News

Reuters reports a suspected ShinyHunters member known as Rey was detained in Jordan and is helping the FBI. Here is what is confirmed, what is not, and what UK organisations …

A critical WordPress core flaw, CVE-2026-87902, was being probed by attackers hours after the 22 September patch. Here’s how it works and what to do now.

Kiteworks asked customers to power down for nine hours after a credible threat warning. Here’s a practical checklist for businesses that depend on any secure file-transfer platform.

Citrix’s confirmed active exploitation of an unauthenticated NetScaler exploit chain means patching alone isn’t enough. Here’s the case for treating it as a possible breach first.

Bitget says attackers exploited a third-party security product to steal high-level credentials and drain about $388 million. Here is what happened and what to test for.

Attackers used stolen staff passwords to take data on about 678,000 people and businesses from France’s tax agency. The ANSSI report shows what was missing, and what UK firms should …

Attackers used a Custom GPT on OpenAI’s own domain to push a fake ChatGPT and a ClickFix lure. Here is how the chain worked and what to check.

Sucuri has described a WordPress backdoor that hides in files, the database and shared memory, and restores itself after cleanup. Here is what it does and how to check for …

Fortinet has confirmed active exploitation of CVE-2026-104286, a CVSS 9.8 flaw in FortiMail. Here is what it does, who is affected and what to do before a fix reaches you.

The Trust Services Criteria never mention a pentest by name, yet auditors expect one for every SOC 2 report. Here is what actually drives that expectation.