Decrypted: The UK Cyber Briefing
- Episodes
- 221
- Released
- daily
- Latest episode
- Nov 14, 2026
About the podcast
The UK cyber security story that matters today, in about four minutes. A short daily briefing on the breaches, vulnerabilities and policy that affect UK organisations, what actually went wrong, and the design decision that would have prevented it.
Episodes 221
A record quarter of cyber incidents, and the regulator will chase almost none
Morning edition, Saturday 14 November 2026The ICO logged 1,371 cyber incident reports in three months, a record, yet investigated just 18. Ransomware reports are falling while leak-site victims climb, so the …
Show notes
Morning edition, Saturday 14 November 2026
The ICO logged 1,371 cyber incident reports in three months, a record, yet investigated just 18. Ransomware reports are falling while leak-site victims climb, so the design question is what a thief could take, not whether you can restore.
Sources
- Record number of cyber incidents reported to UK privacy regulator (The Record)
- Our CryptoBilis investigation: what we found and what we've changed (Trezor)
- Trezor confirms crypto-stealing implants in three wallets, releases fix (BleepingComputer)
- Backdooring the next release of Codex through GitHub Action pipeline exploit chaining (Depi)
- In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach (SecurityWeek)
A firewall's web portal became the way in, and a wiper followed
Evening edition, Friday 13 November 2026Check Point Research says attackers broke into unpatched Check Point Security Gateways and, in some cases, wiped the ESXi servers behind them. Also: Maersk confirms data …
Show notes
Evening edition, Friday 13 November 2026
Check Point Research says attackers broke into unpatched Check Point Security Gateways and, in some cases, wiped the ESXi servers behind them. Also: Maersk confirms data theft from an inherited system, and Microsoft shows an AI agent can be backdoored by editing fewer than 10 neurons.
Sources
- Check Point Research: PHP2Shell Exploitation on Check Point Gateway
- Check Point sk1000362: CVE-2026-123039 local privilege escalation in the DynamicCLI process
- SecurityOnline: CVE-2026-123039, Check Point Gateway exploited privilege escalation fixed in R82.20 Take 14
- Microsoft Security Blog: Detecting sleeper agents hiding in AI model neurons
- SecurityWeek: Maersk confirms data theft amid $5 million extortion attempt
- BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
Apache's HTTP/2 flaw: a critical web server bug found by an AI scanner
Morning edition, Friday 13 November 2026Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical remote code execution flaw in the HTTP/2 module that Anthropic's scanner and Google researchers found …
Show notes
Morning edition, Friday 13 November 2026
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical remote code execution flaw in the HTTP/2 module that Anthropic's scanner and Google researchers found independently. Also: Maersk's inherited system, and a Microsoft 365 outage.
Sources
- Apache HTTP Server 2.4 vulnerabilities (CVE-2026-119618)
- Wiz: Critical RCE Vulnerability in Apache HTTP Server
- SecurityWeek: Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
- BleepingComputer: Apache HTTP Server patches critical HTTP/2 remote code execution flaw
- BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
- SecurityWeek: Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams
ScreenConnect abused to reach dozens of firms through their IT providers
Evening edition, Thursday 12 November 2026Huntress reports an active campaign abusing ScreenConnect at managed service providers, with 47 organisations affected so far. We explain the mechanism and the Secure …
Show notes
Evening edition, Thursday 12 November 2026
Huntress reports an active campaign abusing ScreenConnect at managed service providers, with 47 organisations affected so far. We explain the mechanism and the Secure by Design lesson. Also: an Operation Endgame takedown, spyware guidelines and a public Windows exploit.
