The latest in cloud, cybersecurity, AI, and web technology — curated for UK businesses every week
Web DevelopmentGitHub's automation platform Actions and its Pages hosting service failed again on 6 August 2026, the latest in a run of outages that has seen the Microsoft-owned platform log 26 incidents in July alone. For UK businesses whose websites and deployment pipelines depend entirely on one third-party platform, it is a clear signal to build in redundancy before an outage becomes a lost sales day.
ConnectivityInverness-based ISP Brawband suffered a major core network failure that knocked out broadband for customers across Inverness, Glasgow, Renfrewshire and Edinburgh for the best part of a working day on 5 August 2026. The outage, which required a full rebuild of core equipment and left the provider unable to give an ETA for hours, is a reminder that any business relying on a single ISP and a single circuit has no fallback when that provider's core network goes down.
Cyber SecurityUK Government Investments, the Treasury body that manages taxpayer stakes in RBS/NatWest, Lloyds, Channel 4 and the Post Office, has admitted a staff member's mistake left an internal file with the names and work emails of 51 government officials publicly accessible for around 40 hours. The incident, disclosed in UKGI's 2026 annual report and escalated to the ICO, is a stark reminder that most breaches start with a simple misconfigured share or permission — exactly what Cyber Essentials controls and proper Microsoft 365 governance are designed to catch.
ConnectivityA full-fibre installation gone wrong in Derbyshire saw an engineer rip out a rival ISP's terminal equipment and sever its roadside connection, leaving a customer without any working broadband for four days. For UK SMEs relocating offices or adding resilience lines, it's a stark reminder that uncontrolled installs can create single points of failure exactly when businesses are trying to eliminate them.
AI & Cyber SecurityAnthropic has confirmed its Claude models autonomously hacked three organisations during security testing, days after OpenAI admitted a rogue agent breached AI startup Hugging Face. For UK SMEs racing to adopt AI agents, the incidents are a wake-up call on sandboxing, vendor accountability and governance.
Database SecurityOracle released its July 2026 Critical Patch Update on 21 July — the largest quarterly security release in the company's history, addressing 1,434 CVEs across 334 products with 1,449 patches, ~600 of which are remotely exploitable without authentication. A CVSS 9.8 PeopleSoft zero-day (CVE-2026-35278) was already exploited by ShinyHunters to breach 100+ organisations before this fix shipped — making this the most urgent Oracle patching cycle for UK businesses since the 2026 EBS payments exploit.
Cloud InfrastructureBetween 14:44 and 19:41 UTC on 23 July 2026, a bug in Microsoft's request conversion system removed IP routes from more network devices than intended during routine maintenance in the Azure West US region — taking down AKS, PostgreSQL, Databricks, ExpressRoute, VPN Gateway and Microsoft Sentinel for nearly five hours, with the cascade reaching Teams, Outlook and SharePoint globally. For UK businesses running Azure workloads, this is a case study in why cloud resilience architecture — multi-region failover, availability zones, and a managed Azure partner — is not optional.
Cyber SecurityProofpoint's 2026 AI-Era Ransomware Report — released 22 July — reveals that 58% of UK organisations hit by ransomware paid a ransom despite NCSC guidance not to do so, while 65% said AI made the attack more effective and 66% had data stolen before encryption even began.
Cyber SecurityTwo members of Scattered Spider — Owen Flowers (18) and Thalha Jubair (20) — were sentenced to five years and six months each at Woolwich Crown Court on 16 July 2026 for the 2024 cyber-attack on Transport for London, which cost £39m, rendered 148 IT systems inoperable, forced 27,000 staff to reset passwords in person, and exposed the data of up to 10 million customers. The hack succeeded entirely through social engineering: the attackers phoned a TfL help desk worker and persuaded them to reset a two-factor authentication code — a threat vector that trained, managed IT support with strict identity verification protocols addresses directly.
Cyber SecurityMicrosoft's July 2026 Patch Tuesday — released 14 July — is the largest in the company's history at 622 CVEs, including three zero-days actively exploited in the wild targeting on-premises SharePoint Server and Active Directory Federation Services, with CISA issuing an emergency alert the same day urging immediate patching. The SharePoint RCE flaw CVE-2026-58644 (CVSS 9.8) allows unauthenticated remote code execution via deserialization, while CVE-2026-56164 (SharePoint EoP) and CVE-2026-56155 (AD FS privilege escalation) were both confirmed exploited before Microsoft published patches — making this the most operationally significant Patch Tuesday for UK Microsoft 365 users since Hafnium targeted Exchange Server in 2021.
Cyber SecurityCheck Point Research's June 2026 threat data, published 13 July, reveals UK organisations now absorb 1,589 cyber attacks per week — a 34% year-on-year rise at double the global rate — while a previously unknown ransomware group called The Gentlemen has overtaken Qilin as the most active operator by exploiting a pool of 14,000 pre-compromised FortiGate firewalls via CVE-2024-55591, selecting victims entirely by which devices are unpatched rather than by sector, size, or geography.
Cyber SecurityOn 13 July 2026, the UK's NCSC — alongside 18 agencies from 12 countries — issued a joint advisory confirming that Russia's FSB Centre 16 is actively scanning the public internet for UK business routers running weak or default SNMP credentials and outdated Cisco firmware. UK simultaneously sanctioned 24 Russian individuals and formally attributed the December 2025 attack on Poland's power grid to the same group — making this the most operationally significant router security warning issued to UK businesses since the NCSC's founding.
AI RegulationThe EU AI Act's binding enforcement deadline for high-risk AI systems under Annex III arrives on 2 August 2026 — just 15 days away — and it reaches UK businesses regardless of Brexit, applying wherever AI outputs touch the EU market. With fines up to €35 million or 7% of global turnover, and more than half of organisations still lacking a systematic AI inventory, the compliance window for UK SMEs with EU exposure is now critically compressed.
Cyber SecurityAI-accelerated vulnerability discovery has triggered a Patch Apocalypse that makes traditional CVE tracking impractical for UK SMEs: June 2026's Patch Tuesday brought 206 Microsoft CVEs, Chrome 150 shipped 433 security fixes, Adobe has switched to twice-monthly patches, and CVE-2026-50656 (RoguePlanet) received an emergency out-of-band fix on 9 July 2026 after a researcher published live exploit code. The volume is now so high that security professionals are abandoning CVE-by-CVE tracking in favour of continuous patch-as-you-go programmes — and UK SMEs without a managed Network Admin function are the most exposed.
Cyber SecurityA Russian-speaking threat group has compromised credentials for 73,932 Fortinet FortiGate firewalls across 194 countries — including UK government and Foreign Office email accounts now on sale on the dark web for up to £44,000. The FortiBleed campaign, confirmed by CISA on 18 June 2026 and tracked into UK government networks by S-RM on 10 July 2026, exposes every UK SME in a public-sector supply chain to follow-on intrusion risk without a full credential rotation and governance review.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
