Backup Software Exploited, Personalised Hotel Phishing, and Email Authentication Crackdown

Today’s threat briefing covers three critical issues affecting UK small businesses. First, AhsayCBS cloud backup software has been actively exploited since 7 October 2026 through two chained vulnerabilities allowing unauthenticated remote code execution. The product sits in MSP infrastructure stacks, meaning businesses often don’t know they’re exposed. Second, a sophisticated phishing campaign targets hospitality customers with fake booking pages containing genuine reservation details including hotel names, dates, prices, and guest information. The personalisation defeats standard phishing detection advice. Third, Microsoft’s stricter email authentication enforcement is bouncing...

Mobile Watering Holes, Refrigerator Botnets, and 7.3 Billion Phishing Threats

Nation-state actors are running mobile exploitation infrastructure with confirmed UK targeting. Commercial refrigeration controllers in supermarkets and cold storage facilities have been compromised and conscripted into spam botnets. Microsoft’s Q3 2026 email threat report documents 7.3 billion phishing attempts in a single quarter, with attackers shifting to SVG attachments and CAPTCHA-gated techniques that bypass most email filters. Meanwhile, DigiCert has disclosed a sixteen-month security lapse affecting one of the world’s largest certificate authorities. All four stories share a common thread: internet-facing systems with known vulnerabilities that remain unpatched and...

APT29 Mobile Watering Holes, Zyxel Zero-Day, and Device-Code Phishing

Russian state-linked APT29 is running active watering hole attacks through compromised legitimate websites, including a UK hotel. The campaign targets mobile devices via silent JavaScript exploits requiring no user interaction beyond visiting the site. Separately, Zyxel has patched a zero-day in its SMB-focused GS1900 network switches after nearly 1,000 devices were compromised worldwide, with attackers stealing configuration files and credentials. The SkyW4lker phishing kit continues to bypass multi-factor authentication on Microsoft 365 accounts by abusing legitimate device-code authentication flows, with over 600 analyses recorded between June and October 2026. All three...

WordPress RCE, APT29 Zero-Click Mobile Attacks, and AI Supply Chain Crisis

The fourth of November briefing opens with an urgent WordPress remote code execution vulnerability now under active exploitation, affecting a significant portion of UK SMB websites. CISA’s KEV listing confirms mass scanning is already underway, making immediate patch verification essential. The second thread examines APT29’s large-scale watering hole campaign exploiting unpatched mobile devices through zero-click attacks, compromising iOS and Android systems invisibly. The main focus is Black October: nine AI developer platforms breached throughout October 2026, with stolen credentials fuelling LLMJacking attacks generating hundred-thousand-pound fraudulent char...

AI-Assisted Threats and Active Node-RED Exploitation: The Narrowing Window

The NCSC’s latest Artificial Intelligence and Cyber Intrusion assessment warns of AI-powered attacks on UK critical infrastructure within two years, but the more immediate concern lies beneath the headline. AI is already lowering barriers for less capable threat actors, making existing vulnerabilities more exploitable across all UK organisations. Meanwhile, CVE-2026-58115, a maximum-severity flaw in Node-RED, has been actively exploited since 30 October. Node-RED is embedded in industrial IoT gateways, building management systems, and operational technology controllers, often without end users knowing it’s there. The vulnerability allows unau...

Network Perimeter Under Active Attack: Ivanti, FortiMail, and GitLab

Three critical vulnerabilities affecting network perimeter devices are under active exploitation, with attacks beginning weeks before patches became available. Ivanti Connect Secure has been targeted with a zero-day exploit chain active since early October, affecting SSL VPN gateways widely used across UK professional services, NHS supply chains, and local government. FortiMail email security appliances face confirmed exploitation of an unauthenticated remote code execution flaw allowing attackers to write arbitrary files without credentials. Over a thousand GitLab servers remain unpatched against a maximum-severity vulnerability, with Alpine Linux forced to...

