Decrypted: The UK Cyber Briefing 7e01b47e-3aaf-50c8-8c1d-ced75a23a9e2 A four minute UK cyber security briefing, twice a day. https://www.d4vinder.com/decrypted/ The UK cyber security story that matters today, in about four minutes. A short daily briefing on the breaches, vulnerabilities and policy that affect UK organisations, what actually went wrong, and the design decision that would have prevented it. en-gb Copyright 2026 Davinder Singh Tue, 15 Sep 2026 17:19:13 +0000 Davinder Singh The UK cyber security story that matters today, in about four minutes. A short daily briefing on the breaches, vulnerabilities and policy that affect UK organisations, what actually went wrong, and the design decision that would have prevented it. episodic false Davinder Singh support@d4vinder.com The Check Point VPN flaws that haven't been exploited yet https://www.d4vinder.com/decrypted/the-check-point-vpn-flaws-that-haven-t-been-exploited-yet.html d4-decrypted-the-check-point-vpn-flaws-that-haven-t-been-exploited-yet Mon, 14 Sep 2026 17:06:24 +0000 Check Point patched two 9.8-severity VPN flaws on 9 September; the Dutch NCSC now expects large-scale exploitation soon. Plus: a Twitch extension leaked 31,000 login tokens to Russia, and Parliament approved data-minimising digital age checks for alcohol sales. Check Point patched two 9.8-severity VPN flaws on 9 September; the Dutch NCSC now expects large-scale exploitation soon. Plus: a Twitch extension leaked 31,000 login tokens to Russia, and Parliament approved data-minimising digital age checks for alcohol sales. Check Point patched two 9.8-severity VPN flaws on 9 September; the Dutch NCSC now expects large-scale exploitation soon. Plus: a Twitch extension leaked 31,000 login tokens to Russia, and Parliament approved data-minimising digital age checks for alcohol sales.

Sources

Read the written version

]]> Davinder Singh 0:03:43 false full 6 2026 Microsoft's Windows Defender patch didn't survive the week https://www.d4vinder.com/decrypted/microsoft-s-windows-defender-patch-didn-t-survive-the-week.html d4-decrypted-microsoft-s-windows-defender-patch-didn-t-survive-the-week Mon, 14 Sep 2026 05:18:01 +0000 Microsoft patched a Windows Defender privilege escalation flaw this month; within days the researcher who found it published a working bypass called ShieldCrash. Plus: the UK's plan to build age verification into every smartphone, and a Cyber Bill change that finally puts managed IT providers in scope. Microsoft patched a Windows Defender privilege escalation flaw this month; within days the researcher who found it published a working bypass called ShieldCrash. Plus: the UK's plan to build age verification into every smartphone, and a Cyber Bill change that finally puts managed IT providers in scope. Microsoft patched a Windows Defender privilege escalation flaw this month; within days the researcher who found it published a working bypass called ShieldCrash. Plus: the UK's plan to build age verification into every smartphone, and a Cyber Bill change that finally puts managed IT providers in scope.

Sources

Read the written version

]]> Davinder Singh 0:03:33 false full 5 2026 The bill comes due for the SSO flaw that hit 138 companies https://www.d4vinder.com/decrypted/the-bill-comes-due-for-the-sso-flaw-that-hit-138-companies.html d4-decrypted-the-bill-comes-due-for-the-sso-flaw-that-hit-138-companies Sun, 13 Sep 2026 17:07:50 +0000 Trezor confirms 347,000 customers were sent phishing emails after the Brevo SSO flaw covered last week, showing what cross-tenant identity bugs actually cost downstream. Plus: a fresh batch of exploited remote-access flaws, and a Welsh public body's spreadsheet mishap. Trezor confirms 347,000 customers were sent phishing emails after the Brevo SSO flaw covered last week, showing what cross-tenant identity bugs actually cost downstream. Plus: a fresh batch of exploited remote-access flaws, and a Welsh public body's spreadsheet mishap. Trezor confirms 347,000 customers were sent phishing emails after the Brevo SSO flaw covered last week, showing what cross-tenant identity bugs actually cost downstream. Plus: a fresh batch of exploited remote-access flaws, and a Welsh public body's spreadsheet mishap.

