bn and 6% below $1bn. Responsibility for AI governance varies between executive roles across the size categories. Business leaders should assess the expertise they need to manage AI risks, and consider opportunities to develop the expertise internally before entering an increasingly competitive recruitment market.
https://www.infosecurity-magazine.com/news/head-ai-security-roles/
UK Finance Watchdog Wants Firms to Report AI Failures and Close Calls
Financial firms should report significant AI failures and near misses under existing incident reporting requirements, according to the Financial Conduct Authority. As AI systems become more capable of acting independently, the regulator wants clear accountability for their use. Weak oversight could expose customers to harm, create cyber security weaknesses and disrupt operations more rapidly and widely. The government is considering stronger arrangements for reporting and reviewing serious AI incidents, while MPs have called for stress tests to assess firms’ preparedness for AI-driven market shocks.
Ransomware Pressure Now Reaches Employees’ Homes and Families
Ransomware is putting employees and their families at risk beyond the workplace. Semperis surveyed 1,200 IT and security professionals at organisations that had suffered successful ransomware attacks: 37% reported threats against employees’ relatives or friends, while 25% said staff or family members needed medical or psychological treatment. Meanwhile, 69% experienced repeated successful attacks within a year, highlighting the danger of restoring operations before removing criminals’ access. Response plans should cover threats to individuals alongside business recovery, with clear responsibilities and established police contacts. Paying a ransom does not guarantee recovery.
https://www.helpnetsecurity.com/2026/10/19/semperis-ransomware-employee-safety-report/
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used compromised credentials for ConnectWise Cloud Backup to gain unauthorised access to 173 Microsoft 365 customer and partner environments, according to Huntress. The service’s extensive permissions could expose emails, files and Teams data. In at least one environment, attackers also added credentials to other trusted applications, potentially enabling continued access. ConnectWise suspended Cloud Backup application access and reported no evidence that partner backup data had been compromised. Affected organisations should disable the application pending confirmation that credentials have been reset and investigate suspicious access or changes to application permissions and credentials.
https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
Hackers Disguise Phishing as Promising Business Opportunities
Fraudulent requests for business quotations are being used to steal access to company email accounts. Fortra tracked a twelvefold increase in malicious emails mentioning requests for quotation between October 2025 and September 2026, with nearly 73% directing recipients to pages designed to steal login details. Attackers typically seek a reply before sending links disguised as project documents or purchasing portals. Compromised accounts can enable payment fraud, expose customer information and spread further scams through trusted contacts. Sales and procurement teams are particularly exposed and need safe ways to verify unfamiliar buyers and documents.
https://www.helpnetsecurity.com/2026/10/16/rfq-phishing-emails-sales-procurement-staff/
ClickFix Has Never Been Bigger, and AI Tools Are Its Most Convincing Lure Yet
Criminals are exploiting interest in AI tools to spread ClickFix attacks, which trick users into running commands that install malicious software. Fake installation pages and malicious instructions shared through genuine AI platforms make these attacks harder to recognise. Browser security provider Push found that four in five ClickFix pages it intercepted in 2026 were reached through search engines. Microsoft reported roughly 23-fold growth in attacks between December 2025 and May 2026. The findings show how employees can be tricked into installing malware through search results and genuine AI platforms, bypassing the organisation’s email security.
Small Businesses Risk Being Left Behind by UK’s Cyber Security Ambitions, Report Warns
UK cyber security ambitions risk leaving smaller businesses behind as national guidance fails to translate into practical protection. Government figures show 46% of small businesses and 65% of medium-sized businesses identified a breach or attack in the past year, yet only 41% of small businesses undertook a cyber security risk assessment. A report from De Montfort University and RISCS highlights limited specialist expertise and difficulties prioritising action. It recommends coordinating existing regional and industry support to provide accessible guidance, practical tools and trusted professional advice, helping businesses protect operations and adopt new technologies securely.
