Threat Analysis : Cyber News for Small Business

The Small Business Cyber Security Guy
  • 0.0 (0)
  • Management
  • Updated Daily

Threat Analysis is the daily cyber security briefing for people who are tired of corporate fog, vendor panic, and security theatre dressed up as strategy. Hosted by Mauven MacLeod, it cuts through the noise around cyber threats, ransomware, data breaches, regulation, supply chain risk, and the latest bright idea from people who think a dashboard is the same thing as resilience. Every weekday, Mauven looks at what happened, why it matters, who should be paying attention, and what small and medium sized businesses should do before the mess arrives with a press statement and a very expensive consultant. This is not fear mongering. It is not a product pitch. It is not another cosy chat about awareness while the back door is hanging off its hinges. It is sharp, practical threat analysis with a dry edge, a raised eyebrow, and very little patience for nonsense. You will get clear context, useful actions, and the occasional reminder that cyber security is not magic. It is governance, discipline, evidence, and doing the basics before reality applies a boot to the backside. Threat Analysis is part of The Small Business Cyber Security Guy network.

  1. 18h ago

    Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs

    Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs Two urgent threats sit at opposite ends of the visibility spectrum today. First, the NCSC has issued a critical alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both scoring 9.4 CVSS with public exploit code already circulating. With most UK small business websites running PHP through WordPress, WooCommerce, Magento or custom applications, this is not a comfortable two-week patching window. Remote code execution risks extend well beyond website defacement to encompass customer databases, GDPR exposure and credential compromise. Second, the Wazza phishing kit is actively targeting Microsoft 365 accounts through a sophisticated device code authentication attack that bypasses MFA. By routing through legitimate infrastructure including Google Sites and Cloudflare Workers, the campaign exploits trusted platforms to make malicious traffic indistinguishable from normal business operations. The attack leverages social engineering to trick victims into completing an MFA flow that authenticates the attacker’s session rather than their own. Cisco Talos and Wiz research confirms this is part of a broader pattern of abusing legitimate platforms across more than 25 services. UK small businesses need to verify PHP patching status today, restrict device code authentication in Microsoft 365 tenants through Conditional Access policies, and ensure finance teams understand what device code phishing looks like. Also covered: a reminder on the AOMEI Backupper supply chain compromise affecting updates between April and July 2026. Chapters Introduction Overview of today’s two threats: a loud, technical PHP vulnerability with available patches, and a quiet, sophisticated phishing campaign engineered to appear legitimate. Both affect UK small businesses directly with actionable steps available today. Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 NCSC urgent alert on two critical PHP vulnerabilities scoring 9.4 CVSS with proof-of-concept exploits already circulating. Affects most UK business websites running WordPress, WooCommerce, Magento, Laravel, Symfony and Drupal. Remote code execution risks extend to databases, customer records and GDPR exposure. Four immediate actions: verify PHP version with hosting provider in writing, prioritise internal PHP systems, check WAF rule deployment, and review hosting contracts for update control. Call to Action Encouragement to follow the show and share with colleagues who need threat intelligence. The Wazza Phishing Kit and Microsoft 365 Sophisticated phishing campaign active since July 2026 targeting Microsoft 365 through device code authentication. Originates from compromised legitimate accounts, routes through trusted platforms like Google Sites and Cloudflare Workers to bypass security filters. Exploits legitimate Microsoft device code flow to obtain authentication tokens after victim completes MFA, effectively bypassing multi-factor authentication through social engineering. Cisco Talos documents abuse of 25+ legitimate platforms. Wiz research shows similar patterns in Google Cloud environments. Requires restricting device code authentication through Conditional Access policies and targeted staff awareness about unexpected authentication prompts. AOMEI Backupper Supply Chain Reminder Brief reminder of yesterday’s coverage on AOMEI Backupper supply chain compromise between April and July 2026. Three separate windows where attackers modified download instructions to deliver malware, with the longest window lasting ten minutes. Affects backup software used by over 100 million users worldwide, commonly deployed by UK small businesses. Requires verification of whether the software was updated during the compromise window and endpoint review if so. Conclusion and Action Items Three immediate actions: contact hosting provider to verify PHP patching status in writing, confirm device code authentication is restricted in Microsoft 365 tenant, and flag AOMEI Backupper for review if updated between April and July 2026. All require a phone call or email today rather than budget. Links https://www.ncsc.gov.uk/ https://isc.sans.edu/ https://www.php.net/ https://www.levelblue.com/ https://blog.talosintelligence.com/ https://www.wiz.io/

