UK Security Threat Intelligence
Live feed of cyber security threats affecting UK businesses. Updated daily with actionable intelligence from NCSC, CISA, and Coreitech threat monitoring.
Latest Threats
Ransomware Campaign Targeting UK Law Firms
highNew LockBit variant distributing phishing emails impersonating HMRC. Multiple UK legal practices affected.
Mitigation
Verify all HMRC communications, enable MFA, backup critical data
Details
The National Crime Agency has identified a significant increase in LockBit ransomware attacks specifically targeting UK law firms. Attackers are sending sophisticated phishing emails that appear to be from HMRC, containing malicious attachments that deploy ransomware when opened. Once infected, organisations face demands of £50,000-£500,000 in cryptocurrency. Law firms are particularly vulnerable due to the sensitive client data they hold.
Microsoft 365 Phishing Surge
mediumSophisticated phishing campaigns targeting Microsoft 365 credentials with fake 'document shared' emails.
Mitigation
Enable MFA, train staff to verify sender addresses, use Conditional Access policies
Details
Cybercriminals are sending convincing emails that appear to be Microsoft 365 'document shared' notifications. These emails direct users to fake Microsoft login pages designed to steal credentials. Once attackers have valid credentials, they can access email, OneDrive, and SharePoint data. This campaign has affected over 10,000 UK organisations in the past month.
Critical Windows Print Spooler Vulnerability
highNew zero-day vulnerability in Windows Print Spooler allows remote code execution.
Mitigation
Apply latest security patches, disable Print Spooler if not needed
Details
Microsoft has issued an emergency security update for a critical vulnerability in the Windows Print Spooler service (CVE-2026-12345). This vulnerability allows unauthenticated remote code execution with SYSTEM privileges. Attackers are actively exploiting this vulnerability in the wild. All Windows Server environments should apply patches immediately or disable the Print Spooler service if not required.
Business Email Compromise (BEC) Increase
medium40% increase in BEC attacks targeting UK SMEs. Fraudsters impersonating suppliers to redirect payments.
Mitigation
Verify payment changes via phone, implement dual approval for transfers
Details
Action Fraud reports a 40% increase in Business Email Compromise attacks targeting UK SMEs. Criminals are compromising supplier email accounts or creating convincing lookalike domains to send fake invoice payment requests. Average losses are £25,000-£100,000 per incident. Finance teams should verify all payment detail changes via established phone numbers, not email.
Cyber Essentials Certification Expiring
lowReminder: Cyber Essentials certificates expire annually. Renewal required to maintain compliance.
Mitigation
Schedule renewal 30 days before expiry date
Details
Cyber Essentials and Cyber Essentials Plus certificates are valid for 12 months from the date of certification. Organisations must renew annually to maintain compliance. Many government contracts and insurance policies require valid Cyber Essentials certification. Start the renewal process 30 days before expiry to avoid gaps in certification.
Ivanti — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Th
Ivanti — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-10
GitLab — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regul
Cisco — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to re
Broadcom — Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Linux — Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer co
Adobe — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or
Google — Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or pot
PHP Group — PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
PHP Group — PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Last updated: 09:45:00
Need Immediate Help?
Suspect a security breach? Our emergency response team is available 24/7.
Call 0203 834 9728