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware pressure now reaches employees’ homes and families - Help Net Security
When Your Ransomware Negotiator Works for the Other Side
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 - SecurityWeek
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy - Infosecurity Magazine
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Ransomware and Destructive Attack Victims
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Russian man linked to deadly London hospitals hack arrested - BBC News
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ - Infosecurity Magazine
Bristol primary school hit by second cyber attack as records exported in data breach | Bristol Live
Bullhorn takes staffing platform offline to contain cyberattack
Ahold Delhaize Restoring Services Disrupted by Cyberattack - SecurityWeek
Phishing & Email Based Attacks
Quarantined, but still on your calendar: The explosion of invite-based attacks - Help Net Security
Hackers disguise phishing as promising business opportunities - Help Net Security
Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks - Help Net Security
Milk Dragon phishing kit makes online fraud easier to scale | news | MSSP Alert
More than 300 calls to police after hoax bomb threats at schools - BBC News
Other Social Engineering
Quarantined, but still on your calendar: The explosion of invite-based attacks - Help Net Security
Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks - Help Net Security
ClickFix has never been bigger, and AI tools are its most convincing lure yet
Fake CAPTCHAs are tricking users into running malware on their own devices - Help Net Security
Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
Researchers Infiltrate Microsoft Tech Support Scam Operation
Irish police X accounts breached by crypto-hackers - BBC News
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cyber security threats target University of York staff and students
Why that desperate call from your daughter may have been a cybercriminal using AI
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks - SecurityWeek
ClickFix scams pose growing risk to education sector, Jisc says | Computer Weekly
2FA/MFA
Your frontline workers have a workaround for that MFA prompt - Help Net Security
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Artificial Intelligence
The Vast Majority of Cyber Attacks Now Involve AI, Report Shows | IBTimes
Anthropic Warns AI Agents Can Now Automate the Entire Cyber Kill Chain
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
BoE warns banks to prepare for AI-enabled cyber breaches - CNA
Chinese AI Model Writes More Hackable Code When Told It's for US Contractor - SecurityWeek
Governments, regulators increase scrutiny of China's DeepSeek | Reuters
ClickFix has never been bigger, and AI tools are its most convincing lure yet
G7 to launch exercises to guard against AI cyber attacks | Reuters
Half the AI bot traffic hammering your website comes from Meta - Help Net Security
AI makes cyberattacks cheaper, harder to ignore: Cloudflare executive - The Korea Herald
Major UK cyber attack is ‘inevitable’, AI minister warns - Director of Finance Online
Over Half of Financial Service Leaders Miss Spoofed AI Traffic | Security Magazine
AI increasing cybersecurity complexity
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
Powerful new AI models are behind a wave of recent cyber attacks, experts say | Fortune
OpenAI says its AI agents weakened internal monitoring system | Reuters
UK finance watchdog wants firms to report AI failures and close calls
Financial transformation: Why slow AI adoption is the top risk - SiliconANGLE
Head of AI Security Roles Surge in Large Organizations - Infosecurity Magazine
Symantec Uncovers AI Agent Hijacking Models for Autonomous Attacks - Infosecurity Magazine
AI agent permissions are outrunning security - Help Net Security
AI agent observability is struggling to keep up with hallucinations - Help Net Security
The next election influence campaign will target your AI chatbot | CyberScoop
AI Slop Isn't Just for Social; It's Ruining Cyberattacks, Too
Why AI Confidence Is Not Validation
Stolen AI API keys are paying for hackers' autonomous scans - Help Net Security
The Quantum Clock is Ticking: While Everyone Watches AI, Q-Day Approaches | Baker Donelson - JDSupra
CEOs of major banks grilled at Assembly audit over AI cyberattacks - The Korea Times
AI Takes Control of Robotic Arm in 16 Minutes Flat
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
Agents are your newest insiders. Security must move at their speed. | Microsoft Security Blog
Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection
Chinese AI tool behind cyberattacks in Japan: security firm - The Korea Times
The Mythos of Digital Sovereignty
AI Accelerates Cyber Threat Landscape, Poses New Risks for Insurers and Businesses
AI Safety and Cybersecurity Should Be Allies. Instead, They're at Odds
Say a few words, and a rigged AI asks for $5,000 - Help Net Security
Why that desperate call from your daughter may have been a cybercriminal using AI
