Weekly Updates

IT News & Updates

The latest in cloud, cybersecurity, AI, and web technology - curated for UK businesses every week

150
Articles
5
Categories
Weekly
New Content
100%
Free to Read
Showing 1–15 of 69 articles in Pen Testing
Hackers Set UK Food Industry Freezers to 150C - Why Any Connected Equipment Is a Target

Hackers Set UK Food Industry Freezers to 150C - Why Any Connected Equipment Is a Target

UK meat suppliers and a London fruit and vegetable wholesaler had their refrigeration units hijacked and set to defrost at up to 150C, a day after similar attacks hit supermarket cooling systems across seven European countries. One business only stopped the attack by physically unplugging its internet connection - a stark illustration of how internet-connected equipment with default passwords is becoming an easy target, even when the data behind it isn't valuable to the attacker.

O2 Rolls Out Free AI Scam Call Blocking as 61% of Brits Report Suspicious Calls

O2 Rolls Out Free AI Scam Call Blocking as 61% of Brits Report Suspicious Calls

O2 has rolled out free, AI-powered scam call blocking to all customers, expecting to stop over 3 million malicious calls a week in real time before they even ring. With VMO2's own data showing 61% of Brits who encountered a suspected scam this quarter said it came via a phone call, the upgrade is a reminder that voice remains one of the most exploited channels for targeting employees at UK businesses.

A UK Reseller's Website Was Skimming Card Data - How Small Online Stores Get Caught Out

A UK Reseller's Website Was Skimming Card Data - How Small Online Stores Get Caught Out

Shelly Store UK, an independent reseller of smart home equipment, has warned customers their payment data may be compromised after its payment provider Stripe flagged unauthorised software running on its website. One customer reported a fraudulent £221.28 charge from Australia hours before receiving the breach notification - a textbook case of web skimming malware, a threat that disproportionately hits small online retailers without dedicated security monitoring.

Ofcom Sets Out Age-Check Methods for the UK's Under-16 Social Media Ban - What It Means Beyond the Big Platforms

Ofcom Sets Out Age-Check Methods for the UK's Under-16 Social Media Ban - What It Means Beyond the Big Platforms

Ofcom has recommended four "highly effective" methods - photo ID matching, banking-based checks, facial age estimation and digital ID services - for verifying that social media users are over 16, ahead of the UK's under-16 ban coming into force in March 2027. With the responsibility for implementation placed squarely on platform providers rather than prescribed by the regulator, any UK business running a website or app that could plausibly be accessed by under-16s should be watching this closely.

An AI Agent Found 4 Critical Bugs in Industrial Control Software in Under 4 Hours - What It Means for OT Security

An AI Agent Found 4 Critical Bugs in Industrial Control Software in Under 4 Hours - What It Means for OT Security

An autonomous AI agent called Cipher independently discovered four previously unknown, severe vulnerabilities in EPICS, a widely used industrial control software toolkit, in just three hours and 49 minutes with almost no human guidance. The find, which triggered a CISA advisory, is the latest sign that AI is collapsing the time and expertise once needed to uncover weaknesses in operational technology - a trend that affects any UK business with industrial, building or manufacturing control systems, not just scientific facilities.

GitLab's Max-Severity Bug Has Been There for 12 Years - Why Self-Managed DevOps Tools Need the Same Urgency as Any Server

GitLab's Max-Severity Bug Has Been There for 12 Years - Why Self-Managed DevOps Tools Need the Same Urgency as Any Server

GitLab has patched a maximum-severity flaw that could let an unauthenticated attacker execute arbitrary code on self-managed servers, affecting every release back to GitLab 7.0 from June 2014. With no exploitation reported yet but a near-identical GitLab flaw battered by attackers within days of last month's patch, organisations running GitLab themselves - rather than the cloud-hosted version - have a narrow window to upgrade before scanning begins.

PHP2Shell: The Fixed Versions, the End-of-Life PHP Problem and the AI That Found It

PHP2Shell: The Fixed Versions, the End-of-Life PHP Problem and the AI That Found It

The exact PHP versions that fix PHP2Shell (8.5.12, 8.4.27, 8.3.36, 8.2.35), what to do if you're stuck on end-of-life PHP 8.1, 8.0, 7.4 or 5.x with no official release, why updating WordPress and plugins doesn't touch the bug, the limits of the partial mitigations, and how two AI-assisted research efforts at Calif and Wiz independently found the flaw.

