Digital sovereignty

25 OCT PHP2Shell and Node2Shell: the day the web's engines both broke A Decrypted special. Two engine-level flaws, PHP2Shell and Node2Shell, were patched on the same Wednesday. One took parts of the British state offline as a precaution. Both were found by AI. Annabel and Jude on where the exposure really is, how the UK responded, and what defending at machine speed means on a Monday morning. 25 OCT Britain's 1885 cable law is being replaced, and a longer sentence is not a resilience plan The UK has put out a consultation to replace the 1885 Submarine Telegraph Act with tougher penalties and security duties for subsea cable operators. The Secure by Design lesson is to plan for the cable to break. Also: an abandoned updater, and a US lab portal outage. 23 OCT Railway's secrets scare: what a hosting platform holds on your behalf Developer platform Railway says an intruder may have read customers' decrypted secrets and has told everyone to rotate them. We cover what it said, the Secure by Design lesson, an exploited Arista SD-WAN flaw and the UK's undersea cable proposals. 14 OCT The Housing Ombudsman's complaints system is down, and the fault sits with a supplier The Housing Ombudsman Service cannot take complaints online after a third-party incident hit its case management system. What is known, what is not, and the supplier questions a board can ask this week. Also: Docker Hub's token flaw and Microsoft's phishing takedown. 12 OCT Microsoft sets an expiry date on Windows Update for machines that fall behind Two certificates that Windows uses to trust Windows Update expire in May and June 2027. Machines without the replacements will stop receiving patches. The Secure by Design lesson for UK organisations is an inventory, an owner and a plan. 8 OCT Hijacked country registries mint real Google certificates: the trust chain nobody audits Attackers took over the .gh, .sl and .as registries and obtained genuine HTTPS certificates for Google and others. The lesson for UK organisations sits below the website: who controls your DNS, and who is watching certificate logs. 7 OCT Atlassian's critical Data Center flaw: patch it, then take it off the internet Atlassian has warned of CVE-2026-21589, a critical unauthenticated file-access flaw in its self-hosted Data Center products. No exploitation was reported at disclosure. Also: ASOS's rogue app alert and Wikimedia's report on suspected OpenAI agents. 6 OCT Denmark's population register was drained through a supplier's legitimate access Attackers took names, addresses and personal numbers for 8.8 million people from Denmark's national register using a company's lawful access. The design lesson on throttling and monitoring applies to any UK organisation sharing identity data with suppliers. 2 OCT Microsoft switches on cloud backup of Windows settings by default, with exemptions the UK may not share Windows 11 26H2 now backs up settings to the cloud by default for Entra-joined organisations, except in EU Digital Markets Act regions and sovereign clouds. What UK administrators should check, plus a ransomware takedown and an exploited FortiMail flaw. 27 SEP The Dutch build an exit from Microsoft, and Microsoft corrects its evidence to MPs The Netherlands is piloting DAWO, a government workplace built on NixOS, after US sanctions on the ICC raised the question of supplier lock-in. Microsoft has since corrected its evidence to MPs on the same episode. What UK directors should ask their own suppliers, plus two exploited flaws in WordPress and PeopleSoft. 19 SEP Microsoft fixed a maximum-severity Azure AI flaw and told customers to do nothing Microsoft has fixed a CVSS 10.0 missing-authentication flaw in Azure AI Foundry, with no customer action needed. That is convenient, but it leaves UK organisations trusting a vendor's word. Also: the EU KIDS Act, the Gyazo breach and four Linux root exploits. 12 SEP A GitLab flaw was exploited a day after the patch landed GitLab's maximum severity path traversal flaw was under active internet-wide scanning within a day of the patch landing, exposing secrets and CI/CD pipelines on self-hosted servers. Also this week: peers reject an AI 'kill switch' amendment to the UK's Cyber Security and Resilience Bill, and EU defence officials push back on Brussels' cloud sovereignty rules. 9 AUG The Kemp LoadMaster bug at your network's edge, and the API that didn't need to be on CISA has added a critical, unauthenticated command injection flaw in Progress's Kemp LoadMaster load balancer to its exploited-vulnerabilities list after nearly 800 attack attempts. Plus: a Swiss government SharePoint breach, an ICO reprimand for the Met Police, and the MoD's sole-bid Microsoft threat contract. 29 JUL The SD-WAN orchestrator that needed no login, and the one before it Arista's VeloCloud SD-WAN orchestrator carried a maximum-severity command injection bug that needed no credentials to reach, the second such flaw in a network orchestration console in a fortnight. Also: Qilin ransomware riding an old Palo Alto VPN bug, UK regulators take direct oversight of AWS, Google, Microsoft and Oracle, and a security vendor's own npm package gets backdoored. 27 JUL A mislabelled maintenance job, and the outage it exported to Britain A routine network change in a Microsoft datacentre in California took Teams, Outlook and SharePoint offline for UK businesses for hours, with no attacker involved. Plus a critical Check Point firewall bypass, an AI model that accidentally hacked Hugging Face during a safety test, and a supply chain attack that exposes the limits of npm provenance. 24 JUL The Zimbra bug that needed no click, and the year it went unpatched The NCSC and international partners this week named LAUNDRY BEAR's year-long, zero-click Zimbra email theft campaign. Also: an OpenAI agent broke out of a test sandbox to hack Hugging Face, a China-nexus group was exposed by its own open cloud directory, and the US turned to visa restrictions against cybercrime networks. 23 JUL A capacity limit in Frankfurt, and the National Lottery it took offline A single capacity limit in one AWS availability zone in Frankfurt took the UK National Lottery, Hugging Face and university coursework platforms offline for three and a half hours, without a single attacker involved. Also this week: Stadler Rail's ransomware breach came through a supplier's platform, and a UK bill would make that everyone's problem to manage in advance. 17 JUL Two SonicWall flaws became one breach, and the cloud giants come under new watch Two chained SonicWall SMA1000 zero-days show why a gateway mixing a public interface with a privileged console is one bug from full compromise, just as UK financial regulators start directly overseeing AWS, Google, Microsoft and Oracle. Also: an unpatched Claude for Chrome flaw and a ransomware run completed in under 24 hours. 16 JUL The National Risk Register grows seven cyber scenarios, one borrowed from CrowdStrike The UK's National Risk Register now names AI-enabled cyber attacks on water, policing and datacentres, borrowing a lesson from the 2024 CrowdStrike outage. Also this week: financial regulators start directly overseeing AWS, Microsoft, Google and Oracle, a critical unauthenticated Oracle flaw joins the exploited list, and AI moves from assisting attacks to running them. 15 JUL A trusted GitHub workflow, and the three million downloads it poisoned A GitHub Actions misconfiguration let an attacker backdoor npm packages downloaded three million times a week, no zero-day required. Also this week: the UK puts Microsoft, Google, AWS and Oracle under direct financial oversight, SonicWall's SMA1000 zero-days get a CISA deadline, and Microsoft maps a year of Salesforce OAuth abuse. 15 JUL The AD FS zero-day hiding inside a record Patch Tuesday Microsoft's biggest-ever Patch Tuesday fixed two zero-days already under attack, and the one in AD FS matters more than the one in SharePoint. Also: an unconfirmed ransomware claim against Arm, the Bank of England's new oversight of AWS, Azure, Google Cloud and Oracle, and the UK's under-16s social media law. 2 JUL The quiet shift to sovereign hosting Why more organisations are moving critical systems off the hyperscalers and away from a single Microsoft dependency, and what sovereign actually has to mean.