How attacks get in, and what to fix first
Breakdowns of this year's attacks and the flaws behind them, written for the person who has to decide what to fix on Monday, not for a procurement committee.
Attackers now use AI to find and weaponise exposed services faster than an annual test can keep up with. So everything here comes back to three questions: what did attackers actually exploit, is the same thing exposed on your network, and which fix matters most for Cyber Essentials and the controls your customers ask about.
Latest4 min read
Outdated or end of life? How to tell the two
"Out of date" covers two different problems: a missed patch and a release line nobody fixes any more. They fail differently, and they are fixed differently.
New4 min read
Know your site's stack, get the fix in a day
Most small sites are breached through software nobody remembered was there. How CyberSpec names your stack and emails what's new, with the fix, each day.
Vulnerability Management · Continuous Scanning · WordPress · Security Operations
New5 min read
AI cyber attacks and the shrinking patch window
AI is helping attackers turn fresh patches into working exploits faster. What the 2026 data shows, what it doesn't, and what a small UK firm should change.
AI Cyber Attacks · Vulnerability Exploitation · Patch Management · Cyber Essentials · Small Business Security
New6 min read
Edge device flaws exploited in October 2026
In three weeks CISA flagged exploited flaws in PAN-OS, Cisco's email gateway, Ivanti, FortiMail and BeyondTrust. The kit guarding the network was the way in.
Edge Devices · CISA KEV · CVE-2026-102764 · CVE-2026-0322 · CVE-2026-76519 · Patch Management
New6 min read
ASOS breach 2026: stopping staff impersonation
ASOS lost customer data to an attacker who impersonated a trusted contact. Here's how help-desk social engineering works, and the controls that break it.
Social Engineering · Data Breach · Help Desk Security · Multi-Factor Authentication · Cyber Essentials
New8 min read
How to improve cyber security: do these first
A priority order for UK small businesses, built on 2026's attacks and the Cyber Essentials controls: six actions, why each ranks where it does, how to check it.
Cyber Security · Small Business · Cyber Essentials · Patch Management · Attack Surface
New3 min read
Cyber Essentials vs Cyber Essentials Plus
Same five controls, different test. What Cyber Essentials Plus adds over the self-assessment, how to tell which one a contract wants, and when to book it.
Cyber Essentials · Compliance
New5 min read
Cyber Essentials checklist for 2026 (v3.3)
A control-by-control Cyber Essentials checklist built from the v3.3 requirements, with the password, MFA, patching and firewall numbers you need.
Cyber Essentials · Compliance · Patch Management
New5 min read
Cyber Essentials v3.3 (Danzell): what changed
From late October 2026 every Cyber Essentials assessment runs on v3.3. Two patching questions and cloud MFA became automatic fails. Here is the full list.
Cyber Essentials · Compliance · Patch Management
2 min read
Citrix underrated this NetScaler bug
CVE-2026-8452 shipped as a DoS fix in June. Researchers turned it into unauthenticated RCE in August, and attackers are now dropping web shells on it.
CVE-2026-8452 · Remote Code Execution · Edge Devices · Patch Management · Vulnerability Management
3 min read
End-of-life software fails Cyber Essentials
There's no scoring and no grace period. One end-of-life package on an in-scope device is an automatic Cyber Essentials fail, the day the vendor says so.
Cyber Essentials · Compliance · Patch Management · Vulnerability Management
3 min read
Authenticated vs unauthenticated scanning
One scan tells you what an outsider can reach. The other tells you what is installed. Swapping the two is how a finding list stops matching reality.
Vulnerability Management · Network Scanning · External Scanning · Patch Management
4 min read
Cyber Essentials: what the scan has to pass
The five controls are the paperwork. For Cyber Essentials Plus, an assessor scans your internet-facing addresses and one number decides the result.
Cyber Essentials · Compliance · Patch Management · External Scanning
3 min read
Subdomain takeover: the dangling DNS record
A CNAME outliving the service it pointed at is not a broken link. It is an unclaimed name on your domain that somebody else can register.
Attack Surface · DNS · Subdomain Takeover · Asset Discovery
2 min read
EPSS vs CVSS: which number sorts the queue
CVSS says how bad a vulnerability could be. EPSS estimates whether anyone will actually use it. They answer different questions.
EPSS · CVSS · Vulnerability Prioritisation · Patch Management
2 min read
PCI DSS 11.3.2: what ASV scanning requires
External scans every three months, from an Approved Scanning Vendor, with a passing result. Here is what each of those three constraints costs you.
PCI DSS · ASV Scanning · Compliance · External Scanning
2 min read
What counts as your external attack surface
It is never the list in your asset inventory. It is whatever answers on a public address today, including the things nobody remembers standing up.
Attack Surface · Asset Discovery · Shadow IT · External Scanning
2 min read
ISO 27001 A.8.8: what auditors ask to see
The control is four lines long. What an auditor wants is the record proving you followed it, and that is where most programmes come apart.
ISO 27001 · Compliance · Vulnerability Management · Annex A
2 min read
Ports that should never face the internet
RDP, database ports and container control planes end up publicly reachable the same handful of ways — almost never by decision.
Network Scanning · Attack Surface · Exposed Services · Port Scanning
2 min read
wp2shell: unauthenticated RCE in WordPress
CVE-2026-63030 chains a REST API batch-processing flaw with an SQL injection to mint an admin account. No credentials required.
WordPress · CVE-2026-63030 · Remote Code Execution · REST API · Web Application Security
2 min read
Patching SharePoint does not evict the intruder
The 2026 on-prem SharePoint exploit chain steals IIS machine keys. Patch, hunt, then rotate — in that order, or the attacker keeps their access.
SharePoint · CVE-2026-56164 · Machine Keys · Incident Response · Persistence
2 min read
The VPN flaw that skipped the login screen
CVE-2026-50751 lets an unauthenticated attacker forge IKEv1 auth flags and land inside the network. Four affected branches will never get a patch.
VPN Security · CVE-2026-50751 · Authentication Bypass · Edge Devices · Ransomware
2 min read
SOC 2 CC6.1: what logical access controls need
The control family shows up on every SOC 2 report. Here's what an auditor is actually checking for.
SOC 2 · Compliance · Access Control
2 min read
CVSS score alone is not a priority order
A 9.1 on an internal dev box and a 7.4 on your public API gateway are not the same problem.
CVSS · Triage · Vulnerability Management
2 min read
Why annual pentests miss what matters
A point-in-time assessment can only ever tell you about the point in time it ran. Here's what changes in the gap.
Penetration Testing · Continuous Scanning · Security Operations
