General cybersecurity news and analysis
The government is encouraging police to try live facial recognition after the Met praised its Croydon deployment, but with courts and privacy watchdogs raising legal and bias concerns, ministers will publish guidance instead of forcing a nationwide roll‑out.
As CISA ends funding to CIS on Oct. 1, thousands of towns and school districts risk losing free threat‑sharing, scanning and incident support — turning an IT funding cut into a public‑safety problem. Without a quick replacement, smaller jurisdictions face costly gaps, fragmented defenses and greater exposure to attackers probing for blind spots.
A single malicious line in a typosquatted npm package quietly CC’d thousands of Postmark emails to an attacker—turning a routine dependency into a stealthy data leak. It’s a wake‑up call: strong dependency hygiene, provenance checks, and runtime protections are essential to keep outbound messaging safe.
Microsoft disrupted an AI-powered phishing campaign that used SVG files disguised as PDFs to trick email and cloud preview viewers into stealing credentials, showing attackers can now auto-generate convincing scams at scale. Treat unexpected document previews and credential prompts with caution, enable MFA, and verify senders to stay one step ahead.
When mission needs outpace aging IT and cloud, cyber, and AI demands collide, infrastructure becomes the strategic foundation for federal success—enabling agility, security, and trustworthy AI. Cloud Exchange 2025 made clear: treating infrastructure as a mission enabler, not a cost center, is the only way agencies can modernize, defend assets, and deliver better services.
National cyber authorities from the Five Eyes, Germany and the Netherlands have unveiled a coordinated OT security standard to help protect the industrial systems that run our power, water and factories from disruptive, safety‑threatening attacks. If paired with funding and industry buy‑in, this practical guidance could finally turn years of OT neglect into measurable resilience—otherwise it risks staying on paper while attackers probe the weakest links.
Two-thirds of organizations lack dedicated cybersecurity staff, leaving networks and data more exposed as threats surge and hiring, burnout, and competition for talent bite. Fixing it means smarter hiring, hands-on training and public‑private action before the next big incident.
A severe cyberattack that halted Jaguar Land Rover’s factories and put thousands of jobs at risk has prompted the UK to underwrite up to £1.5bn to stabilise production and protect supply chains. The emergency loan buys breathing space — but revives tough questions about corporate cyber responsibility and when taxpayers should rescue private industry.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Akira ransomware actors are rapidly exploiting SonicWall SSL VPN flaws to bypass MFA and spread payloads—proving MFA isn’t a silver bullet and that urgent patching, tighter segmentation, and better monitoring are essential to stop these fast-moving attacks.
Can the UK roll out a mandatory digital ID while trust, politics and privacy norms are in flux — or will a rushed plan deepen exclusion and surveillance risks? This debate matters because the right mix of design, legal limits and public buy-in could make everyday life easier, but the wrong choices could erode rights and trust for years.
Beneath the waves a handful of fragile undersea cables carry Britain’s internet, voice and about £220 billion in daily financial traffic — yet ministers have been too timid protecting these vital arteries. The JCNSS warns that simple fixes like better redundancy, shore protection and clearer ministerial responsibility could stop a local hit from becoming a national crisis.
When President Trump publicly demanded Microsoft fire global affairs chief Lisa Monaco, it turned a corporate hire into a high-stakes clash over corporate independence, national security, and public trust. That showdown forces a bigger question: how should tech companies balance expert government experience with fears of politicization and risk to critical infrastructure?
Could teenage curiosity spark an international incident? Two 17‑year‑olds in the Netherlands were arrested for allegedly using cheap Wi‑Fi sniffing tools on behalf of Russian intelligence, a case that exposes how low‑cost cyber tradecraft and online recruitment can blur the line between youthful tinkering and real national‑security threats.
When a datacenter fire put 647 e-government services offline, everyday tasks like tax filings and benefit claims suddenly ground to a halt. It’s a wake-up call that Korea’s digital convenience needs stronger backups, clearer communication and user-centered contingency plans to protect people when systems fail.
A decade-old espionage tool, PlugX, has been revamped and is now creeping into telecom and manufacturing networks across ASEAN, blending proven code with new evasion tricks to steal data and stay hidden. Operators, policymakers and smaller suppliers need to tighten defenses, share intelligence and hunt for anomalous DLL side-loading before these stealthy intrusions become lasting footholds.
When attackers treat exposed routers and firewalls like unlocked doors, small misconfigurations become gateways for state-backed espionage — RedNovember used buggy appliances and a portable Go backdoor to stealthily steal intelligence worldwide. The fix is simple (and doable): inventory and patch your edge devices, segment networks, and lock down exposed management interfaces before the next intruder walks in.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
What if the law that lets companies and the government swap cyber threat signals overnight simply vanished? With the 2015 CISA at risk amid a possible shutdown, automated feeds, legal protections, and the trusted channels that stop attacks fast could all be thrown into doubt.
Researchers uncovered a clever phishing campaign weaponizing innocent-looking SVG images to deliver a chain of malware — including PureRAT — that’s been targeting ministries, aid groups, and civilians in Ukraine and Vietnam. Stay wary of unexpected attachments and verify senders before you click, because even an image can be the gateway to credential theft and hidden cryptomining.
A critical Perfect‑10 RCE in Fortra’s GoAnywhere MFT is being actively exploited, leaving thousands of internet‑facing instances at risk — patch immediately, isolate exposed servers, and audit logs to stop data theft or ransomware. This crisis spotlights gaps in vendor disclosure and supply‑chain risk, so organizations and vendors must coordinate fast to prevent widespread breaches.
LockBit 5.0 is back and scarier than ever — its native payloads can now hit Windows, Linux and VMware ESXi in one campaign, putting entire enterprises and virtualized workloads at risk. If you haven’t already, harden hypervisors, adopt cross-platform defenses, and treat ransomware as an enterprise survival priority.
Singapore is sounding the alarm after a spike in Facebook impersonation scams that have cheated residents and strained law enforcement, and officials are now publicly pressing Meta to act faster to protect users. If platforms don’t step up with better detection, verification and takedowns, trust — and people’s money and privacy — will keep eroding.
Could a $5 expired domain let a stranger trick your AI into spilling customer data? Researchers proved it with Salesforce’s Agentforce, a wake-up call that mundane trust failures in AI pipelines can lead to serious leaks and that continuous domain monitoring and layered safeguards are essential.
Volvo North America says some employee records were accessed after a ransomware strike on HR supplier Miljödata, a reminder of how risky outsourcing payroll and benefits can be. Affected staff are being notified as investigators work the case — and the incident spotlights the urgent need for tougher vendor security and clearer breach rules.
Cisco ASA firewalls are once again under active attack by the ArcaneDoor campaign exploiting known flaws—putting critical networks and sensitive data at real risk. If you manage ASA devices, patch urgently, lock down admin access, and treat these appliances as high‑value targets before attackers do.