Critical PHP Flaws Put Millions of Websites at Risk - ‘Patch or Go Offline’, Say UK, US and EU Agencies

Critical PHP Flaws Put Millions of Websites at Risk - ‘Patch or Go Offline’, Say UK, US and EU Agencies

The NCSC, alongside US and EU cyber agencies, is urging every organisation running PHP - the scripting language behind most of the world's websites - to patch two critical vulnerabilities that allow unauthenticated attackers to execute code on affected servers. The flaws were reportedly uncovered using AI and described as among the most significant ever found this way, and Amazon says it had already seen attacks exploiting them before the public warning was issued.

Security Patches Are Breaking 10x More Often - Why ‘Patch and Move On’ No Longer Works

Security Patches Are Breaking 10x More Often - Why ‘Patch and Move On’ No Longer Works

AI penetration-testing firm Terra Security has found that the share of GitHub security fixes needing a follow-up advisory for a failed patch jumped from around 0.2% to 2.3% in 2026, after six years of stable, low numbers. Vulnerabilities with broken fixes are four times more likely to end up on CISA's actively-exploited list, and the timing fits a growing use of AI by attackers to probe new patches for gaps the moment they ship.

ConnectWise Suspends Cloud Backup After M365 Credential Theft - Why MSP Supply Chains Matter to Every UK Business

ConnectWise Suspends Cloud Backup After M365 Credential Theft - Why MSP Supply Chains Matter to Every UK Business

ConnectWise has suspended its Cloud Backup, SaaS Security and Cloud Management services after detecting unauthorised access to application identities, with security firm Huntress alleging a stolen Microsoft 365 credential is being actively used to compromise customer tenants. Because ConnectWise sells its tools to managed service providers who in turn support thousands of small businesses, most end customers affected will have no idea their IT support relies on the platform at all.

When Ransomware Locks the Doors: Why Building Systems Are the New Cyber Frontier

When Ransomware Locks the Doors: Why Building Systems Are the New Cyber Frontier

Cybercriminals are increasingly targeting building automation systems that control door access, HVAC, lighting and fire alarms, using physical lockouts and real-world chaos as leverage to extort ransom payments. Research from ServiceNow's Armis Labs found 73% of organisations own building systems that have been used in ransomware attacks, and 91% of those systems communicate over insecure protocols - a blind spot most UK businesses have never assessed.

ICO Reprimands Met Police Over Shadow IT - A Governance Lesson for Every UK Business

ICO Reprimands Met Police Over Shadow IT - A Governance Lesson for Every UK Business

The Information Commissioner's Office has reprimanded the Metropolitan Police Service for an "ongoing failure" to stop staff using unauthorised IT platforms, after officers created 500 accounts on a retailer anti-shoplifting tool and uploaded sensitive data on suspects without oversight. The case is the second shadow IT failure at the force in four years, and a clear warning that policy alone doesn't stop staff adopting convenient tools outside IT's control.

Cisco's Email Security Gateway Hit by Second Root-Access Zero-Day in Two Months

Cisco's Email Security Gateway Hit by Second Root-Access Zero-Day in Two Months

Cisco and CISA have confirmed active exploitation of a critical, CVSS 9.8 vulnerability in Cisco Secure Email Gateway that lets an unauthenticated attacker gain root access simply by sending a malicious email attachment. With no workaround available and a second such zero-day in as many months, organisations running the appliance face emergency patching - and should check whether their email security actually sits behind one.

Phase Eight, Hobbs and H&M Targeted as UK Retail Cyber-Attacks Keep Coming

Phase Eight, Hobbs and H&M Targeted as UK Retail Cyber-Attacks Keep Coming

TFG London, owner of fashion brands Phase Eight, Hobbs and Whistles, is investigating a cyber-security incident that hit some IT systems over the weekend, while H&M is separately probing a hack claim from the group ShinyHunters. The pair join ASOS on the list of UK fashion retailers hit within weeks of each other, prompting one security expert to compare the pattern to waiting for a bus: "you wait for one, and suddenly three come along at once".

UK Minister Warns AI-Driven Cyber Breach Is ‘Likely, If Not Inevitable’ - What It Means for UK Businesses

UK Minister Warns AI-Driven Cyber Breach Is ‘Likely, If Not Inevitable’ - What It Means for UK Businesses

UK AI minister Kanishka Narayan has warned that a cyber-attack similar to the OpenAI agent breach of Australia's Medicare system is "likely, if not inevitable" in Britain, as the government considers using the Cyber Security and Resilience Bill to introduce mandatory reporting of AI safety incidents. For UK businesses already navigating a wave of agentic AI attacks this year, the message from government is that existing defences may not be enough.