  2. 1d ago

    AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach

    AOMEI Supply Chain Attack, NetScaler Exploitation, and Password1 Breach Three recent incidents expose fundamental gaps in UK business security practice. AOMEI Backupper, backup software deployed across millions of systems, suffered a supply chain compromise between April and July 2026 when attackers tampered with update infrastructure during brief windows, delivering remote access backdoors to users who triggered legitimate update checks. Citrix NetScaler devices face active exploitation of CVE-2026-88771, a critical remote code execution vulnerability with no workaround, as attackers deploy web shells and chain additional vulnerabilities for persistent access. The ICO has issued reprimands to two Welsh organisations following a ransomware breach affecting 3,300 people, predominantly children, after attackers gained entry through a forgotten test account secured with the password Password1. Additional reporting covers the compromise of a Microsoft 365 API credential belonging to ConnectWise Cloud Backup, which enabled automated bulk access across hundreds of customer tenants. The briefing provides actionable guidance for checking AOMEI exposure, confirming NetScaler patch status, auditing dormant accounts, and interrogating MSP access logging. None of these failures required sophisticated attack techniques. All map to existing NCSC guidance that remains unimplemented across UK SMB environments. Chapters Introduction Daily threat briefing for 20 October 2026 covering three incidents that map where UK businesses continue to leave security gaps: a supply chain attack in trusted backup software, critical network infrastructure exploitation, and a breach starting with a test account using Password1. AOMEI Backupper Supply Chain Compromise Attackers compromised AOMEI Backupper update infrastructure between April and July 2026, delivering malicious payloads during brief tampering windows. Over 100 million users worldwide, with significant UK SMB deployment. Guidance on checking for indicators of compromise and interrogating IT providers about exposure across their client base. Mid-Episode Call to Action Brief reminder to follow the show and share with business owners and IT managers. NetScaler Remote Code Execution CVE-2026-88771 Citrix NetScaler devices face active exploitation of a critical vulnerability with CVSS score 9.8. No workaround exists. Attackers deploy web shells and chain additional CVEs for persistence. Guidance on obtaining written confirmation of patch status from MSPs and understanding the absence of UK mandatory remediation deadlines. ICO Reprimands for Welsh Organisations ICO has issued reprimands to Ogi Networks and Data Cymru following a ransomware breach affecting approximately 3,300 people, predominantly children, after attackers accessed a forgotten test account with the password Password1. Guidance on auditing dormant accounts, enforcing password policies, and implementing multi-factor authentication. MSP Credential Exposure in Microsoft 365 Huntress research documents compromise of ConnectWise Cloud Backup Microsoft 365 API credential, enabling bulk automated access across hundreds of customer tenants. Guidance on interrogating MSPs about their credential hygiene, access logging, and exposure to this specific incident. Closing Summary Three immediate actions: check AOMEI Backupper installations against published indicators, obtain written confirmation of NetScaler patch status, and audit dormant and test accounts. All three failures map to existing guidance; the gap is implementation, not knowledge. Links https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-supply-chain-attack https://www.citrix.com/security/advisory/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.zscaler.com/blogs/security-research/netscaler-exploitation-analysis https://ico.org.uk/action-weve-taken/enforcement/ https://www.ncsc.gov.uk/guidance/supply-chain-security https://www.ncsc.gov.uk/guidance/password-policy https://www.huntress.com/blog/connectwise-cloud-backup-credential-compromise