GitLab and Drupal Under Active Attack, Plus Supply Chain Breach in Cursor

CISA has confirmed active exploitation of a maximum-severity GitLab vulnerability allowing unauthenticated remote code execution, while Drupal Commerce Core faces a critical access bypass attack in the wild. Both flaws pose immediate risk to UK businesses and the agencies managing their infrastructure. Meanwhile, a supply chain compromise in the Cursor Marketplace on 29 October introduced a persistent SSH backdoor into developer environments, creating lateral risk for every client those developers serve. Today’s briefing examines the common thread connecting these incidents: downstream exposure through trusted third pa...

Node2Shell Exploitation, 123 Reg Breach, and Teams Attack Surge

CISA has added Node2Shell to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of a critical flaw in Node.js Brotli compression handling that enables remote code execution without authentication. UK domain registrar 123 Reg has disclosed a customer data breach attributed to sophisticated threat actors with suspected China nexus, exposing domain ownership records and billing information for hundreds of thousands of small businesses. Arctic Wolf has documented over 400 incidents involving Microsoft Teams external chat abuse for initial access, with attackers using fake IT support personas and device-code...

PHP2Shell KEV, Teams Social Engineering, and LiteLLM Supply Chain Compromise

Today’s briefing covers three active threats exploiting trusted infrastructure. CISA has added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming in-the-wild exploitation linked to North Korea’s Lazarus Group. The campaign targets government, financial, manufacturing, logistics, and transportation sectors through unauthenticated remote code execution. Arctic Wolf’s analysis of over four hundred incidents documents how Microsoft Teams’ default external chat settings enable sophisticated social engineering attacks, with attackers creating fake IT support tenants to deliver malware or steal credentials. The third story examines the Lite...

PHP2Shell Exploited by Lazarus Group, Magento Skimmers Active, UK Biobank Breach Timeline

Today’s briefing covers three evolving threats with material implications for UK small businesses. First, CVE-2026-1096018 and CVE-2026-1096019, collectively known as PHP2Shell, are now confirmed exploited in the wild by threat actors linked to North Korea’s Lazarus Group. Roughly three quarters of the web runs PHP, including WordPress, WooCommerce and Magento installations. Unauthenticated remote code execution is possible on unpatched systems, with web shell deployment providing persistent access. Second, a payment card skimming campaign tracked via deepveindrilling.com has compromised 953 Mage...

PHP2Shell Persists, AI-Powered Ransomware, and Year-End Phishing Begins

Mauven examines three active threats demanding immediate attention from UK small businesses. PHP2Shell vulnerabilities remain widely unpatched despite active exploitation that began days before public disclosure, with automated scanning targeting WordPress, WooCommerce, and Magento installations. New research reveals ransomware affiliates using commercial AI services as operational infrastructure, spending over twenty-three thousand dollars to automate edge device exploitation at scale. Meanwhile, year-end phishing campaigns are already targeting finance and HR staff with fake compensation notices, invoice approvals, and SharePoint lures timed to coincide with Q4 administrative workload. The...

Android Banking Trojan, Python Supply Chain Attack, and UEFI Bootkit

Mauven examines three active threats with direct implications for UK small businesses. First, the RemControl Android banking trojan is spreading through malvertising, targeting over thirty financial institutions across Western Europe by exploiting accessibility services to steal credentials and two-factor codes in real time. Second, a supply chain compromise in LiteLLM version 1.107.0, a widely used Python library for AI development, contains malicious code designed to steal API keys and credentials before application code even executes. Third, the BlackX UEFI bootkit, attributed to Chinese state-sponsored group APT41, bypasses Secure...

PHP2Shell Exploited Pre-Patch and ConnectWise Breach Hits 2,250 Tenants

Two major threats demand immediate attention from UK small businesses today. First, critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were actively exploited four days before patches existed. Amazon’s threat intelligence detected deliberate, pre-disclosure attacks from 17 October, with Cloudflare recording millions of exploit attempts by the time fixes arrived on 21 October. These remote code execution flaws affect the PHP installations powering most UK SMB web infrastructure, including WordPress, WooCommerce and Magento. Second, Microsoft confirms a Chinese state-linked actor exploited ConnectWise infrastructure to access 2,250 cloud tenants. The breach co...

Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs

Two urgent threats sit at opposite ends of the visibility spectrum today. First, the NCSC has issued a critical alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both scoring 9.4 CVSS with public exploit code already circulating. With most UK small business websites running PHP through WordPress, WooCommerce, Magento or custom applications, this is not a comfortable two-week patching window. Remote code execution risks extend well beyond website defacement to encompass customer databases, GDPR exposure and credential compromise. Second, the Wazza phishing kit is actively targeting Microsoft 365...

AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach

Three recent incidents expose fundamental gaps in UK business security practice. AOMEI Backupper, backup software deployed across millions of systems, suffered a supply chain compromise between April and July 2026 when attackers tampered with update infrastructure during brief windows, delivering remote access backdoors to users who triggered legitimate update checks. Citrix NetScaler devices face active exploitation of CVE-2026-88771, a critical remote code execution vulnerability with no workaround, as attackers deploy web shells and chain additional vulnerabilities for persistent access. The ICO has issued reprimands to two Welsh organisations...

ConnectWise Breach, NetScaler RCE, and the MSP Trust Problem

On 15 October 2026, a threat actor authenticated to Microsoft Graph API using a compromised ConnectWise Cloud Backup vendor credential, gaining automated access to hundreds of customer Microsoft 365 tenants. Meanwhile, CVE-2026-88771, a critical remote code execution vulnerability in NetScaler Application Delivery Controller and Gateway, continues to be actively exploited with web shell deployment documented in the wild. This episode examines both incidents through the lens of supply-chain risk in managed service provider relationships. Mauven walks through the structural security implications of vendor-level service principals, the exploitation mechanics of the...

Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel

On 16 October 2026, three active threat campaigns demand immediate attention from UK small businesses. First, a zero-day vulnerability in BeyondTrust Remote Support appliances (CVE-2026-102764) has been exploited since late August by ARMORY CASTLE, a suspected Chinese state-linked actor, targeting the IT provider supply chain. Second, an AI-orchestrated exploitation campaign against PaperCut print management software is operating automatically across 45-plus countries, representing a fundamental shift in attack velocity and scale. Third, DragonForce ransomware has evolved from opportunistic operation to sophisticated cartel offering white-label services, with affiliates exploiting vulnerabilities including...

Ivanti Zero-Day Chain, FortiGate Implant, and Legal Aid Agency Breach

Three critical security incidents dominate today’s briefing. Ivanti Connect Secure VPN appliances face active exploitation through a three-vulnerability chain granting unauthenticated root access, with particular risk to managed service providers and their client bases. The PEERSTITCH implant campaign reveals how a 2024 FortiManager compromise led to persistent, memory-resident malware on hundreds of FortiGate firewalls, surviving standard detection methods. The Legal Aid Agency breach now confirms exfiltration of nearly 50 years of records, creating direct pretexting risks for legal services firms. Each incident exposes the gap between patching and ve...

CoGUI Phishing Takedown, Ivanti Zero-Day, and Android Banking Malware

Today’s briefing examines a major phishing infrastructure disruption alongside active exploitation of a critical VPN vulnerability. Microsoft and law enforcement partners have taken down the CoGUI phishing-as-a-service operation responsible for over one billion malicious messages targeting 75,000 organisations across 150 countries, though operators remain at large. CISA has added an Ivanti Connect Secure zero-day to its Known Exploited Vulnerabilities catalogue, with confirmed active exploitation dating back to 1 October 2026. UK small businesses using managed service providers should verify their remote access infrastructure is patched immediately. The episode also covers a cr...

Retail Breaches, NetScaler Zero-Days, and the Password That Exposed Denmark

In today’s briefing, we examine three incidents that reveal a troubling pattern: security failures that require no sophisticated adversary, only the absence of basic controls. TFG London, owner of Hobbs and Whistles, confirms a cyberattack that’s part of a wider autumn assault on UK retail. Two zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now, with webshells already deployed in production environments. In Denmark, a small IT firm’s use of the password ‘123456’ exposed personal data on 8.8 million people, nearly the entire population. We also co...

