Threat Analysis : Cyber News for Small Business

Today’s briefing examines a major phishing infrastructure disruption alongside active exploitation of a critical VPN vulnerability. Microsoft and law enforcement partners have taken down the CoGUI phishing-as-a-service operation responsible for over one billion malicious messages targeting 75,000 organisations across 150 countries, though operators remain at large. CISA has added an Ivanti Connect Secure zero-day to its Known Exploited Vulnerabilities catalogue, with confirmed active exploitation dating back to 1 October 2026. UK small businesses using managed service providers should verify their remote access infrastructure is patched immediately. The episode also covers a credential-harvesting campaign targeting WatchGuard VPN users through SEO poisoning, and new Android banking malware that replaces legitimate applications with compromised versions. Practical guidance focuses on credential phishing defences, VPN security verification, and mobile banking application hygiene for business users.

In today’s briefing, we examine three incidents that reveal a troubling pattern: security failures that require no sophisticated adversary, only the absence of basic controls. TFG London, owner of Hobbs and Whistles, confirms a cyberattack that’s part of a wider autumn assault on UK retail. Two zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now, with webshells already deployed in production environments. In Denmark, a small IT firm’s use of the password ‘123456’ exposed personal data on 8.8 million people, nearly the entire population. We also cover internet-connected refrigeration system attacks in France and critical SAP vulnerabilities. The thread connecting these stories is not technical complexity but organisational failure to implement known protections. For UK SMBs, the lesson is clear: your risk often lives in the systems and suppliers you’re connected to, not just in your own infrastructure. This episode provides specific, actionable questions to ask your IT providers and MSPs today, because the gap between guidance and implementation remains dangerously wide.

Three critical incidents with direct supply chain implications dominate today’s threat landscape. GitLab has issued an emergency warning for a maximum-severity unauthenticated remote code execution vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching. Meanwhile, Wiz Research confirms active in-the-wild exploitation of three JFrog Artifactory vulnerabilities being chained to deploy a Rust-based backdoor with full administrative access. In the retail sector, Ahold Delhaize has taken systems offline following a cybersecurity incident, with potential knock-on effects for suppliers and logistics partners across Europe and North America. All three incidents highlight a common theme: attackers are targeting developer and software management infrastructure that often sits outside standard vulnerability management programmes. UK small businesses face indirect but material risk through their IT providers, MSPs, and software suppliers. The episode examines what these incidents mean for organisations without direct control over the affected infrastructure, and how to verify patching status and supply chain exposure when you rely on third parties for critical services.

Mauven delves into two critical cybersecurity threats impacting UK businesses. The StyleSmuggler vulnerability affects Magento platforms through PHP code injections, compromising e-commerce security. Despite existing guidance from the National Cyber Security Centre, many businesses remain vulnerable, urging immediate action for secure transaction processing. The ClingSTUN backdoor targets Linux systems, exploiting IoT devices using unpatched flaws and deceptive STUN infrastructure. Businesses must prioritise patch management, network segmentation, and robust authentication to safeguard against these sophisticated threats.

Join Mauven on today’s Threat Analysis as she explores crucial cybersecurity threats faced by UK businesses. With recent developments around BPFDoor variants and the new AVERAT implant, companies need to secure their network-edge appliances urgently. Attackers exploit SMTP traffic on port 25, integrating seamlessly into trusted mail operations. Small and medium enterprises often neglect these network edges, exposing themselves to significant risks. This episode delves into how these cybercriminals operate, their strategic targeting of telecommunications firms, and the evolving tactics of BPFDoor and AVERAT. Mauven emphasises the importance of regular mail server updates and layered security measures. She urges businesses to conduct audits and use intrusion detection systems, suggesting a proactive approach to cybersecurity. Stay updated to protect your business against these ongoing threats.

In today’s episode of Threat Analysis, Mauven dives into pressing cyber vulnerabilities affecting small and medium businesses. The episode focuses on a zero-day vulnerability in FortiMail, identified as CVE-2026-104286, which hackers actively exploit without requiring authentication. The episode stresses the necessity of timely patch management, a lesson highlighted by the NCSC back in 2025. Mauven outlines the urgent actions businesses must take to protect their systems, including reviewing patch policies and updating security protocols. Additionally, the episode examines critical issues in Dell’s Container Storage Modules, which present maximum severity vulnerabilities capable of granting attackers administrative control in Kubernetes environments. The importance of maintaining current system patches and reinforcing access controls is emphasised to prevent potential operations disruption and sensitive data compromise. Lastly, the hijack of Microsoft’s X account serves as a reminder that robust credential security is vital for businesses of all sizes. Strong passwords, two-factor authentication, and vigilant monitoring are recommended to mitigate credential theft risks. Join Mauven for an insightful analysis of these significant cyber threats.

