Candiru spyware delivered through adverts: when the ad is the exploit
Decrypted: The UK Cyber BriefingShow Notes
Citizen Lab says an ad tech firm let Candiru spyware reach chosen devices through ordinary adverts, with no click needed. The Secure by Design lesson is that a vendor badge is not a control. Plus an exploited Nextcloud flaw and Anthropic's self-replicating AI warning.
More from Decrypted: The UK Cyber Briefing
Yesterday's PHP story has become an outage: 32 UK government services were unavailable on Thursday as officials applied patches. Plus a hijacked LiteLLM release and the role AI played in finding the PHP flaws.
The National Crime Agency and US and German agencies have published how SafePay, a ransomware gang with at least 600 victims, breaks in and operates. The Secure by Design lessons are old and cheap. Also: Plex2Shell and Google's AI vulnerability tally.
PHP shipped emergency fixes today for two critical remote code execution flaws, and the NCSC says any version may be affected. The lesson is knowing where PHP runs. Also: the SafePay ransomware advisory and the US order removing DeepSeek.
AOMEI Backupper's update files were briefly tampered with on its own servers, delivering a backdoor with no software flaw involved. The Secure by Design lesson is signed updates. Also: PHP's patches due today, rogue AI agent guidance, and a spyware ruling.
The ICO has reprimanded Data Cymru and its IT supplier after ransomware got in through a forgotten test account with the password Password1. The Secure by Design lesson is an account inventory and clear supplier duties. Also: AOMEI update tampering, and French supermarket fridges.