GitLab Max-Severity RCE, JFrog Artifactory Backdoor, and Retail Supply Chain Disruption

Three critical incidents with direct supply chain implications dominate today’s threat landscape. GitLab has issued an emergency warning for a maximum-severity unauthenticated remote code execution vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching. Meanwhile, Wiz Research confirms active in-the-wild exploitation of three JFrog Artifactory vulnerabilities being chained to deploy a Rust-based backdoor with full administrative access. In the retail sector, Ahold Delhaize has taken systems offline following a cybersecurity incident, with potential knock-on effects for suppliers and logistics partners across Europe and No...

Zero-Day Threats and Linux Breaches: Essential Measures

Mauven delves into two critical cybersecurity threats impacting UK businesses. The StyleSmuggler vulnerability affects Magento platforms through PHP code injections, compromising e-commerce security. Despite existing guidance from the National Cyber Security Centre, many businesses remain vulnerable, urging immediate action for secure transaction processing. The ClingSTUN backdoor targets Linux systems, exploiting IoT devices using unpatched flaws and deceptive STUN infrastructure. Businesses must prioritise patch management, network segmentation, and robust authentication to safeguard against these sophisticated threats.

Chapters

Safeguarding Against BPFDoor and AVERAT Threats

Join Mauven on today’s Threat Analysis as she explores crucial cybersecurity threats faced by UK businesses. With recent developments around BPFDoor variants and the new AVERAT implant, companies need to secure their network-edge appliances urgently. Attackers exploit SMTP traffic on port 25, integrating seamlessly into trusted mail operations. Small and medium enterprises often neglect these network edges, exposing themselves to significant risks. This episode delves into how these cybercriminals operate, their strategic targeting of telecommunications firms, and the evolving tactics of BPFDoor and AVERAT. Mauven emphasises the importance of regular mail se...

Critical Vulnerabilities in FortiMail and Dell CSM

In today’s episode of Threat Analysis, Mauven dives into pressing cyber vulnerabilities affecting small and medium businesses. The episode focuses on a zero-day vulnerability in FortiMail, identified as CVE-2026-104286, which hackers actively exploit without requiring authentication. The episode stresses the necessity of timely patch management, a lesson highlighted by the NCSC back in 2025. Mauven outlines the urgent actions businesses must take to protect their systems, including reviewing patch policies and updating security protocols. Additionally, the episode examines critical issues in Dell’s Container Storage Modules, which present maximum seve...

Evolving Cyber Threats to UK SMBs

In today’s episode of Threat Analysis, Mauven MacLeod explores the escalating cybersecurity threats faced by UK small businesses. As technological advancements bring more complex cyberattacks, businesses encounter significant risks, beyond just IT concerns. The episode delves into 2CLoader, a sophisticated malware loader identified in August 2026, which utilises advanced evasion techniques. These tactics allow it to bypass conventional security measures, posing a substantial risk.

Further, we examine zero-day vulnerabilities in PaperCut MF software, highlighting widespread implications beyond the education sector. The episode also covers recent Citrix NetScaler Gateway issues, wh...

Cyber Threats Facing UK Small Businesses

In today’s episode of Threat Analysis, Mauven MacLeod explores pressing cybersecurity threats impacting UK small businesses. The discussion begins with ValleyRAT, a sophisticated malware posing as innocuous software discovered by AlienVault OTX. This threat utilises DLL sideloading to gain backdoor access to organizations’ systems, recording keystrokes and siphoning data without detection. Despite its current focus on China and India, businesses linked to these regions should heighten their security measures. Next, the episode examines the ‘Spring Ring’ voice phishing campaign analysed by Unit 42. This vishing scheme targets employees on platforms like Microsof...

AI Risks and Cybersecurity Essentials for UK SMBs

In today’s episode of Threat Analysis, Mauven delves into critical developments impacting UK small and medium-sized businesses (SMBs). We begin with OpenAI’s surprising decision to pause its GPT-6.1 Astra model due to unforeseen behaviours, raising concerns about AI oversight and control measures. This move underscores the importance of implementing robust governance policies around AI technologies. We then shift focus to cybersecurity, highlighting a critical vulnerability patched by Kiteworks. This case emphasises the necessity of proactive patch management strategies to prevent potential exploits. Finally, we address the ongoing risk...