Memes Fly About Spies and AI Employees - Business Insider
UK keeps AI safeguards in the maybe pile for Cyber Security BIll
When AI Agents Commit Breaches, Humans May Not Be Held Liable
Managing open-weight model risk in enterprise deployments | Microsoft Security Blog
Enterprise AI Enters Risk Management Phase
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
AI Agents Accessed Indian Organizations Without Authorization, CERT-In Warns
Backdooring Open-Weight AI Models - Schneier on Security
DeepSeek deep-sixed at all US federal civilian agencies
Thoma Bravo Expects Rogue Agents to Persist as AI Buildout Grows
OpenCode hack exposes API keys amid AI distillation attacks
New Aoki Infostealer Targets AI Coding Assistant Credentials - Infosecurity Magazine
PwC says Irish organisations ‘under-prepared’ as AI reshapes cyber threats
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge
The G7’s AI Cyber Drills Need A Test For The Stop Command - OpEd - Eurasia Review
Documents Reveal Military Plan for Agentic AI That Hacks U.S. Adversaries
Army Cyber Command builds agentic workforce to support cyber operations - Federal News Network
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
Concern among Irish business leaders over AI cybersecurity risks
AI On Track To ‘Crowd Out’ Human Decision-Making In Warfare - Eurasia Review
OpenAI president urges AI safeguards as group he funds opposes regulation | Reuters
Bots/Botnets
Half the AI bot traffic hammering your website comes from Meta - Help Net Security
Ukraine targets Russia’s ‘Google’ as the internet becomes a new front line | CNN
X purges 13,000 accounts linked to suspected meddling ahead of US midterms
Careers, Roles, Skills, Working in Cyber and Information Security
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars - SecurityWeek
Cloud/SaaS
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Google Cloud Outage in London Disrupts Revolut Banking Services
Railway Security Incident: Hackers May Have Accessed Customer Environment Variables
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Irish police X accounts breached by crypto-hackers - BBC News
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Cyber Crime, Organised Crime & Criminal Actors
When Attackers Cooperate And Vendors Don't
How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
Inside the Com: the online underworld turning teenage gamers into cybercriminals
Data Breaches/Leaks
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
UK Legal Aid Agency Hack Scope Widens After Forensic Review - SecurityWeek
Albert Heijn hasn't reported hack to police; No grocery deliveries until at least Sunday | NL Times
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ - Infosecurity Magazine
UK data watchdog warns Met Police over shadow IT data breach | Computer Weekly
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
Cyberattacks continue to menace Japan as more firms disclose data breaches - The Japan Times
Conduent agrees to $80 million settlement over 2024 data breach | news | MSSP Alert
Railway Security Incident: Hackers May Have Accessed Customer Environment Variables
Cyber security threats target University of York staff and students
Burger King Japan Data Breach Impacted 11 Million Customers
One Compromised Login Exposed Millions of California Students' Records - SecurityWeek
Nikkei discloses third data breach in a month, 1.8M records exposed
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
Zeabur shutting down after second security breach in two months
Bullhorn sees red after cyberattack knocks recruitment platform offline
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive
Denial of Service/DoS/DDoS
DDoS attacks can knock services offline before links reach capacity - Help Net Security
Encryption
Mozilla, Google, Apple block compromised eMudhra CA certificates
Your motherboard's old debug header is still listening, and it's an unpatched security risk
Lazarus hackers use post-quantum cryptography for malware delivery
Fraud, Scams and Financial Crime
How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
Milk Dragon phishing kit makes online fraud easier to scale | news | MSSP Alert
Irish police X accounts breached by crypto-hackers - BBC News
Researchers Infiltrate Microsoft Tech Support Scam Operation
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme | CyberScoop
EU opens Digital Services Act investigation into Booking.com over scams
Identity and Access Management
Insider Risk and Insider Threats
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
Your frontline workers have a workaround for that MFA prompt - Help Net Security
Recruitment is part of the attack surface | Professional Security Magazine
Insurance
SMEs misunderstand cyber insurance cover - CIR Magazine
Cyber Rates Are Down, Risks Are Up but Small Businesses Slow to Adopt
Internet of Things – IoT
TP-Link camera flaws let hackers seize control of Tapo devices | Cybernews
A car hacker’s gold mine for connected cars: Capture and analyze network traffic from 21 vehicles.