  3. 2d ago

    ConnectWise Breach, NetScaler RCE, and the MSP Trust Problem

    ConnectWise Breach, NetScaler RCE, and the MSP Trust Problem On 15 October 2026, a threat actor authenticated to Microsoft Graph API using a compromised ConnectWise Cloud Backup vendor credential, gaining automated access to hundreds of customer Microsoft 365 tenants. Meanwhile, CVE-2026-88771, a critical remote code execution vulnerability in NetScaler Application Delivery Controller and Gateway, continues to be actively exploited with web shell deployment documented in the wild. This episode examines both incidents through the lens of supply-chain risk in managed service provider relationships. Mauven walks through the structural security implications of vendor-level service principals, the exploitation mechanics of the NetScaler vulnerability, and the practical steps UK small businesses should take to audit third-party access to their environments. Also covered: F5’s out-of-band patches for critical NGINX vulnerabilities. This is not theoretical exposure. These are active incidents requiring immediate response from businesses that rely on MSP-managed infrastructure. Chapters Intro Mauven opens the 19 October 2026 briefing with an urgent note for businesses using MSP relationships or Citrix VPN infrastructure. Two active, documented incidents require immediate attention. ConnectWise Supply-Chain Breach Hits M365 Tenants On 15 October, an attacker used a compromised ConnectWise Cloud Backup vendor credential to traverse hundreds of Microsoft 365 customer tenants via automated GUID-sorted enumeration. The incident exposes the structural risk of vendor-level service principals. Mauven details the authentication mechanics, the scope of exposure, and four actionable steps: confirm product use with your MSP, audit enterprise applications in Azure AD, check audit logs for IP 144.172.64.128, and demand written answers on credential rotation processes. CTA Follow the show and share this episode with anyone managing an MSP relationship or making patching decisions. NetScaler RCE CVE-2026-88771 Under Active Exploitation CVE-2026-88771, disclosed 27 September 2026, is a CVSS 9.8 remote code execution vulnerability in NetScaler ADC and Gateway. CISA has added it to the Known Exploited Vulnerabilities catalogue. Attackers are deploying web shells for persistent access. Mauven outlines patching priorities, the importance of pre-patch compromise review, and the need for written confirmation from MSPs managing NetScaler infrastructure. Critical NGINX Vulnerabilities Patched Out-of-Band F5 has released out-of-band patches for multiple critical NGINX vulnerabilities, including three enabling remote code execution. Businesses using managed hosting should confirm with providers that patches have been applied. The Pattern All three incidents share a common thread: the products and vendors between your business and the internet are part of your attack surface. NCSC guidance on supply-chain risk and third-party access controls exists but is inconsistently applied across the MSP industry. Outro Mauven closes with two priority questions for MSPs: what is connected to our Microsoft 365 tenancy and what permissions does it have, and have our NetScaler appliances been patched and reviewed for compromise. Written answers required. Links https://www.huntress.com/blog/connectwise-cloud-backup-breach https://www.ncsc.gov.uk/collection/supply-chain-security https://support.citrix.com/article/CTX626634 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.zscaler.com/blogs/security-research/netscaler-cve-2026-88771-exploitation-analysis https://www.f5.com/company/blog/security/nginx-out-of-band-security-patches https://www.bleepingcomputer.com/news/security/f5-nginx-vulnerabilities-patched-out-of-band/

  4. 5d ago

    Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel

    Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel On 16 October 2026, three active threat campaigns demand immediate attention from UK small businesses. First, a zero-day vulnerability in BeyondTrust Remote Support appliances (CVE-2026-102764) has been exploited since late August by ARMORY CASTLE, a suspected Chinese state-linked actor, targeting the IT provider supply chain. Second, an AI-orchestrated exploitation campaign against PaperCut print management software is operating automatically across 45-plus countries, representing a fundamental shift in attack velocity and scale. Third, DragonForce ransomware has evolved from opportunistic operation to sophisticated cartel offering white-label services, with affiliates exploiting vulnerabilities including the nearly five-year-old Log4Shell. A supplementary proxyjacking campaign (skynox-7) has compromised at least 143 network edge devices globally. The common thread: known vulnerabilities, unpatched systems, and IT tooling that business owners have never inventoried. All three campaigns are confirmed active, documented by Mandiant, Hunt.io, ReliaQuest, Bitsight, and GreyNoise. This briefing provides actionable guidance for businesses that may be exposed through their IT providers or their own infrastructure, with specific questions to ask and checks to run today. Chapters Introduction Overview of three confirmed, active threat campaigns directly relevant to UK small businesses: a zero-day in remote support software, an AI-orchestrated print management exploit, and a restructured ransomware cartel. ARMORY CASTLE BeyondTrust Zero-Day Exploitation Analysis of CVE-2026-102764, a zero-day in BeyondTrust Remote Support exploited by suspected Chinese state actor ARMORY CASTLE since late August 2026, including post-exploitation techniques and supply chain implications for businesses using managed IT providers. Mid-Episode Call to Action Invitation to follow the show and share with fellow business owners. AI-Orchestrated PaperCut Exploitation Campaign Examination of automated exploitation targeting PaperCut NG/MF print management software across 45-plus countries, using AI agents to execute attacks at unprecedented scale and speed, with implications for professional services and healthcare sectors. DragonForce Ransomware Cartel Evolution Assessment of DragonForce’s transformation from opportunistic ransomware operator to white-label cartel model, including exploitation of Log4Shell and other years-old vulnerabilities still present in UK business environments. Skynox-7 Network Edge Device Proxyjacking Brief on proxyjacking campaign compromising NAS, NVR, and DVR devices globally, turning business hardware into criminal proxy infrastructure through exploitation of known vulnerabilities and default credentials. Closing and Action Items Summary of common vulnerabilities across all campaigns and specific questions business owners should ask their IT providers immediately. Links https://www.beyondtrust.com/trust-center/security-advisories https://www.mandiant.com/resources/blog https://hunt.io/blog https://www.reliaquest.com/blog https://www.bitsight.com/blog https://www.greynoise.io/blog https://www.ncsc.gov.uk/guidance/patch-management