Sources

Read the written version

]]> Davinder Singh 0:03:11 false full 4 2026 A Russian spy operation had Claude rewrite its own malware after getting caught https://www.d4vinder.com/decrypted/a-russian-spy-operation-had-claude-rewrite-its-own-malware-after-getting-caught.html d4-decrypted-a-russian-spy-operation-had-claude-rewrite-its-own-malware-after-getting-caught Sun, 13 Sep 2026 05:17:38 +0000 Anthropic says a Midnight Blizzard-linked group let Claude autonomously rebuild detected malware and hit 20+ targets; NCSC's agentic AI guidance explains the gap. Plus: Citrix NetScaler's exploited auth bypass, and the UK's new device-level age verification plan. Anthropic says a Midnight Blizzard-linked group let Claude autonomously rebuild detected malware and hit 20+ targets; NCSC's agentic AI guidance explains the gap. Plus: Citrix NetScaler's exploited auth bypass, and the UK's new device-level age verification plan. Anthropic says a Midnight Blizzard-linked group let Claude autonomously rebuild detected malware and hit 20+ targets; NCSC's agentic AI guidance explains the gap. Plus: Citrix NetScaler's exploited auth bypass, and the UK's new device-level age verification plan.

Sources

Read the written version

]]> Davinder Singh 0:03:31 false full 3 2026 A GitLab flaw was exploited a day after the patch landed https://www.d4vinder.com/decrypted/a-gitlab-flaw-was-exploited-a-day-after-the-patch-landed.html d4-decrypted-a-gitlab-flaw-was-exploited-a-day-after-the-patch-landed Sat, 12 Sep 2026 17:19:54 +0000 GitLab's maximum severity path traversal flaw was under active internet-wide scanning within a day of the patch landing, exposing secrets and CI/CD pipelines on self-hosted servers. Also this week: peers reject an AI 'kill switch' amendment to the UK's Cyber Security and Resilience Bill, and EU defence officials push back on Brussels' cloud sovereignty rules. GitLab's maximum severity path traversal flaw was under active internet-wide scanning within a day of the patch landing, exposing secrets and CI/CD pipelines on self-hosted servers. Also this week: peers reject an AI 'kill switch' amendment to the UK's Cyber Security and Resilience Bill, and EU defence officials push back on Brussels' cloud sovereignty rules. GitLab's maximum severity path traversal flaw was under active internet-wide scanning within a day of the patch landing, exposing secrets and CI/CD pipelines on self-hosted servers. Also this week: peers reject an AI 'kill switch' amendment to the UK's Cyber Security and Resilience Bill, and EU defence officials push back on Brussels' cloud sovereignty rules.

Sources

Read the written version

]]> Davinder Singh 0:03:24 false full 2 2026 The phone call that gets past your passkey https://www.d4vinder.com/decrypted/the-phone-call-that-gets-past-your-passkey.html d4-decrypted-the-phone-call-that-gets-past-your-passkey Sat, 12 Sep 2026 05:09:41 +0000 Extortion gangs are phoning staff pretending to be the IT helpdesk to sidestep passkeys and MFA entirely, while a maximum-severity Cisco firewall flaw and an AI-driven mass hack of PaperCut servers round out a heavy 24 hours for patching teams. Extortion gangs are phoning staff pretending to be the IT helpdesk to sidestep passkeys and MFA entirely, while a maximum-severity Cisco firewall flaw and an AI-driven mass hack of PaperCut servers round out a heavy 24 hours for patching teams. Extortion gangs are phoning staff pretending to be the IT helpdesk to sidestep passkeys and MFA entirely, while a maximum-severity Cisco firewall flaw and an AI-driven mass hack of PaperCut servers round out a heavy 24 hours for patching teams.

Sources

Read the written version

]]> Davinder Singh 0:02:43 false full 1 2026