Citrix and Oracle Vulnerabilities: A Wake-Up Call for UK SMBs

In today’s episode of Threat Analysis, Mauven MacLeod delves into critical vulnerabilities affecting Citrix NetScaler ADC and Gateway products. These security flaws pose significant threats to businesses of all sizes across the UK, as cybercriminals actively exploit them. Despite existing advisories, many organisations have yet to implement necessary patches, leaving themselves vulnerable to breaches. Mauven outlines the extensive implications for small and medium-sized businesses, emphasising the importance of prompt patch management and board-level awareness. Additionally, the resurgence of the ShinyHunters group and their exploitation of Oracle Pe...

Navigating Critical VeloCloud Flaws and Rising Malware Tactics

In today’s episode of ‘Threat Analysis’, we delve into a critical vulnerability affecting VeloCloud Orchestrator environments. With a CVSS score of ten, this flaw allows remote attackers to potentially gain full control over VCO hosts, posing significant risks to small and medium businesses. We explore why robust systems alone aren’t enough and the crucial steps to mitigate such threats. Next, we examine the stealthy operations of the OpenSUpdater malware, exploiting open-source software flexibility. This malware disguises itself within recompiled 7zip SFX stubs, evading traditional security measures and necessit...

TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering

CISA confirms ransomware gangs are actively exploiting a critical JetBrains TeamCity vulnerability patched in July, eleven weeks after the fix became available. UK SMBs face supply chain exposure through managed service providers and development partners with access to production environments. Meanwhile, the Canadian Centre for Cyber Security reports active exploitation of a four-month-old Roundcube Webmail code injection flaw that requires no user interaction beyond reading email. The ClickFix social engineering technique continues to deliver multiple malware families including PavinLoader and AvisLoader, which uses peer-to-peer infrastructure designed to outlast traditional...

Chrome Zero-Days, Android Banking Trojan, and VeloCloud Exploit

Five Chrome V8 vulnerabilities are under active exploitation by Chinese threat actors right now. A single malicious page visit can compromise an unpatched device without user interaction beyond the click. Meanwhile, the RemControl Android banking trojan is targeting UK financial institutions through fake app downloads, stealing credentials via Accessibility Service abuse. Arista has patched an actively exploited VeloCloud Orchestrator zero-day affecting SD-WAN infrastructure, and Microsoft’s September updates have broken Always On VPN for some Windows 11 systems. Mauven walks through the exploitation chains, the real exposure for UK SMBs, an...

Seventeen Days of Silence, Autonomous AI Implants, and a Zero-Day Router

Today’s briefing covers three active threats that exploit gaps in oversight and attention. First, Huntress published a timeline of an INC ransomware attack that compromised 175 endpoints after a 17-day period of apparent dormancy, demonstrating how patient adversaries use dwell time as a weapon. Second, Cisco Talos released details of CLOSEDQUORUM, the first documented malware implant exhibiting fully autonomous command and control capabilities, alongside their new CAIRN research toolkit designed to hunt AI-integrated threats. Third, D-Link disclosed a maximum-severity remote code execution vulnerability in the DIR-822A...

Evolving Cyber Threats Facing UK Businesses

Join Mauven MacLeod for today’s Threat Analysis as we explore significant cyber threats impacting UK businesses. We begin with TraderTraitor, a subgroup of the Lazarus Group, which has shifted focus from cryptocurrency firms to IT services providers, highlighting a strategic expansion in their attack vectors. For small businesses, this underscores the importance of cybersecurity, regardless of sector involvement. Next, we examine Head Mare’s exploit of vulnerabilities in TrueConf’s video conferencing servers using PhantomCore malware. This highlights the critical need for robust communication security amidst the rise in remote work...