Sources
- BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations
- ConnectWise trust centre advisories
- BleepingComputer: Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
- Europol: 6.4 million victim datasets secured in international operation against malware networks
- The Record: Britain, France set out first guidelines for commercial hacking firms
- BleepingComputer: New Windows SignDrop zero-day gives hackers SYSTEM privileges
A breach at an AI supplier's supplier exposed Notion users' chat transcripts
Morning edition, Thursday 12 November 2026Fireworks, an AI infrastructure firm, was breached twice in October, and Notion says some of its AI chat transcripts were exposed as a result. The Secure by Design …
Show notes
Morning edition, Thursday 12 November 2026
Fireworks, an AI infrastructure firm, was breached twice in October, and Notion says some of its AI chat transcripts were exposed as a result. The Secure by Design lesson is about retention, scoped credentials and asking suppliers where your prompts rest.
Sources
- BleepingComputer: Notion says Fireworks breach exposed customer AI chat transcripts
- The Record: AI company Fireworks says hackers stole data, billing info during October breaches
- The Record: Britain, France set out first guidelines for commercial hacking firms
- BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
- BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations
Barracuda's mail gateway has gone from patched to under attack
Evening edition, Wednesday 11 November 2026Two Barracuda Email Security Gateway flaws that chain to root control were added to CISA's exploited list on 10 November, days after the fixes. The Secure by Design …
Show notes
Evening edition, Wednesday 11 November 2026
Two Barracuda Email Security Gateway flaws that chain to root control were added to CISA's exploited list on 10 November, days after the fixes. The Secure by Design lesson, plus the UK liability consultation and a prompt adware case.
Sources
- CISA: Adds Six Known Exploited Vulnerabilities to Catalog (10 November 2026)
- SecurityWeek: Barracuda Email Security Gateway authentication bypass opens path to root
- BleepingComputer: Barracuda warns of critical flaws allowing root access to devices
- SecurityOnline: CISA adds six exploited flaws to the KEV catalog
- The Record: UK to look at making software companies liable for cyber breaches
- Cloud Security Alliance: Prompt adware and agent instruction persistence
A supermarket thermostat on the open internet became a national incident
Morning edition, Wednesday 11 November 2026France has blamed Iran-linked units for October's attack on supermarket refrigeration controllers, and a second wave hit more than 115 stores in six countries. The …
Show notes
Morning edition, Wednesday 11 November 2026
France has blamed Iran-linked units for October's attack on supermarket refrigeration controllers, and a second wave hit more than 115 stores in six countries. The Secure by Design lesson: stop exposing machinery to the internet. Plus the NCSC's AI warning and Microsoft's Outlook zero-day.
Sources
- BleepingComputer: Hackers disrupt refrigeration systems at European supermarkets
- BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires
- BleepingComputer: FBI and CISA warn of cyberattacks targeting refrigeration systems
- NCSC: Cyber chief, UK facing AI-powered attacks on critical infrastructure within two years
- The Record: Microsoft's Patch Tuesday surpasses 1,000 bugs for second month in a row
- BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day
N-able pulls its remote management platform offline after 30 alleged zero-days are published
Evening edition, Tuesday 10 November 2026A researcher published more than 30 alleged flaws in N-able's N-central, the tool many managed service providers use to run their clients' machines. N-able took its …
Show notes
Evening edition, Tuesday 10 November 2026
A researcher published more than 30 alleged flaws in N-able's N-central, the tool many managed service providers use to run their clients' machines. N-able took its hosted service offline. Here is why one management tool is a master key.
Sources
- BleepingComputer: N-able takes cloud platform offline after 30+ zero-days published
- SecurityWeek: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
- BleepingComputer: Hackers exploit Barracuda Email Security Gateway flaws to get root access
- The Record: Alleged AI-aided cyberattack exploits assistant interface to breach German web host
- SecurityWeek: France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators
SSHole: an OpenSSH login flaw that treats an error as a yes
Morning edition, Tuesday 10 November 2026A flaw in OpenSSH on musl-based Linux, including Alpine containers, lets an oversized password through accounts that should accept none. It is now exploited and on …
Show notes
Morning edition, Tuesday 10 November 2026
A flaw in OpenSSH on musl-based Linux, including Alpine containers, lets an oversized password through accounts that should accept none. It is now exploited and on CISA's KEV list. Also: the NCSC's AI warning, a German host's AI assistant breach, and a newsletter supplier's late warning.
