Surveillance and privacy

1 NOV GCHQ cannot say how many removable drives it has lost The Investigatory Powers Commissioner says GCHQ cannot immediately locate removable media it puts in the thousands. The lesson for UK organisations is about inventory, encryption and who owns the data path. 30 OCT Ofcom's age-check shortlist: the question is what gets kept Ofcom has shortlisted four ways to check a user is 16 for the under-16 social media ban. The Secure by Design question is what each leaves behind. Also: a second exploited Cisco VPN zero-day since August, and an Amadeus breach reaching Japan Airlines. 26 OCT An abandoned app's updater could have run code on millions of machines Researchers took over the lapsed update domain of a dead Popcorn Time fork and found its updater would run anything it was sent, as the most privileged user. The Secure by Design lesson is cheap: sign your updates and plan for end of life. 18 OCT The Met's unapproved app and the side door in every organisation The ICO reprimanded the Metropolitan Police over about 500 accounts on a retail crime platform the force never approved. The lesson for every UK organisation: approval must be an enforced gate, tested regularly, not a policy reminder. 17 OCT Candiru spyware delivered through adverts: when the ad is the exploit Citizen Lab says an ad tech firm let Candiru spyware reach chosen devices through ordinary adverts, with no click needed. The Secure by Design lesson is that a vendor badge is not a control. Plus an exploited Nextcloud flaw and Anthropic's self-replicating AI warning. 14 OCT The Housing Ombudsman's complaints system is down, and the fault sits with a supplier The Housing Ombudsman Service cannot take complaints online after a third-party incident hit its case management system. What is known, what is not, and the supplier questions a board can ask this week. Also: Docker Hub's token flaw and Microsoft's phishing takedown. 14 OCT Ivanti Connect Secure: a zero-day chain that your integrity checker cannot see Volexity says an attacker chained Ivanti Connect Secure flaws to take root on patched VPN appliances, leaving no malware and evading the vendor's integrity checker. What UK organisations should do, plus Docker Hub, the Housing Ombudsman and a Norwegian ad-tech fine. 11 OCT A failed airline's inbox is up for sale to train an AI: whose data is it? Google has proposed paying $10 million for a bankrupt airline's internal data to train AI, and 121 US lawmakers want it halted. The Secure by Design lesson for UK organisations: data you keep becomes an asset in your insolvency. 11 OCT SonicWall's SMA1000 gets a second front door, and someone is already knocking SonicWall fixed a maximum severity, no-login flaw in its SMA1000 remote access gateways, and one researcher reports probes that match it. The Secure by Design lesson: internal services should not trust a request because of where it came from. 10 OCT One person, nine banks: AI agents change the arithmetic of attack CrowdStrike links attacks on South Korean banks to one person using an open-source AI pentest agent and commercial models. What UK organisations should change when attack effort scales with API credit, plus a SonicWall flaw and a 2027 Windows Update deadline. 7 OCT ASOS's own app became the ransom note: who can speak in your name? Hackers used ASOS's own app to push an extortion message to customers, claiming a Snowflake compromise they have yet to evidence. The Secure by Design question for UK firms: who can speak in your name? 6 OCT Denmark's population register was drained through a supplier's legitimate access Attackers took names, addresses and personal numbers for 8.8 million people from Denmark's national register using a company's lawful access. The design lesson on throttling and monitoring applies to any UK organisation sharing identity data with suppliers. 3 OCT FortiMail's encryption portal let attackers write files without logging in Attackers are exploiting CVE-2026-104286, a 9.8-rated flaw in FortiMail's encryption feature that lets them write files without logging in. Also: MI5's alert on China-funded research and a Danish university's identity system breach. 2 OCT Microsoft switches on cloud backup of Windows settings by default, with exemptions the UK may not share Windows 11 26H2 now backs up settings to the cloud by default for Entra-joined organisations, except in EU Digital Markets Act regions and sovereign clouds. What UK administrators should check, plus a ransomware takedown and an exploited FortiMail flaw. 1 OCT A Zammad zero-day chain let an AI agent breach the people who find zero-days The Dutch Institute for Vulnerability Disclosure was breached through two unknown Zammad flaws, in what it describes as a hack through AI agents. The Secure by Design lesson is about helpdesk privileges and segmentation. Also: MikroTik RouterOS, Star Blizzard, Paragon. 24 SEP Ofcom asks Pornhub's owner if it tested the age check it borrowed from Apple Ofcom has opened an Online Safety Act investigation into Aylo over an age check that relies on Apple signals. The Secure by Design question is what any UK organisation should ask about a control it borrows. Also: the NCSC on AI and defenders, malware in Terraform providers, and a Check Point VPN flaw under attack. 