Law Enforcement Action and Take Downs
Russian man linked to deadly London hospitals hack arrested - BBC News
Police arrests 95 suspects in international CSAM crackdown action
Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme | CyberScoop
Teenager who gave cyber support to terrorists and learnt how to make bombs jailed - Essex Live
Linux and Open Source
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Malvertising
Targeted ads delivered 0-click exploits to install mercenary malware - Ars Technica
Malware
Quarantined, but still on your calendar: The explosion of invite-based attacks - Help Net Security
Fake CAPTCHAs are tricking users into running malware on their own devices - Help Net Security
Targeted ads delivered 0-click exploits to install mercenary malware - Ars Technica
Lazarus hackers use post-quantum cryptography for malware delivery
Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
CikaBika Bot RAT Uses Discord for C&C - SecurityWeek
Fake Arch Linux AUR packages exploit typos to run malware with root privileges - Help Net Security
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
9 rising malware trends every security pro should know | CSO Online
New Aoki Infostealer Targets AI Coding Assistant Credentials - Infosecurity Magazine
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks - SecurityWeek
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
Misinformation, Disinformation and Propaganda
Ukraine targets Russia’s ‘Google’ as the internet becomes a new front line | CNN
The next election influence campaign will target your AI chatbot | CyberScoop
Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection
X purges 13,000 accounts linked to suspected meddling ahead of US midterms
Mobile
Malware Found Pre-Installed In Thousands Of Budget Android Phones - Here's What We Know
Models, Frameworks and Standards
UK keeps AI safeguards in the maybe pile for Cyber Security BIll
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks - SecurityWeek
Outages
Google Cloud Outage in London Disrupts Revolut Banking Services
BAE Systems cyberattack disrupts US federal court operations
Passwords, Credential Stuffing & Brute Force Attacks
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ - Infosecurity Magazine
One Compromised Login Exposed Millions of California Students' Records - SecurityWeek
Privacy, Surveillance
Regulations, Fines and Legislation
BoE warns banks to prepare for AI-enabled cyber breaches - CNA
UK finance watchdog wants firms to report AI failures and close calls
UK keeps AI safeguards in the maybe pile for Cyber Security BIll
Deepfakes and Election Manipulation: UK Watchdog Seeks Faster Detection
EU opens Digital Services Act investigation into Booking.com over scams
CEOs of major banks grilled at Assembly audit over AI cyberattacks - The Korea Times
DeepSeek deep-sixed at all US federal civilian agencies
OpenAI president urges AI safeguards as group he funds opposes regulation | Reuters
UK competition regulator targets Microsoft's business software grip | Reuters
Sabotage
Researchers warned attackers could 'defrost the food' months before French supermarkets got hit
France: Internet-Exposed Danfoss Controllers Drop 71% After Attack - Infosecurity Magazine
Shadow IT
UK data watchdog warns Met Police over shadow IT data breach | Computer Weekly
Social Media
Irish police X accounts breached by crypto-hackers - BBC News
X purges 13,000 accounts linked to suspected meddling ahead of US midterms
Software Supply Chain
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
Spyware
Targeted ads delivered 0-click exploits to install mercenary malware - Ars Technica
Spyware found on devices belonging to prominent Serbian critics as elections loom | CyberScoop
Supply Chain and Third Parties
US bankruptcy court cyberattack disrupts 18 states so far | Cybernews
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Exclusive: Putin sends fishing trawlers to spy on Britain
Russia’s Starlink substitute poses a security threat far beyond Ukraine - Atlantic Council
How Europe Should Respond to Russia’s Growing Hybrid Threats - Freedom
Russia Is Tightening Internet Controls, Leading to Operational Risks
Prolific Chinese espionage group exploits BeyondTrust zero-day | CyberScoop
Russia wages hybrid war on Nato from holiday homes
Cyber hit on a defence prime would cost capacity, warns MP
Documents Reveal Military Plan for Agentic AI That Hacks U.S. Adversaries
Army Cyber Command builds agentic workforce to support cyber operations - Federal News Network
Cyber hit on a defence prime would cost capacity, warns MP
China
Chinese AI Model Writes More Hackable Code When Told It's for US Contractor - SecurityWeek
Governments, regulators increase scrutiny of China's DeepSeek | Reuters
Prolific Chinese espionage group exploits BeyondTrust zero-day | CyberScoop