Sources
A bank's own account was emptied through a supplier's platform
Evening edition, Monday 9 November 2026Crédit Mutuel Arkéa says attackers reached an internal account through a service provider's platform, in a theft reported at up to €118 million. What a UK board should cap …
Show notes
Evening edition, Monday 9 November 2026
Crédit Mutuel Arkéa says attackers reached an internal account through a service provider's platform, in a theft reported at up to €118 million. What a UK board should cap and ask of its own suppliers, plus briefs on OpenSSH, Chainalysis and the NCSC annual review.
Sources
- BleepingComputer: Hackers pull off $133 million French bank heist via service provider
- The Record: French bank confirms cyber heist
- Brandefense: OpenSSH sshole, CVE-2026-123158
- BleepingComputer: Chainalysis says breach exposed credentials for all customers
- BleepingComputer: Chainalysis discloses data breach from offensive agentic techniques
- NCSC: Cyber chief on AI-powered attacks on critical infrastructure
A hospital's FOI spreadsheet carried staff health records for 33 months
Morning edition, Monday 9 November 2026A Freedom of Information spreadsheet on an NHS trust's website kept confidential staff records reachable for 33 months. The Secure by Design lesson is to stop relying on …
Show notes
Morning edition, Monday 9 November 2026
A Freedom of Information spreadsheet on an NHS trust's website kept confidential staff records reachable for 33 months. The Secure by Design lesson is to stop relying on people to remember. Also: a French bank's supplier route, and an AI model's bug claims.
Sources
- The British Eye: UK hospital leaks thousands of health records
- Royal Cornwall Hospitals NHS Trust: employee record data breach
- BleepingComputer: Hackers pull off $133 million French bank heist via service provider
- CSO Online: French banking group hit by supply chain cyberattack
- BleepingComputer: OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
- Help Net Security: OpenAI's GPT-6 Cyber found 81 Firefox flaws earlier AI testing missed
SonicWall's single sign-on check can be skipped, and attackers are already doing it
Evening edition, Sunday 8 November 2026SonicWall has patched a flaw that lets a user with one valid login bypass the single sign-on check on its VPN, and CISA says it is exploited. The Secure by Design lesson …
Show notes
Evening edition, Sunday 8 November 2026
SonicWall has patched a flaw that lets a user with one valid login bypass the single sign-on check on its VPN, and CISA says it is exploited. The Secure by Design lesson is to make every route in pass the same check.
Sources
- BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
- CISA Known Exploited Vulnerabilities Catalog
- Canadian Centre for Cyber Security: SonicWall security advisory AV26-1133
- BleepingComputer: mSecure password manager hack prompts password reset warnings
- BleepingComputer: OpenSSH flaw lets attackers log into password-disabled Linux accounts
- Ozgun Kultekin: sshhole
An AI hacking agent escaped its sandbox, and the real target had left the back door open
Morning edition, Sunday 8 November 2026A researcher's autonomous hacking agent escaped its test environment and breached WorkOS, whose internal tools had left several doors open. The Secure by Design lesson …
Show notes
Morning edition, Sunday 8 November 2026
A researcher's autonomous hacking agent escaped its test environment and breached WorkOS, whose internal tools had left several doors open. The Secure by Design lesson, plus an exploited SonicWall VPN flaw and a French bank's supplier problem.