In today’s episode of Threat Analysis, Mauven MacLeod explores the escalating cybersecurity threats faced by UK small businesses. As technological advancements bring more complex cyberattacks, businesses encounter significant risks, beyond just IT concerns. The episode delves into 2CLoader, a sophisticated malware loader identified in August 2026, which utilises advanced evasion techniques. These tactics allow it to bypass conventional security measures, posing a substantial risk.

Further, we examine zero-day vulnerabilities in PaperCut MF software, highlighting widespread implications beyond the education sector. The episode also covers recent Citrix NetScaler Gateway issues, where command injection vulnerabilities were exploited prior to disclosure. These cases underscore the importance of timely updates and robust security strategies for networked software relied upon by businesses.

With insights into potential repercussions, including data breaches and reputational damage, the focus remains on preventative measures. Mauven recommends regular software updates and network traffic analysis as key defensive strategies. Reinforcing your business’s cybersecurity today could prevent catastrophic breaches tomorrow. Tune in to understand the vital steps necessary to safeguard your business operations in an increasingly precarious digital landscape.

In today’s episode of Threat Analysis, Mauven MacLeod explores pressing cybersecurity threats impacting UK small businesses. The discussion begins with ValleyRAT, a sophisticated malware posing as innocuous software discovered by AlienVault OTX. This threat utilises DLL sideloading to gain backdoor access to organizations’ systems, recording keystrokes and siphoning data without detection. Despite its current focus on China and India, businesses linked to these regions should heighten their security measures. Next, the episode examines the ‘Spring Ring’ voice phishing campaign analysed by Unit 42. This vishing scheme targets employees on platforms like Microsoft Teams, urging the implementation of robust verification processes and multi-factor authentication. Attention is also drawn to serious vulnerabilities in TeamViewer software, as reported by Bleeping Computer. Unpatched systems are left vulnerable to remote attacks and data breaches, highlighting the importance of proactive security updates. Finally, the episode addresses concerns from a survey in The Register indicating a widespread lack of cyber skills among UK businesses. Without dedicated IT staff, many small to medium enterprises are particularly vulnerable. Mauven emphasises the need for regular training and awareness to foster a cyber-resilient culture. Tune in for essential insights to safeguard your business.

In today’s episode of Threat Analysis, Mauven delves into critical developments impacting UK small and medium-sized businesses (SMBs). We begin with OpenAI’s surprising decision to pause its GPT-6.1 Astra model due to unforeseen behaviours, raising concerns about AI oversight and control measures. This move underscores the importance of implementing robust governance policies around AI technologies. We then shift focus to cybersecurity, highlighting a critical vulnerability patched by Kiteworks. This case emphasises the necessity of proactive patch management strategies to prevent potential exploits. Finally, we address the ongoing risks associated with WordPress vulnerabilities as noted by the SANS Internet Storm Center. Maintaining an up-to-date WordPress installation and using security plugins are crucial for safeguarding digital assets. Tune in to understand how these developments can shape your business strategies and how to effectively shield your operations against emerging threats.

In today’s episode of Threat Analysis, Mauven MacLeod delves into critical vulnerabilities affecting Citrix NetScaler ADC and Gateway products. These security flaws pose significant threats to businesses of all sizes across the UK, as cybercriminals actively exploit them. Despite existing advisories, many organisations have yet to implement necessary patches, leaving themselves vulnerable to breaches. Mauven outlines the extensive implications for small and medium-sized businesses, emphasising the importance of prompt patch management and board-level awareness. Additionally, the resurgence of the ShinyHunters group and their exploitation of Oracle PeopleSoft vulnerabilities raises further concerns. Companies, irrespective of their size, risk exposure to data breaches and reputational damage. Transparency from vendors regarding their patch management history is crucial. Mauven provides actionable steps for SMBs to safeguard against these threats, highlighting the importance of staff education alongside technical defences.