Decrypted: The UK Cyber Briefing

Morning edition, Sunday 15 November 2026

Attackers used stolen GitHub tokens to plant a secret-stealing script in thousands of repositories, then erased their tracks. What UK organisations should check, and the cheap design fixes. Plus the NCSC on AI ransomware and an EU cloud sovereignty warning.

Sources

• OX Security: Thousands of GitHub accounts hijacked with wfx-loot CI secret-stealing malware
• Aikido: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
• NCSC: Artificial intelligence and cyber intrusion
• NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
• MLex: UK tech suppliers face losses under EU cloud sovereignty rules, techUK says
• techUK: Europe's Technology Sovereignty Package and what it means for UK tech

Read the written version

Evening edition, Saturday 14 November 2026

The Check Point gateway attacks have developed: CISA now lists the root-level flaw that let attackers go from a web portal to a wiper on virtualisation hosts. Plus Ofcom's age-check methods, an unproven Qilin claim, and an AI-assisted bug hunt.

Sources

• Check Point Research: PHP2Shell Exploitation on Check Point Gateway
• CISA: Adds Two Known Exploited Vulnerabilities to Catalog (13 November 2026)
• Security Affairs: CISA adds Check Point and UnrealIRCd flaws to its KEV catalog
• oss-security: UnrealIRCd 6.2.7.1 and hot-patch announcement
• Advanced Television: Ofcom sets out age verification options
• CyPro: Simply UK ransomware claim lacks evidence

Read the written version

Morning edition, Saturday 14 November 2026

The ICO logged 1,371 cyber incident reports in three months, a record, yet investigated just 18. Ransomware reports are falling while leak-site victims climb, so the design question is what a thief could take, not whether you can restore.

Sources

• Record number of cyber incidents reported to UK privacy regulator (The Record)
• Our CryptoBilis investigation: what we found and what we've changed (Trezor)
• Trezor confirms crypto-stealing implants in three wallets, releases fix (BleepingComputer)
• Backdooring the next release of Codex through GitHub Action pipeline exploit chaining (Depi)
• In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach (SecurityWeek)

Read the written version

Evening edition, Friday 13 November 2026

Check Point Research says attackers broke into unpatched Check Point Security Gateways and, in some cases, wiped the ESXi servers behind them. Also: Maersk confirms data theft from an inherited system, and Microsoft shows an AI agent can be backdoored by editing fewer than 10 neurons.

Sources

• Check Point Research: PHP2Shell Exploitation on Check Point Gateway
• Check Point sk1000362: CVE-2026-123039 local privilege escalation in the DynamicCLI process
• SecurityOnline: CVE-2026-123039, Check Point Gateway exploited privilege escalation fixed in R82.20 Take 14
• Microsoft Security Blog: Detecting sleeper agents hiding in AI model neurons
• SecurityWeek: Maersk confirms data theft amid $5 million extortion attempt
• BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million

Read the written version

Morning edition, Friday 13 November 2026

Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical remote code execution flaw in the HTTP/2 module that Anthropic's scanner and Google researchers found independently. Also: Maersk's inherited system, and a Microsoft 365 outage.

Sources

• Apache HTTP Server 2.4 vulnerabilities (CVE-2026-119618)
• Wiz: Critical RCE Vulnerability in Apache HTTP Server
• SecurityWeek: Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
• BleepingComputer: Apache HTTP Server patches critical HTTP/2 remote code execution flaw
• BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
• SecurityWeek: Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams

Read the written version

Evening edition, Thursday 12 November 2026

Huntress reports an active campaign abusing ScreenConnect at managed service providers, with 47 organisations affected so far. We explain the mechanism and the Secure by Design lesson. Also: an Operation Endgame takedown, spyware guidelines and a public Windows exploit.

Sources

• BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations
• ConnectWise trust centre advisories
• BleepingComputer: Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
• Europol: 6.4 million victim datasets secured in international operation against malware networks
• The Record: Britain, France set out first guidelines for commercial hacking firms
• BleepingComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges

Read the written version

Morning edition, Thursday 12 November 2026

Fireworks, an AI infrastructure firm, was breached twice in October, and Notion says some of its AI chat transcripts were exposed as a result. The Secure by Design lesson is about retention, scoped credentials and asking suppliers where your prompts rest.

Sources

• BleepingComputer: Notion says Fireworks breach exposed customer AI chat transcripts
• The Record: AI company Fireworks says hackers stole data, billing info during October breaches
• The Record: Britain, France set out first guidelines for commercial hacking firms
• BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
• BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations

Read the written version

Evening edition, Wednesday 11 November 2026

Two Barracuda Email Security Gateway flaws that chain to root control were added to CISA's exploited list on 10 November, days after the fixes. The Secure by Design lesson, plus the UK liability consultation and a prompt adware case.

Sources

• CISA: Adds Six Known Exploited Vulnerabilities to Catalog (10 November 2026)
• SecurityWeek: Barracuda Email Security Gateway authentication bypass opens path to root
• BleepingComputer: Barracuda warns of critical flaws allowing root access to devices
• SecurityOnline: CISA adds six exploited flaws to the KEV catalog
• The Record: UK to look at making software companies liable for cyber breaches
• Cloud Security Alliance: Prompt adware and agent instruction persistence

Read the written version

Morning edition, Wednesday 11 November 2026

France has blamed Iran-linked units for October's attack on supermarket refrigeration controllers, and a second wave hit more than 115 stores in six countries. The Secure by Design lesson: stop exposing machinery to the internet. Plus the NCSC's AI warning and Microsoft's Outlook zero-day.

Sources

• BleepingComputer: Hackers disrupt refrigeration systems at European supermarkets
• BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires
• BleepingComputer: FBI and CISA warn of cyberattacks targeting refrigeration systems
• NCSC: Cyber chief, UK facing AI-powered attacks on critical infrastructure within two years
• The Record: Microsoft's Patch Tuesday surpasses 1,000 bugs for second month in a row
• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day

Read the written version

Evening edition, Tuesday 10 November 2026

A researcher published more than 30 alleged flaws in N-able's N-central, the tool many managed service providers use to run their clients' machines. N-able took its hosted service offline. Here is why one management tool is a master key.

Sources

• BleepingComputer: N-able takes cloud platform offline after 30+ zero-days published
• SecurityWeek: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
• BleepingComputer: Hackers exploit Barracuda Email Security Gateway flaws to get root access
• The Record: Alleged AI-aided cyberattack exploits assistant interface to breach German web host
• SecurityWeek: France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators

Read the written version