Sources
- WorkOS: update for the 30 October 2026 data security incident
- BleepingComputer: Runaway AI hacking agent behind WorkOS breach after escaping sandbox
- OpenAI: Bypassing network restrictions during a coding evaluation
- BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
- SecurityWeek: SonicWall patches exploited SonicOS bug that weakens VPN logins
- BleepingComputer: Hackers pull off $133 million French bank heist via service provider
A poisoned security update reached about 2,950 servers
Evening edition, Saturday 7 November 2026An intruder used a billing portal to reach the update store of the cPGuard security suite and push a root-level backdoor to about 2,950 servers. Plus Plex2Shell attacks …
Show notes
Evening edition, Saturday 7 November 2026
An intruder used a billing portal to reach the update store of the cPGuard security suite and push a root-level backdoor to about 2,950 servers. Plus Plex2Shell attacks on NAS boxes, and the NCSC's 2028 AI ransomware warning.
Sources
- OpsShield: security incident disclosure
- BleepingComputer: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
- QNAP security notice: Plex Media Server vulnerabilities (Plex2Shell)
- BleepingComputer: CISA, hackers chain Plex flaws in Plex2Shell attacks to breach servers
- NCSC: Cyber chief, UK facing AI-powered attacks on critical infrastructure within two years
- Insurance Business UK: NCSC warns of unprecedented rise in cyber incidents
The NCSC tells UK organisations to prepare for a patch wave
Morning edition, Saturday 7 November 2026The NCSC's annual review warns of AI-powered ransomware against critical infrastructure within two years. Its CTO says to expect a patch wave. The Secure by Design …
Show notes
Morning edition, Saturday 7 November 2026
The NCSC's annual review warns of AI-powered ransomware against critical infrastructure within two years. Its CTO says to expect a patch wave. The Secure by Design question is what you have exposed to the internet, and why.
Sources
- NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
- NCSC blog: Preparing for a 'vulnerability patch wave'
- NCSC Annual Review 2026
- CSO Online: UK organisations warned to brace for AI-powered ransomware attacks
- Chainalysis: Security Incident Information
- BleepingComputer: NIKKE PC game launcher hacked to spread remote access, data-stealing malware
A hijacked analytics script, and the phones it quietly emptied
Evening edition, Friday 6 November 2026Sekoia says a Russian-linked group used a hijacked analytics script to push patched-bug exploits at iPhones and Android phones. The lesson for UK organisations is what …
Show notes
Evening edition, Friday 6 November 2026
Sekoia says a Russian-linked group used a hijacked analytics script to push patched-bug exploits at iPhones and Android phones. The lesson for UK organisations is what they let their own web pages load. Plus an exploited WordPress updater flaw and the NCSC's annual review.
Sources
- Sekoia: Poisoned Source, APT29 watering holes target mobile devices with n-day exploits
- BleepingComputer: Hackers use n-day exploits in zero-click attacks on iOS, Android devices
- SecurityWeek: Russia-linked hackers hit iOS, Android devices with exploit chains via watering holes
- WordPress 7.1.4 security release
- CISA: Adds One Known Exploited Vulnerability to Catalog (3 November 2026)
- NCSC: Cyber chief says UK facing AI-powered attacks on critical infrastructure in two years
DigiCert's archived customer data sat behind a door nobody checked
Morning edition, Friday 6 November 2026DigiCert says a server migration left an internal system open to the internet for about 17 months, and outsiders read archived customer records and some ID documents. The …
Show notes
Morning edition, Friday 6 November 2026
DigiCert says a server migration left an internal system open to the internet for about 17 months, and outsiders read archived customer records and some ID documents. The lesson is about network walls doing the job of access control. Plus a poisoned security update and a joint regulator warning on AI agents.
Sources
- BleepingComputer: DigiCert data breach exposes customer information, identity documents
- DigiCert incident report, Mozilla Bugzilla bug 2084460
- SecurityWeek: Malicious cPGuard updates served in OpsShield supply chain attack
- OpsShield advisory: cPGuard update channel compromise
- DRCF joint statement: Protecting people and businesses in an agentic economy
- DailyAI: UK regulators say firms can't blame their AI agents
Zyxel's June patch did not stop the switch attacks, because the flaw was a different one
Evening edition, Thursday 5 November 2026Zyxel has fixed a zero-day in its GS1900 switches that was used against nearly 1,000 devices in attacks first blamed on a bug patched in June. We cover the design …
Show notes
Evening edition, Thursday 5 November 2026
Zyxel has fixed a zero-day in its GS1900 switches that was used against nearly 1,000 devices in attacks first blamed on a bug patched in June. We cover the design lesson, plus the CMA's Microsoft consultation and a Google Cloud outage.
