decrypted · 7 november 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

The NCSC tells UK organisations to prepare for a patch wave

The National Cyber Security Centre has told Britain's critical infrastructure to expect ransomware built with AI-powered malware within two years. Its more useful line concerns the past. Chief executive Dr Richard Horne said: "For decades, we have collectively got away with doing tech on the cheap." The review, titled The State of the Cyber Nation, was published on 3 November.

What the review says

The NCSC calls AI-powered malware in a ransomware attack on critical national infrastructure "highly likely" within two years. The report expects AI to speed up existing methods, not run whole attacks itself. Dr Horne's point is that AI has invented no new weaknesses: it lets attackers find long-tolerated ones at a scale once unimaginable.

The patch wave

The NCSC's chief technology officer, Ollie Whitehouse, set out the practical consequence in a blog first published on 1 May and updated in October. He expects a "forced correction" across open source, commercial, in-house and software-as-a-service products, meaning software you rent online. Organisations should prepare for a "patch wave".

Think of a building nobody has surveyed for decades. The cracks are old. What has changed is that a surveyor with a thermal camera can now list every one of them in an afternoon, and so can the burglar. The snagging list arrives all at once, and the landlord who ignored it gets the whole bill together.

His advice is plain and unglamorous:

Find and minimise your internet-facing systems, and patch that external surface first, then your critical security systems.
Replace legacy technology that cannot be updated, or bring it back into support, especially where it faces the internet.
Turn on automatic updates, including for embedded devices, and adopt "update by default", with exceptions for safety-critical systems and operational technology.

The Secure by Design reading

This is opinion, not NCSC wording, but the two pieces fit together. A patch wave punishes the organisations that wired things to the internet because it was convenient. Dr Horne urged leaders to stop connecting technology to the internet unnecessarily, and to treat Cyber Essentials as the start, not the finish. Whitehouse adds that vendors should ship memory-safety and containment technologies, which shrink the damage a single bug can do.

So the design decision that matters is made long before the flaw is found: does this system need to be reachable from anywhere at all? What a defender sees is not a dramatic alert. It is a queue of advisories growing faster than the team can clear it, and the systems at the front of that queue are the exposed ones.

The cost of applying the lesson is modest and dull: an honest inventory of what faces the internet, a standing patch window your board has agreed in advance, and a date by which unsupported kit goes. The government is funding the national side, with £70 million for a new National Exposure and Real-Time Vulnerability Centre. Your own estate is still your own bill.

Also this week

Chainalysis revises its breach. The blockchain analytics firm, whose customers include law enforcement and financial institutions, first said on 30 October that only non-sensitive details such as names, emails and role labels were taken, by an actor using what it called "offensive agentic techniques". On 4 November it said that names, usernames, password hashes and live tokens for all users were exposed. It says it has no evidence that investigations data was accessed or attribution data altered. An email to some customers also described an on-path attack, one that sits between a user and a service, exposing a subset of passwords. Login, transaction and address screening products were taken offline, phased restoration began on 6 November, and every user must reset passwords and rotate API keys, the credentials one program uses to talk to another. The AI description is the company's own and no technical detail has been published. The lesson is old: assume the first scope statement is too small, and make stolen tokens short-lived.

A game launcher as a delivery route. A researcher alleges that four script files for the PC launcher of Goddess of Victory: Nikke, served from the publisher's official infrastructure, were altered on 27 September, so that opening the launcher fetched code from attacker domains and installed a remote access tool. The publisher, Level Infinite, said on X that the files "may have been tampered with by a third party", and shipped a fix on 4 November. The dates and technical detail come from the researcher via BleepingComputer, and the publisher's investigation continues. BleepingComputer advises a full antivirus scan, and credential changes from a clean device if compromised. Anything that fetches and runs script at start-up makes someone else's server part of your perimeter, which is worth a policy line if staff install games on work laptops.

Sources