SOC status:Duty analyst on shift
Insights
Research, detection engineering notes and plain-English explanations for the questions UK boards, IT managers and security leads actually ask. One substantial piece a week; a short threat brief in between.
Get the fortnightly briefing
The R&D and DIB vertical continues to sit at the highest strategic threat level of any of the covered verticals, with the dominant threat being long-dwell espionage from China-nexus and DPRK-nexus actors.
Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediation deadline; the continued tail of CitrixBleed 3 session-token abuse against NetScaler estates…
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659, sustained credential-stuffing volumes against member portals, and the continuing baseline of BEC / invoice-redirect fraud against trade-body finance functions.
Coverage this period is dominated by the NCA arrests on 30 Jun 2026 of four UK nationals connected to the M&S / Co-op / Harrods DragonForce / Scattered Spider cluster, the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE)…
Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant given the prevalence of SharePoint document management across shipping agents, brokers…
Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant for the legal sector given the near-ubiquity of SharePoint and iManage for matter files, trust-account documentation…
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE), continued long-tail impact of the Synnovis / Qilin June 2024 attack on NHS South East London, and sustained ransomware activity by Qilin against healthcare-adjacent targets.
Coverage this period is dominated by the CISA KEV addition of the SharePoint deserialisation defect (CVE-2026-45659) on 01 Jul with a three-day federal remediation deadline; the continued tail of CitrixBleed 3 session-token abuse against NetScaler estates…
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 - a significant risk given the prevalence of SharePoint in classified-adjacent document management - and by continuing PRC state-sponsored activity attributable to Salt Typhoon and Volt Typhoon.
The collection picture this period is dominated by sustained state-aligned interest in trade bodies and policy-influence organisations (Mustang Panda and APT28 both remain active against this vertical), the edge-appliance exposure introduced by the 23 June Ubiquiti UniFi OS KEV addition…
The dominant theme this period is the continuing operational dominance of the DragonForce / Scattered Spider cluster against UK retail - its 2025 M&S…
The dominant theme this week is exposure of OT bridge devices following CISA's 23 June addition of CVE-2025-67038 (Lantronix EDS5000 serial-to-IP code injection) to the Known Exploited Vulnerabilities catalogue - this is operationally critical to the maritime vertical because Lantronix devices are…
229 articles · page 4 of 20