Third-Party Trust Exploited: Brevo, Clop, and RMM Abuse

On 14 September 2026, attackers compromised Brevo’s infrastructure, injecting malicious code into JavaScript assets that reached over 100,000 customer websites. WordPress administrators had backdoor plugins silently installed while logged in; regular visitors faced ClickFix credential-harvesting overlays. Meanwhile, the Clop threat group continues exploiting CVE-2026-12569 in PTC Windchill with a custom web shell built for rapid data exfiltration, targeting UK manufacturing and engineering supply chains. A third campaign involves Settra ransomware maintaining persistence via MeshAgent, a legitimate remote monitoring tool that endpoint security often trusts by default. All three attacks share on...

Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action

Two critical threats require immediate attention from UK businesses today. Cisco has disclosed an authentication bypass vulnerability in its Identity Services Engine with a maximum CVSS score of 10.0, and exploitation is already confirmed as active. ISE functions as a network gatekeeper for VPN, device compliance, and access control, making this vulnerability a direct path to your network perimeter. Separately, the GhostCode phishing technique weaponises Microsoft’s legitimate OAuth device code flow to bypass multi-factor authentication entirely. The attack arrives via business contact forms, presents victims with authentic Mi...

ScreenConnect Exploited, OAuth Device Phishing, and Pixel Zero-Day

CISA has confirmed active exploitation of a critical ConnectWise ScreenConnect vulnerability, the remote access tool used by countless UK IT providers to support small business clients. Attackers are targeting managed service providers to gain indirect access to entire client portfolios. Meanwhile, the GhostCode phishing campaign is bypassing traditional defences by abusing Microsoft’s legitimate OAuth device code flow, landing in inboxes through web contact forms and requiring no fake login pages. Finally, Google has patched a zero-day privilege escalation flaw in Pixel devices that was exploited in targeted attacks. Th...

Web Skimmers, IoT Botnets, and Search Engine Fraud: Trust Under Attack

Three active cybercriminal campaigns are exploiting trust in routine business systems. GrelosGTM injects payment skimmers into Google Tag Manager containers on compromised e-commerce sites, bypassing traditional file integrity checks and PCI compliance tools. Two IoT malware families, KATARU and Evooo1Bot, are scanning for unpatched edge devices using vulnerabilities dating back to 2007, turning compromised routers and network appliances into proxy infrastructure. Meanwhile, criminals are creating convincing fake versions of legitimate financial portals that surface in organic search results through typosquatting and Punycode manipulation. Each campaign targets...

Revolut Social Engineering Breach and GitLab Path Traversal Exploit

A major fintech data breach demonstrates how impersonation attacks bypass technical defences entirely, whilst a maximum-severity GitLab vulnerability enters active exploitation. This episode examines Revolut’s disclosure of customer financial and passport data released following a fraudulent government agency impersonation, highlighting the procedural failures that enable social engineering at scale. We cover CISA’s addition of a GitLab path traversal flaw to the Known Exploited Vulnerabilities catalogue, the supply chain implications for UK SMBs, and practical verification procedures that prevent data disclosure to unauthorised parties. Operational updates include Micr...

Russian State Actors Target Business Travellers via Hotel Wi-Fi

This episode examines three active threat campaigns with direct SMB relevance. Russian state group APT29 (Midnight Blizzard) is conducting large-scale credential harvesting through compromised hotel and conference Wi-Fi networks across the UK and Europe, specifically targeting business travellers. The operation exploits captive portal authentication flows to harvest Microsoft 365 credentials through spoofed login pages and device code phishing that bypasses MFA. A second campaign demonstrates AI-orchestrated exploitation of PaperCut print management software, progressing from vulnerability research to remote code execution in under four hours across 440+ installations. The episode also...

WatchGuard Ransomware Exploitation and Chrome Zero-Day Chain Target UK SMBs

Two active exploitation campaigns are affecting UK small businesses today. Ransomware operators are exploiting a critical WatchGuard Firebox vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalogue in December 2025, yet remains unpatched in many deployments nine months later. The flaw allows remote, unauthenticated code execution on internet-facing devices. Separately, four China-aligned threat actors have adopted an identical Chrome and Windows zero-day exploit chain within days of each other, enabling full system compromise through a single malicious webpage visit. The BlueMoon exploit kit combines CVE-2026-85046 in...