Insights
Threats that matter.
Analysis of the vulnerabilities and threats affecting UK organisations, and what to do about them.
Vulnerability advisoryCritical
PHP2Shell:what to do now
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can let an attacker run code on a web server without logging in. What is affected, what has been seen so far and what to do.
Read the briefingPatch advisoryExploited
October Patch Tuesday:a record month
Microsoft fixed a record 1,413 vulnerabilities in October, including a Windows zero-day that attackers are already using. What it is and what to patch first.
Read the briefingThreat report
UK ransomware:what the latest numbers say
Ransomware attacks on UK organisations are rising fast, and the NCSC is handling four nationally significant incidents a week. The figures, and the question every board should be asking.
Read the briefingRegulation
Cyber Security and Resilience Bill:what is changing
The UK's update to the NIS Regulations is going through the House of Lords. It brings managed service providers into scope and introduces 24-hour incident reporting.
Read the briefing