Need IT Support?

Get in touch with our team for an obligation-free chat about your business IT

Contact Us
Insights & guides

Latest from our blog

Structured Data and Schema Markup: A UK Business Guide to Winning Rich Results in Google Search in 2026
SEO5 Nov 2026

Structured Data and Schema Markup

Schema markup is structured code added to web pages that describes their content in a standard vocabulary search engines understand: this page is a product...

Read article
Website Redesign Planning: A UK Business Guide to Avoiding the Mistakes That Tank SEO Rankings During a Rebuild in 2026
Web Development4 Nov 2026

Website Redesign Planning

Treating website redesign SEO as an afterthought is the most reliable way for a UK business to lose the organic traffic it spent years building. The pattern is...

Read article
Virtual CIO Onboarding: A UK Business Guide to What the First 90 Days Should Actually Look Like in 2026
Virtual CIO3 Nov 2026

Virtual CIO Onboarding

Good virtual CIO onboarding looks, from the outside, surprisingly unglamorous. Many UK businesses sign a virtual CIO contract expecting a strategy presentation...

Read article
Network Capacity Planning: A UK Business Guide to Forecasting Growth Before Your Network Becomes the Bottleneck in 2026
Network Admin1 Nov 2026

Network Capacity Planning

Network capacity planning is the practice of knowing how much headroom each part of your network has, forecasting when growth will use it up, and acting before...

Read article
Office Downsizing and Consolidation: A UK Business Guide to Moving to a Smaller Office Without Losing IT Capability in 2026
IT Office Moves31 Oct 2026

Office Downsizing and Consolidation

Planning office downsizing IT is a different exercise from planning a normal office move, and treating it as a smaller version of one is where most problems...

Read article
Microsoft 365 Copilot Adoption: A UK Business Guide to Why Most Deployments Fail to Change How People Work in 2026
Microsoft 365 Copilot30 Oct 2026

Microsoft 365 Copilot Adoption

A workable Copilot adoption strategy starts from an uncomfortable fact: buying Microsoft 365 Copilot licences does not change how anyone works. The pattern in...

Read article
Microsoft 365 Copilot ROI: How UK Businesses Are Measuring Productivity Gains in 2026
Microsoft 365 Copilot29 Oct 2026

Microsoft 365 Copilot ROI

Most UK organisations that bought Copilot in 2024 and 2025 have reached their first or second renewal, and the question in the room has changed. Nobody is...

Read article
Penetration Testing for Web Applications: A UK Business Guide to OWASP Top 10 Testing and What a Web App Pen Test Actually Covers in 2026
Penetration Testing28 Oct 2026

Penetration Testing for Web Applications

Web application penetration testing examines the software your customers, staff and partners actually use your portal, platform, booking system or API to find...

Read article
Backup Encryption: A UK Business Guide to Protecting Backup Data at Rest and in Transit Without Locking Yourself Out in 2026
Cloud Backup27 Oct 2026

Backup Encryption

Backup encryption at rest and in transit is now standard across almost every backup product, and most UK businesses assume their backups are protected because...

Read article
Private Connectivity to Azure and AWS: A UK Business Guide to ExpressRoute and Direct Connect vs Public Internet VPN in 2026
Cloud Networking26 Oct 2026

Private Connectivity to Azure and AWS

Private cloud connectivity means linking your offices or data centre to Azure or AWS over a dedicated circuit Microsoft ExpressRoute or AWS Direct Connect...

Read article
Technology stack

Built on technology you can trust.

We design, run and secure your IT on proven, industry-leading platforms, including Microsoft 365 and Azure, Cisco Meraki, Cloudflare, AWS, BitDefender and SolarWinds, so your business stays secure, scalable and reliable.

  • SolarWinds
  • Cloudflare
  • BitDefender
  • AWS
  • Hono
  • SolarWinds
  • Cloudflare
  • BitDefender
  • AWS
  • Hono
  • Opus
  • Office 365
  • Microsoft
  • Cisco Meraki
  • Microsoft Azure
  • SolarWinds
  • Opus
  • Office 365
  • Microsoft
  • Cisco Meraki
  • Microsoft Azure
  • SolarWinds

Enquiry Received!

Thank you for getting in touch. A member of our team will review your enquiry and get back to you within 24 hours.