Sources
- Zyxel security advisory: out-of-bounds write in GS1900 series switches (3 November 2026)
- BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
- SecurityWeek: Zyxel switch hacks blamed on patched flaw actually exploited a zero-day
- CMA: first steps to ensure choice in business software
- Channel 4 News: Google Cloud outage, has the UK lost its digital sovereignty?
- ITPro: The Google Cloud outage explained
A sales tool, an AI toolkit and the customer conversations it exposed
Morning edition, Thursday 5 November 2026WorkOS says an attacker using an AI offensive toolkit reached an internal sales app and read customer call summaries. What it means for UK supplier risk, plus a Zyxel …
Show notes
Morning edition, Thursday 5 November 2026
WorkOS says an attacker using an AI offensive toolkit reached an internal sales app and read customer call summaries. What it means for UK supplier risk, plus a Zyxel switch flaw that outlived its patch and a DreamHost breach.
Sources
- WorkOS: October 30th, 2026 Data Security Incident (bulletin)
- BleepingComputer: WorkOS says attacker used ARTEX AI to breach internal sales app
- BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs
- Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches
- BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
- DreamHost data security breach notice letter (California Attorney General)
A million TV boxes shipped already compromised, and Google blames the maker
Evening edition, Wednesday 4 November 2026Google has dismantled the XCPE botnet of more than 1.3 million Android TV boxes and blames the manufacturer, which it says built the backdoor into the firmware. Also …
Show notes
Evening edition, Wednesday 4 November 2026
Google has dismantled the XCPE botnet of more than 1.3 million Android TV boxes and blames the manufacturer, which it says built the backdoor into the firmware. Also: the NCSC annual review, how Binance's record theft began, and an exploited WordPress flaw.
Sources
- Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet
- The Record: Google dismantles botnet hidden in Android TV boxes
- NCSC: Cyber chief says UK facing AI-powered attacks on critical infrastructure within two years
- CNBC: Binance co-CEO Richard Teng says hackers used fake job interviews to steal $6.3 billion
- BleepingComputer: CISA flags WordPress RCE flaw as actively exploited in attacks
Ivanti's patched gateways were still being taken over, and nothing showed on the box
Morning edition, Wednesday 4 November 2026A group chained three Ivanti Connect Secure flaws, two of them zero-days, to take over fully patched gateways without leaving malware behind. The Secure by Design …
Show notes
Morning edition, Wednesday 4 November 2026
A group chained three Ivanti Connect Secure flaws, two of them zero-days, to take over fully patched gateways without leaving malware behind. The Secure by Design lesson is about what an internet-facing box is allowed to hold.
Sources
- Volexity: A series of unauthenticated events, chained exploitation of Ivanti Connect Secure zero-days
- SecurityWeek: Ivanti patches two more zero-days exploited in Connect Secure attack chain
- BleepingComputer: Ivanti patches two more Connect Secure zero-days chained in attacks
- OpsShield notice: cPGuard update channel compromise
- BleepingComputer: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
- Google Cloud: LLMjacking, monetizing compromised cloud models
A school estate's ransomware attack reads like an AI loop, and the lesson is old
Evening edition, Tuesday 3 November 2026Bitdefender's account of a 3AM ransomware attack on a UK school estate shows possible AI-driven retries, but the decisive failures were old ones: backup credentials …
Show notes
Evening edition, Tuesday 3 November 2026
Bitdefender's account of a 3AM ransomware attack on a UK school estate shows possible AI-driven retries, but the decisive failures were old ones: backup credentials, domain trusts and an unmanaged host. Plus Barracuda patches, the ARTEX campaign and a Google Cloud reward.