  5. 6d ago

    Ivanti Zero-Day Chain, FortiGate Implant, and Legal Aid Agency Breach

    Ivanti Zero-Day Chain, FortiGate Implant, and Legal Aid Agency Breach Three critical security incidents dominate today’s briefing. Ivanti Connect Secure VPN appliances face active exploitation through a three-vulnerability chain granting unauthenticated root access, with particular risk to managed service providers and their client bases. The PEERSTITCH implant campaign reveals how a 2024 FortiManager compromise led to persistent, memory-resident malware on hundreds of FortiGate firewalls, surviving standard detection methods. The Legal Aid Agency breach now confirms exfiltration of nearly 50 years of records, creating direct pretexting risks for legal services firms. Each incident exposes the gap between patching and verification, between logs that appear clean and systems that actually are clean. For small businesses relying on managed IT infrastructure, this episode provides specific questions to ask providers and concrete steps to verify security posture. The NCSC has also published updated guidance on post-quantum cryptography in TLS configurations, signalling the start of a multi-year migration that requires planning rather than crisis response. Chapters Introduction Overview of three major security incidents involving systems left open that shouldn’t have been, and the gap between official accounts and operational reality. Ivanti Connect Secure Zero-Day Chain Analysis of three chained zero-day vulnerabilities enabling unauthenticated root access to Ivanti VPN appliances, with particular focus on risks to managed service providers and their client bases. Includes specific verification steps for organisations and their IT providers. Listener Call to Action Brief reminder to follow the show and share with colleagues who need threat intelligence updates. PEERSTITCH FortiGate Implant Deep dive into a sophisticated intrusion campaign originating from a 2024 FortiManager compromise, leading to deployment of memory-resident malware on hundreds of managed FortiGate firewalls. Explains why standard compromise checks would have missed this threat and what verification steps are actually required. Legal Aid Agency Breach Examination of a breach affecting nearly 50 years of records, including probation service data, and the specific pretexting risks this creates for legal services firms and their clients. Covers verification procedures for firms handling legal aid cases. NCSC TLS Guidance Update Planning note on newly published NCSC guidance for post-quantum cryptography migration in TLS configurations, framed as a multi-year planning exercise rather than immediate crisis. Closing Remarks Summary emphasising the distinction between devices that appear secure and devices that actually are secure, and the importance of asking IT providers how they verify security rather than assuming it. Links https://www.ivanti.com/security https://www.paloaltonetworks.com/unit42 https://www.ncsc.gov.uk/guidance/using-tls-to-protect-data https://www.ncsc.gov.uk/guidance/post-quantum-cryptography

