Show Notes
Today's Budget pledges to consult next year on where liability for cyber breaches should sit. A single bullet point, but it goes to the heart of Secure by Design. Plus the Everest claim against PwC, and Britain's new AI security money.
More from Decrypted: The UK Cyber Briefing
GoDaddy-owned 123 Reg says an intruder read customer records on 18 September in its first AI-driven attack. We separate evidence from the company's own assessment, then cover an ESXi flaw used as a zero-day and Ofcom's age-check assessment.
Bristol City Council took four days to shut down a schools platform after spotting suspicious activity, and a ransomware group has now listed the council. The Secure by Design question is who can switch a shared system off, and how fast.
Arista has patched another exploited flaw in VeloCloud Orchestrator, the console that runs an organisation's SD-WAN. The real question for UK organisations is who can reach that console at all. Also: Symantec's captured AI agent that hijacks exposed AI endpoints.
HM Inspectorate of Constabulary and Fire & Rescue Services found that every attack on police data since 2021 hit an outside supplier, not the police. The Secure by Design fix starts at procurement. Also: Apple's CoreGraphics patch reaches older devices, and Texas sues OpenAI.
DreamHost has spent four days forcing email and FTP password resets and has not yet said why. The lesson for UK firms is about recovery paths and blast radius. Also: Magento stores infected despite patching, and an AI pen-testing tool misused.