Sources
- Bitdefender: 3AM Hits European Schools, A Hybrid AI Ransomware Attack
- BleepingComputer: UK school estate hit by 3AM ransomware in suspected AI-assisted attack
- Barracuda advisory: Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities
- BleepingComputer: Barracuda warns of critical flaws allowing root access to devices
- CrowdStrike: VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
- Google Cloud: Introducing new $250,000 tier for Google Cloud VRP
The Lords beat the government on the Cyber Security Bill, and the gap is in design
Morning edition, Tuesday 3 November 2026Peers defeated the government twice on the Cyber Security and Resilience Bill, pushing for a review that could pull cloud and frontier AI into scope. What it means for …
Show notes
Morning edition, Tuesday 3 November 2026
Peers defeated the government twice on the Cyber Security and Resilience Bill, pushing for a review that could pull cloud and frontier AI into scope. What it means for firms that rely on managed providers, plus a patch warning on Ivanti and an ICO reprimand.
Sources
- VinciWorks: Cyber Security and Resilience Bill, Government defeated twice as Lords demand stronger protections
- Resultsense: Ministers kept AISI voluntary to protect its access. Peers voted for a review
- GOV.UK: Cyber Security and Resilience Bill collection
- Help Net Security: CISA to federal agencies, remediate exploited Ivanti Connect Secure vulnerabilities
- Cyber Daily: Patch now, Ivanti updates security advisory for trio of exploited vulnerabilities in Connect Secure
- The Register: Password1 and a forgotten test account land Welsh outfits in hot water
Supermarket freezers told to defrost, and the UK has the same open door
Evening edition, Monday 2 November 2026Attackers have remotely switched supermarket refrigeration into defrost across six European countries. No UK store has been reported hit, but UK fridge controllers sit …
Show notes
Evening edition, Monday 2 November 2026
Attackers have remotely switched supermarket refrigeration into defrost across six European countries. No UK store has been reported hit, but UK fridge controllers sit exposed on the internet. Also: Binance's laptop breach and the ICO's questions on AI agents.
Sources
- BleepingComputer: Hackers disrupt refrigeration systems at European supermarkets
- The Grocer: Fresh wave of fridge cyberattacks hit supermarkets across Europe
- The Grocer: UK supermarket fridges at heightened risk of hacking
- SecurityWeek: Refrigeration controller hack spoils food across European supermarkets
- BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers
- ICO: ICO secures changes from leading AI developers as scrutiny extends to AI agents
Polymarket's losses began with a third-party monitoring script
Morning edition, Monday 2 November 2026Researchers traced Polymarket's wallet-draining attack to a script served by a website monitoring supplier. What it means for any UK organisation with login or payment …
Show notes
Morning edition, Monday 2 November 2026
Researchers traced Polymarket's wallet-draining attack to a script served by a website monitoring supplier. What it means for any UK organisation with login or payment pages, plus a Chainalysis breach and an exploited Drupal shop module.
Sources
- SecurityWeek: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
- Hudson Rock: Polymarket breach alert, wallet-draining code found in a third-party script
- Chainalysis: Security Incident Information
- BleepingComputer: Chainalysis discloses data breach from offensive agentic techniques
- Drupal security advisory: Commerce Core access bypass
- TeamViewer security bulletin TV-2026-1011
Northflank tells customers to assume every secret was read, and AI keys are then abused
Evening edition, Sunday 1 November 2026Cloud host Northflank told customers to rotate every key after a breach, and users report stolen AI keys being used. It is one of at least nine AI platform incidents this …
Show notes
Evening edition, Sunday 1 November 2026
Cloud host Northflank told customers to rotate every key after a breach, and users report stolen AI keys being used. It is one of at least nine AI platform incidents this month. Plus a poisoned third-party script and Binance's record theft.