  6. Oct 14

    CoGUI Phishing Takedown, Ivanti Zero-Day, and Android Banking Malware

    CoGUI Phishing Takedown, Ivanti Zero-Day, and Android Banking Malware Today’s briefing examines a major phishing infrastructure disruption alongside active exploitation of a critical VPN vulnerability. Microsoft and law enforcement partners have taken down the CoGUI phishing-as-a-service operation responsible for over one billion malicious messages targeting 75,000 organisations across 150 countries, though operators remain at large. CISA has added an Ivanti Connect Secure zero-day to its Known Exploited Vulnerabilities catalogue, with confirmed active exploitation dating back to 1 October 2026. UK small businesses using managed service providers should verify their remote access infrastructure is patched immediately. The episode also covers a credential-harvesting campaign targeting WatchGuard VPN users through SEO poisoning, and new Android banking malware that replaces legitimate applications with compromised versions. Practical guidance focuses on credential phishing defences, VPN security verification, and mobile banking application hygiene for business users. Chapters Introduction Overview of a major phishing infrastructure takedown and an actively exploited Ivanti Connect Secure zero-day affecting remote access systems. The CoGUI Phishing Takedown Analysis of the disrupted phishing-as-a-service marketplace responsible for one billion malicious messages, why operators remaining at large matters, and a related WatchGuard VPN credential-harvesting campaign using SEO poisoning. Call to Action Listener engagement request to share the briefing with others who need threat intelligence. Ivanti Connect Secure Zero-Day Breakdown of the CISA-catalogued vulnerability with two weeks of confirmed exploitation before public disclosure, implications for managed service provider customers, and immediate patch verification requirements. Hirudo Android Malware New Android malware that replaces legitimate banking applications with modified versions, relevant to businesses conducting mobile banking operations. Closing Summary Recap of the day’s threat landscape: phishing infrastructure reconstitution risks, urgent Ivanti patching requirements, and defences against SEO-poisoned software downloads. Links https://www.bleepingcomputer.com/news/security/microsoft-disrupts-massive-phishing-as-a-service-operation/ https://blogs.microsoft.com/on-the-issues/2026/10/14/cogui-phishing-takedown-digital-crimes-unit/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.huntress.com/blog/watchguard-vpn-credential-phishing-campaign https://www.ncsc.gov.uk/guidance/phishing-resistant-authentication

  7. Oct 13

    Retail Breaches, NetScaler Zero-Days, and the Password That Exposed Denmark

    Retail Breaches, NetScaler Zero-Days, and the Password That Exposed Denmark In today’s briefing, we examine three incidents that reveal a troubling pattern: security failures that require no sophisticated adversary, only the absence of basic controls. TFG London, owner of Hobbs and Whistles, confirms a cyberattack that’s part of a wider autumn assault on UK retail. Two zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now, with webshells already deployed in production environments. In Denmark, a small IT firm’s use of the password ‘123456’ exposed personal data on 8.8 million people, nearly the entire population. We also cover internet-connected refrigeration system attacks in France and critical SAP vulnerabilities. The thread connecting these stories is not technical complexity but organisational failure to implement known protections. For UK SMBs, the lesson is clear: your risk often lives in the systems and suppliers you’re connected to, not just in your own infrastructure. This episode provides specific, actionable questions to ask your IT providers and MSPs today, because the gap between guidance and implementation remains dangerously wide. Chapters Introduction Mauven introduces three incidents requiring no sophisticated adversary, only the absence of action: a UK retail breach, actively exploited zero-days, and a catastrophic password failure in Denmark. UK Retail Hit Again: TFG London Confirms Cyberattack TFG London, parent of Hobbs and Whistles, confirms a cyberattack with systems offline and orders delayed. The incident fits a pattern of autumn attacks on UK retail. Businesses sharing supply chains, logistics platforms, or IT connections with affected retailers should review access logs and understand their exposure through shared infrastructure. Call to Action A reminder to follow the show and share it with others who need daily threat intelligence. NetScaler Zero-Days: Active Exploitation, Right Now Two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are under active exploitation. CVE-2026-88771 allows unauthenticated remote code execution with webshells already deployed. CVE-2026-88772 is a DTLS memory overflow enabling similar attacks. UK SMBs should ask MSPs and IT providers in writing whether they run affected NetScaler products and confirm patching status, treating silence as confirmation of risk. ‘123456’: The Password That Exposed 8.8 Million People A small Danish IT firm with access to Denmark’s civil register was breached via weak passwords, including ‘123456’, exposing data on 8.8 million people. UK businesses must conduct due diligence on data processors, require MFA on privileged accounts, and update data processor agreements to specify minimum security standards as required under UK GDPR. Today’s Wider Context: Refrigeration, SAP, and What Physical Systems Tell Us Attackers compromised internet-connected refrigeration systems at hundreds of French supermarkets by exploiting outdated firmware. SAP published October security updates addressing 20 vulnerabilities, including a maximum-severity flaw in Cloud SDK for Python. UK businesses should review building management system security and confirm SAP patching with their ERP providers. Conclusion The consistent pattern across today’s incidents is not technical sophistication but the gap between knowing security best practices and implementing them. UK SMBs should review supplier connections, particularly those established years ago, and start by asking one supplier with data access about MFA enforcement on privileged accounts. Links https://unit42.paloaltonetworks.com/netscaler-zero-day-vulnerabilities/ https://www.ncsc.gov.uk/collection/supply-chain-security https://www.ncsc.gov.uk/collection/supply-chain-security/supplier-assurance

