Show Notes
UpGuard found over 16,000 exposed Supabase databases leaking personal data because the platform's security default doesn't apply to tables built by AI coding agents. Also: Citrix's NetScaler zero-days get a patch and a federal deadline, Bitget's $388m theft traces to a security vendor's own flaw, and TikTok drops its ICO appeal.
More from Decrypted: The UK Cyber Briefing
Yesterday's PHP story has become an outage: 32 UK government services were unavailable on Thursday as officials applied patches. Plus a hijacked LiteLLM release and the role AI played in finding the PHP flaws.
The National Crime Agency and US and German agencies have published how SafePay, a ransomware gang with at least 600 victims, breaks in and operates. The Secure by Design lessons are old and cheap. Also: Plex2Shell and Google's AI vulnerability tally.
PHP shipped emergency fixes today for two critical remote code execution flaws, and the NCSC says any version may be affected. The lesson is knowing where PHP runs. Also: the SafePay ransomware advisory and the US order removing DeepSeek.
AOMEI Backupper's update files were briefly tampered with on its own servers, delivering a backdoor with no software flaw involved. The Secure by Design lesson is signed updates. Also: PHP's patches due today, rogue AI agent guidance, and a spyware ruling.
The ICO has reprimanded Data Cymru and its IT supplier after ransomware got in through a forgotten test account with the password Password1. The Secure by Design lesson is an account inventory and clear supplier duties. Also: AOMEI update tampering, and French supermarket fridges.