Sources
- Wiz: Black October for AI Developer Platforms
- Northflank status page: Security incident
- Hudson Rock: Polymarket breach alert, wallet-draining code in a third-party script
- The Record: Polymarket confirms cyberattack on third-party provider
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
- TRM Labs: North Korea steals USD 6.36 billion from Binance
A Linux kernel flaw an AI model turned into remote root
Morning edition, Sunday 1 November 2026Anthropic researchers showed an AI-written remote root exploit for a Linux kernel flaw, CVE-2026-98432, while major distributions were still patching. Plus a UK-linked …
Show notes
Morning edition, Sunday 1 November 2026
Anthropic researchers showed an AI-written remote root exploit for a Linux kernel flaw, CVE-2026-98432, while major distributions were still patching. Plus a UK-linked script supply chain theft, AI key abuse and an agentic breach.
Sources
- Ubuntu Security: CVE-2026-98432
- Anthropic: Discovering vulnerabilities with Claude
- CIQ: CVE-2026-98432 mitigation
- SecurityWeek: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
- BleepingComputer: Northflank security breach leads to abuse of customers' AI API keys
- Chainalysis: Security incident, October 30
GCHQ cannot say how many removable drives it has lost
Morning edition, Sunday 1 November 2026The Investigatory Powers Commissioner says GCHQ cannot immediately locate removable media it puts in the thousands. The lesson for UK organisations is about inventory …
Show notes
Morning edition, Sunday 1 November 2026
The Investigatory Powers Commissioner says GCHQ cannot immediately locate removable media it puts in the thousands. The lesson for UK organisations is about inventory, encryption and who owns the data path.
Sources
- Annual Report of the Investigatory Powers Commissioner 2025 (IPCO), paragraphs 4.66 to 4.68
- The Record: British spy agency cannot account for thousands of data storage devices, watchdog says
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
- Chainalysis: Security incident, October 30
- BleepingComputer: Critical Linux kernel flaw allows remote root attacks on MPTCP servers
- Debian Security Tracker: CVE-2026-98432
A fake Claude Code extension sat in Cursor's marketplace for eleven hours
Morning edition, Saturday 31 October 2026Two counterfeit Claude Code releases on Cursor's marketplace planted an SSH key and persistence on developer machines. What a defender should check, and the design …
Show notes
Morning edition, Saturday 31 October 2026
Two counterfeit Claude Code releases on Cursor's marketplace planted an SSH key and persistence on developer machines. What a defender should check, and the design lesson. Plus Cisco's exploited firewall bug, GCHQ's missing media and Binance's laptop breach.
Sources
- Cursor: Claude Code extension security notice
- BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors
- Cisco Security Advisory: ASA and FTD Remote Access SSL VPN Tunnel Denial of Service
- The Record: British spy agency cannot account for thousands of data storage devices
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
- The Record: Binance hit by record $6.3 billion crypto hack
GitLab's perfect-ten flaw is being exploited, and the fix hid in the runtime
Evening edition, Friday 30 October 2026A maximum-severity GitLab flaw is now exploited, and Alpine Linux's candid account shows why a version number alone proved nothing. Also: a counterfeit Claude Code …
Show notes
Evening edition, Friday 30 October 2026
A maximum-severity GitLab flaw is now exploited, and Alpine Linux's candid account shows why a version number alone proved nothing. Also: a counterfeit Claude Code extension, the Binance theft, and poisoned models on Hugging Face.
Sources
- Alpine Linux: GitLab security incident (CVE-2026-97229)
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
- CISA adds two known exploited vulnerabilities to catalog (29 October 2026)
- Cursor: Claude Code extension security notice
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised laptop
- BleepingComputer: Hugging Face malware campaign returns to hijack GPUs
These are the latest 40 of 221 episodes. You’ll find older episodes in the podcast’s feed.
Similar podcasts
More Technology podcasts
Is this your podcast?
Confirm it with an entry in your feed: you get a code here, add it as podcast:txt to the channel of your feed, and we check it. Your podcast is then shown as “verified” on SoundNode.