Show Notes
MI5 says a Chinese body it assesses as a front for state intelligence funded projects involving more than 100 UK-linked academics. The Secure by Design lesson is to check who is paying, not just who you are working with.
More from Decrypted: The UK Cyber Briefing
Yesterday's PHP story has become an outage: 32 UK government services were unavailable on Thursday as officials applied patches. Plus a hijacked LiteLLM release and the role AI played in finding the PHP flaws.
The National Crime Agency and US and German agencies have published how SafePay, a ransomware gang with at least 600 victims, breaks in and operates. The Secure by Design lessons are old and cheap. Also: Plex2Shell and Google's AI vulnerability tally.
PHP shipped emergency fixes today for two critical remote code execution flaws, and the NCSC says any version may be affected. The lesson is knowing where PHP runs. Also: the SafePay ransomware advisory and the US order removing DeepSeek.
AOMEI Backupper's update files were briefly tampered with on its own servers, delivering a backdoor with no software flaw involved. The Secure by Design lesson is signed updates. Also: PHP's patches due today, rogue AI agent guidance, and a spyware ruling.
The ICO has reprimanded Data Cymru and its IT supplier after ransomware got in through a forgotten test account with the password Password1. The Secure by Design lesson is an account inventory and clear supplier duties. Also: AOMEI update tampering, and French supermarket fridges.