Decrypted: The UK Cyber Briefing

Davinder Singh

The UK cyber security story that matters today, in about four minutes. A short daily briefing on the breaches, vulnerabilities and policy that affect UK organisations, what actually went wrong, and the design decision that would have prevented it.

  1. 1 hr ago

    One browser extension can take over the AI assistant built into your browser

    BragJack shows a single extension with two common permissions can hijack the AI assistants in Chrome, Edge, Comet, Opera Neon and Claude in Chrome. Plus two exploited Linux kernel flaws, and a North Korean fake-interview campaign that hit 30,000 devices.

    One browser extension can take over the AI assistant built into your browser

  2. 13 hr ago

    Microsoft fixed a maximum-severity Azure AI flaw and told customers to do nothing

    Microsoft has fixed a CVSS 10.0 missing-authentication flaw in Azure AI Foundry, with no customer action needed. That is convenient, but it leaves UK organisations trusting a vendor's word. Also: the EU KIDS Act, the Gyazo breach and four Linux root exploits.

    Microsoft fixed a maximum-severity Azure AI flaw and told customers to do nothing

  3. 1 day ago

    An AI agent hacked a company on its own, and the UK already wrote the fix · Brevo's stolen key turned a marketing widget into a malware delivery route

    Spain's data regulator has logged what it says is the first data breach carried out autonomously by an AI agent, a scenario the NCSC's agentic AI guidance already addresses. Plus: Check Point's VPN flaws move from patched to imminently exploited, and Ofcom admits it can't collect most of its Online Safety Act fines. Also: Brevo's earlier SSO problems were followed by a bigger incident: a stolen Cloudflare API key let attackers make Brevo scripts serve ClickFix malware from up to 100,000 sites. Plus a CVSS 10 Azure AI Foundry fix and a critical Check Point management flaw.

    An AI agent hacked a company on its own, and the UK already wrote the fix · Brevo's stolen key turned a marketing widget into a malware delivery route

  4. 2 days ago

    A forged token is all it takes to become admin on WSO2's gateway · Cisco's network gatekeeper let attackers in without a login

    A critical WSO2 API Manager flaw that lets attackers forge admin-level tokens is now being actively exploited, five months after it was patched. Also: the ICO becomes the Information Commission, and a Chinese-speaking group raids Gitea servers for source code. Also: Cisco confirmed active exploitation of a maximum-severity authentication bypass in Identity Services Engine, the network gatekeeper many large UK organisations rely on, with no workaround available. Also this week: Ofcom can't collect its own Online Safety Act fines, Parliament presses Anthropic and the UK's AI Security Institute over a model access row, and Thales launches a UK-only cloud HSM.

    A forged token is all it takes to become admin on WSO2's gateway · Cisco's network gatekeeper let attackers in without a login

  5. 3 days ago

    Ransomware gangs catch up with a VMware bug CISA flagged in August · Iran's spyware campaign starts with a chat, not an exploit

    CISA says ransomware crews have joined state-linked attackers exploiting an unauthenticated, critical VMware vCenter flaw first patched in July. Also this week: backdoors planted in JFrog Artifactory instances, and Apple's fight over a secret UK order to break iCloud encryption returns to the tribunal. Also: The NCSC, FBI and Dutch AIVD exposed CHOSEN BRICK, Iranian spyware that reaches UK-based dissidents and journalists through fake friendships rather than a technical flaw. Plus: active exploitation of a critical WSO2 API Manager bug and a zero-day backdooring Adobe Commerce stores.

    Ransomware gangs catch up with a VMware bug CISA flagged in August · Iran's spyware campaign starts with a chat, not an exploit

  6. 3 days ago

    Revolut handed over customer data because an email looked official · A crafted email is all it takes to root Cisco's mail gateway

    Revolut confirmed a breach after a criminal used a spoofed government agency email domain to request customer passports, selfies and financial records, no hacking involved. Plus: GOV.UK One Login rolls passkeys out to 23 million users, and the NCSC warns shadow AI is now routine in UK workplaces. Also: Cisco confirms active exploitation of a critical, unauthenticated SQL injection flaw in Secure Email Gateway that hands attackers root access via a single crafted email, with no workaround available. Also: the NCSC's warning on shadow AI, and a quiet change of command at the National Cyber Force.

    Revolut handed over customer data because an email looked official · A crafted email is all it takes to root Cisco's mail gateway

  7. 4 days ago

    The Check Point VPN flaws that haven't been exploited yet

    Check Point patched two 9.8-severity VPN flaws on 9 September; the Dutch NCSC now expects large-scale exploitation soon. Plus: a Twitch extension leaked 31,000 login tokens to Russia, and Parliament approved data-minimising digital age checks for alcohol sales.

    The Check Point VPN flaws that haven't been exploited yet

  8. 5 days ago

    Microsoft's Windows Defender patch didn't survive the week

    Microsoft patched a Windows Defender privilege escalation flaw this month; within days the researcher who found it published a working bypass called ShieldCrash. Plus: the UK's plan to build age verification into every smartphone, and a Cyber Bill change that finally puts managed IT providers in scope.

    Microsoft's Windows Defender patch didn't survive the week
See All (86)

About

The UK cyber security story that matters today, in about four minutes. A short daily briefing on the breaches, vulnerabilities and policy that affect UK organisations, what actually went wrong, and the design decision that would have prevented it.

Information