  8. Oct 12

    GitLab Max-Severity RCE, JFrog Artifactory Backdoor, and Retail Supply Chain Disruption

    GitLab Max-Severity RCE, JFrog Artifactory Backdoor, and Retail Supply Chain Disruption Three critical incidents with direct supply chain implications dominate today’s threat landscape. GitLab has issued an emergency warning for a maximum-severity unauthenticated remote code execution vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching. Meanwhile, Wiz Research confirms active in-the-wild exploitation of three JFrog Artifactory vulnerabilities being chained to deploy a Rust-based backdoor with full administrative access. In the retail sector, Ahold Delhaize has taken systems offline following a cybersecurity incident, with potential knock-on effects for suppliers and logistics partners across Europe and North America. All three incidents highlight a common theme: attackers are targeting developer and software management infrastructure that often sits outside standard vulnerability management programmes. UK small businesses face indirect but material risk through their IT providers, MSPs, and software suppliers. The episode examines what these incidents mean for organisations without direct control over the affected infrastructure, and how to verify patching status and supply chain exposure when you rely on third parties for critical services. Chapters Introduction Opening summary of three supply chain-focused incidents requiring immediate attention, with emphasis on active targeting of software build infrastructure. GitLab Max-Severity RCE Emergency warning for unauthenticated remote code execution vulnerability in GitLab CI/CD Regular Expression Compiler. Explains CI/CD pipeline risk, the specific flaw, patching urgency, and how to verify MSP response. Call to Action Brief listener engagement prompt encouraging show following and sharing with colleagues and suppliers. JFrog Artifactory Active Exploitation Active in-the-wild exploitation of three chained JFrog Artifactory vulnerabilities deploying a Rust-based backdoor. Details the three-step attack chain, payload characteristics, and indirect supply chain exposure for UK SMBs. Ahold Delhaize Retail Incident Cybersecurity incident at major food retail group Ahold Delhaize prompts system shutdowns. Examines scale, containment measures, and knock-on effects for suppliers, logistics partners, and payment processors in the supply chain. The Wider Picture Analysis of NCSC external attack surface management consultation in context of today’s incidents. Highlights gap between standard vulnerability management and developer infrastructure, and the implications for UK SMBs relying on third-party providers. Closing Summary of supply chain attack concentration and advice on verifying patching evidence from IT providers rather than accepting assumptions. Links https://about.gitlab.com/releases/2026/10/12/security-release-gitlab-17-5-1-released/ https://www.wiz.io/blog/jfrog-artifactory-vulnerabilities-exploited-in-the-wild https://www.aholddelhaize.com/newsroom/2026/10/12/cybersecurity-incident/ https://www.ncsc.gov.uk/blog-post/external-attack-surface-management https://www.ncsc.gov.uk/collection/developers-collection/principles/protect-your-code-repository https://nvd.nist.gov/vuln/detail/CVE-2026-42016 https://nvd.nist.gov/vuln/detail/CVE-2026-42018 https://nvd.nist.gov/vuln/detail/CVE-2026-82329

See All (76)

About

Threat Analysis is the daily cyber security briefing for people who are tired of corporate fog, vendor panic, and security theatre dressed up as strategy. Hosted by Mauven MacLeod, it cuts through the noise around cyber threats, ransomware, data breaches, regulation, supply chain risk, and the latest bright idea from people who think a dashboard is the same thing as resilience. Every weekday, Mauven looks at what happened, why it matters, who should be paying attention, and what small and medium sized businesses should do before the mess arrives with a press statement and a very expensive consultant. This is not fear mongering. It is not a product pitch. It is not another cosy chat about awareness while the back door is hanging off its hinges. It is sharp, practical threat analysis with a dry edge, a raised eyebrow, and very little patience for nonsense. You will get clear context, useful actions, and the occasional reminder that cyber security is not magic. It is governance, discipline, evidence, and doing the basics before reality applies a boot to the backside. Threat Analysis is part of The Small Business Cyber Security Guy network.

Information