Citrix NetScaler's next critical SAML flaw lands on top of last week's patches
Decrypted: The UK Cyber BriefingShow Notes
A new critical NetScaler flaw, CVE-2026-107406, can hit appliances that administrators patched only last week, and NHS England says exploitation is likely. Also: the AWS AgentCore research Amazon disputes, and where the Cyber Security and Resilience Bill stands.
More from Decrypted: The UK Cyber Briefing
Yesterday's PHP story has become an outage: 32 UK government services were unavailable on Thursday as officials applied patches. Plus a hijacked LiteLLM release and the role AI played in finding the PHP flaws.
The National Crime Agency and US and German agencies have published how SafePay, a ransomware gang with at least 600 victims, breaks in and operates. The Secure by Design lessons are old and cheap. Also: Plex2Shell and Google's AI vulnerability tally.
PHP shipped emergency fixes today for two critical remote code execution flaws, and the NCSC says any version may be affected. The lesson is knowing where PHP runs. Also: the SafePay ransomware advisory and the US order removing DeepSeek.
AOMEI Backupper's update files were briefly tampered with on its own servers, delivering a backdoor with no software flaw involved. The Secure by Design lesson is signed updates. Also: PHP's patches due today, rogue AI agent guidance, and a spyware ruling.
The ICO has reprimanded Data Cymru and its IT supplier after ransomware got in through a forgotten test account with the password Password1. The Secure by Design lesson is an account inventory and clear supplier duties. Also: AOMEI update tampering, and French supermarket fridges.