A South African parent, three British fashion brands and the questions every board should ask
Decrypted: The UK Cyber BriefingShow Notes
TFG says a cyber incident has knocked out IT systems at Phase Eight, Hobbs and Whistles, and it does not yet know if customer data was taken. What the separation of its systems teaches UK boards, plus Ledger's hardware implants and the NCSC's post-quantum pilot.
More from Decrypted: The UK Cyber Briefing
A critical flaw in the Collabora server bundled with Nextcloud was exploited from 10 September, but the advisory only appeared on 14 October. Plus Microsoft's account of AI agents in the ConnectWise attacks, and the UK's undersea cable sabotage proposals.
Developer platform Railway says an intruder may have read customers' decrypted secrets and has told everyone to rotate them. We cover what it said, the Secure by Design lesson, an exploited Arista SD-WAN flaw and the UK's undersea cable proposals.
A poisoned LiteLLM release stole credentials after attackers pointed a genuine, signed publishing workflow at a lookalike repository. The Secure by Design lesson is about fixed inputs and single powerful tokens. Also: Arista's exploited SD-WAN flaw, OpenAI's agents and Railway's secrets scare.
Yesterday's PHP story has become an outage: 32 UK government services were unavailable on Thursday as officials applied patches. Plus a hijacked LiteLLM release and the role AI played in finding the PHP flaws.
The National Crime Agency and US and German agencies have published how SafePay, a ransomware gang with at least 600 victims, breaks in and operates. The Secure by Design lessons are old and cheap. Also: Plex2Shell and Google's AI vulnerability tally.