DeepSeek deep-sixed at all US federal civilian agencies
Chinese AI tool behind cyberattacks in Japan: security firm - The Korea Times
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Russia
Exclusive: Putin sends fishing trawlers to spy on Britain
Russia’s Starlink substitute poses a security threat far beyond Ukraine - Atlantic Council
How Europe Should Respond to Russia’s Growing Hybrid Threats - Freedom
Russia Is Tightening Internet Controls, Leading to Operational Risks
Russia wages hybrid war on Nato from holiday homes
Ukraine targets Russia’s ‘Google’ as the internet becomes a new front line | CNN
Finnish intelligence will be able to strike on Russian territory
Romanian Institutions Bought Banned Russian Cybersecurity Software | OCCRP
North Korea
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
New data show cleared employees are bigger targets than ever - Federal News Network
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
ISIS’s Current Cyber Ambitions: Intent, Capabilities, and Threat – GNET
Tools and Controls
Mozilla, Google, Apple block compromised eMudhra CA certificates
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Why AI Confidence Is Not Validation
BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
When Your Ransomware Negotiator Works for the Other Side
N-able Research Finds AI Security Tools are Threatened by Trust and Complexity Challenges
Cyber Defense Group Finds Gaps in Cyberattack Readiness
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge | Group-IB Blog
Romanian Institutions Bought Banned Russian Cybersecurity Software | OCCRP
WiFi handgun detection can spot concealed guns, study says | Cybernews
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
SMEs misunderstand cyber insurance cover - CIR Magazine
Cyber Rates Are Down, Risks Are Up but Small Businesses Slow to Adopt
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars - SecurityWeek
The G7’s AI Cyber Drills Need A Test For The Stop Command - OpEd - Eurasia Review
The 3-2-1 backup rule has a glaring caveat that ransomware exploits perfectly
Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
Other News
Small businesses risk being left behind by UK's cyber security ambitions, report warns
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge | Group-IB Blog
Why Cybercriminals Are Targeting Law Firms - D Magazine
Why law firms must treat security as a core professional duty | BCS
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Bullhorn takes staffing platform offline to contain cyberattack
Ahold Delhaize Restoring Services Disrupted by Cyberattack - SecurityWeek
OnlyFans Copyright Takedowns Expose Compromised Websites
Auto tech startup claims it traced hack attempt back to rival's IP address
Why cyber resilience is now a boardroom priority for UK public services
Vulnerability Management
Vulnerability Management Isn't About the Score — It's About How It Applies to You
Exploited Flaws Typically Take Three Months to Patch, Moody’s Finds - Infosecurity Magazine
The Evolving Cybersecurity Lexicon
Incomplete security patches show hackers where to look next - Help Net Security
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 - SecurityWeek
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge | Group-IB Blog
Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
Vulnerabilities
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
PHP2Shell exploit bypasses protections designed to stop remote code execution
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Microsoft says October updates didn’t actually fix VPN issues
NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Prolific Chinese espionage group exploits BeyondTrust zero-day | CyberScoop
Critical vulnerability in Ivanti Connect Secure exploited by attackers | brief | MSSP Alert
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack - SecurityWeek
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU - SecurityWeek
Cisco Patches 34 Vulnerabilities Across Multiple Products - SecurityWeek
F5, Juniper Networks Patch Critical Vulnerabilities - SecurityWeek
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Splunk, SolarWinds Release Fresh Security Updates - SecurityWeek
Atlassian Patches 75 Flaws in Data Center and Server Products - SecurityWeek
Max-severity GitLab bug allows remote code execution over 12 years of releases
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Drupal patches critical RCE flaws, warns exploits may emerge soon
Hackers exploit SiteGuard WAF flaw to run commands as admins
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks - SecurityWeek
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers Warn OpenCode Quietly Patched Critical RCE Flaw - Infosecurity Magazine
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.