22 SEP A masterkey to every case file: the Ministry of Justice's Southport breach The Ministry of Justice apologised after court staff accessed Southport attack victims' case files without authorisation, a permissions failure referred to the ICO. Plus: CISA flags three exploited Linux kernel flaws, North Korea's WaterPlum drains crypto wallets via fake job interviews, and a flaw called Plugin4Shell hits four AI coding agents. 16 SEP Iran's spyware campaign starts with a chat, not an exploit The NCSC, FBI and Dutch AIVD exposed CHOSEN BRICK, Iranian spyware that reaches UK-based dissidents and journalists through fake friendships rather than a technical flaw. Plus: active exploitation of a critical WSO2 API Manager bug and a zero-day backdooring Adobe Commerce stores. 16 SEP Ransomware gangs catch up with a VMware bug CISA flagged in August CISA says ransomware crews have joined state-linked attackers exploiting an unauthenticated, critical VMware vCenter flaw first patched in July. Also this week: backdoors planted in JFrog Artifactory instances, and Apple's fight over a secret UK order to break iCloud encryption returns to the tribunal. 14 SEP Microsoft's Windows Defender patch didn't survive the week Microsoft patched a Windows Defender privilege escalation flaw this month; within days the researcher who found it published a working bypass called ShieldCrash. Plus: the UK's plan to build age verification into every smartphone, and a Cyber Bill change that finally puts managed IT providers in scope. 13 SEP The bill comes due for the SSO flaw that hit 138 companies Trezor confirms 347,000 customers were sent phishing emails after the Brevo SSO flaw covered last week, showing what cross-tenant identity bugs actually cost downstream. Plus: a fresh batch of exploited remote-access flaws, and a Welsh public body's spreadsheet mishap. 13 SEP A Russian spy operation had Claude rewrite its own malware after getting caught Anthropic says a Midnight Blizzard-linked group let Claude autonomously rebuild detected malware and hit 20+ targets; NCSC's agentic AI guidance explains the gap. Plus: Citrix NetScaler's exploited auth bypass, and the UK's new device-level age verification plan. 23 AUG The 768 AWS keys still working years after they leaked Truffle Security found hundreds of leaked AWS keys still granting full account control years after they leaked, a Zimbra mail flaw now under active exploitation, and Cifas data showing UK SIM swap fraud up 402% this year, with the design lesson from each. 22 AUG The Rust supply chain attack that memory safety didn't stop, and the advisory Microsoft retracted A backdoored Rust crate with a decade of trust behind it, tied by researchers to North Korea, shows memory safety doesn't stop a supply chain attack. Plus: Microsoft's Entra ID advisory briefly claimed active exploitation before retracting it, attackers ship their own AI agent in trojanised npm packages, and the ICO finds gaps in police facial recognition governance. 18 AUG The Azure breach that named Vodafone, and the MFA that waved it through A seller calling themselves TheHatman is offering 3.6 million employee records lifted from corporate Azure and Entra tenants, Vodafone among them, using nothing more exotic than password spraying and MFA fatigue. Plus: an ICO reprimand shows what happens when patching lapses for four years, and a critical macOS flaw is being used to mine Monero. 17 AUG GE and Philips join Shell on Clop's leak site, over a flaw exploited before it had a patch General Electric and Philips are investigating Clop ransomware data theft claims, widening a campaign that already hit Shell through a critical zero-day in PTC's Windchill engineering software. Plus: an actively exploited Cisco firewall flaw prompts an NHS alert, and France's tax authority discloses a breach it quietly contained since June. 15 AUG The Power Pages default behind three UK breaches this month Researchers this week confirmed a data-extortion crew's claims against 13 organisations, including the UK's Department for Education, the Police National Legal Database and Newcastle University, all breached via one misconfigured Microsoft Power Pages setting. Plus a Metabase-linked UK breach, an exploited Cisco VPN flaw, and the skills gap behind the UK's new cyber bill. 7 AUG Apple goes back to court over the UK's iCloud backdoor Apple has filed a second legal challenge against the UK's demand for access to encrypted iCloud backups, a case that puts lawful access and secure design on a collision course. Also: today's CISA deadline for a trio of exploited flaws, including an AI workflow tool that handed out superuser access by default, and an extortion gang that never bothered sending a ransom note. 22 JUL A hospital billing vendor's breach, and the 147 million records it inherited Craneware's breach exposed patient data it inherited through a 2021 acquisition, raising a data-minimisation question for any UK firm that has bought its way into systems it didn't design. Plus a fourth Langflow RCE hits CISA's exploited list, Brussels tightens AI-scraping rules the ICO already enforces, and a Dutch cooling failure tests cloud resilience. 15 JUL The AD FS zero-day hiding inside a record Patch Tuesday Microsoft's biggest-ever Patch Tuesday fixed two zero-days already under attack, and the one in AD FS matters more than the one in SharePoint. Also: an unconfirmed ransomware claim against Arm, the Bank of England's new oversight of AWS, Azure, Google Cloud and Oracle, and the UK's under-16s social media law.