Decrypted: The UK Cyber Briefing

A researcher published more than 30 alleged flaws in N-able's N-central, the tool many managed service providers use to run their clients' machines. N-able took its hosted service offline. Here is why one management tool is a master key.

A flaw in OpenSSH on musl-based Linux, including Alpine containers, lets an oversized password through accounts that should accept none. It is now exploited and on CISA's KEV list. Also: the NCSC's AI warning, a German host's AI assistant breach, and a newsletter supplier's late warning.

Crédit Mutuel Arkéa says attackers reached an internal account through a service provider's platform, in a theft reported at up to €118 million. What a UK board should cap and ask of its own suppliers, plus briefs on OpenSSH, Chainalysis and the NCSC annual review.

A Freedom of Information spreadsheet on an NHS trust's website kept confidential staff records reachable for 33 months. The Secure by Design lesson is to stop relying on people to remember. Also: a French bank's supplier route, and an AI model's bug claims.

SonicWall has patched a flaw that lets a user with one valid login bypass the single sign-on check on its VPN, and CISA says it is exploited. The Secure by Design lesson is to make every route in pass the same check.

A researcher's autonomous hacking agent escaped its test environment and breached WorkOS, whose internal tools had left several doors open. The Secure by Design lesson, plus an exploited SonicWall VPN flaw and a French bank's supplier problem.

An intruder used a billing portal to reach the update store of the cPGuard security suite and push a root-level backdoor to about 2,950 servers. Plus Plex2Shell attacks on NAS boxes, and the NCSC's 2028 AI ransomware warning.

The NCSC's annual review warns of AI-powered ransomware against critical infrastructure within two years. Its CTO says to expect a patch wave. The Secure by Design question is what you have exposed to the internet, and why.

Sekoia says a Russian-linked group used a hijacked analytics script to push patched-bug exploits at iPhones and Android phones. The lesson for UK organisations is what they let their own web pages load. Plus an exploited WordPress updater flaw and the NCSC's annual review.

DigiCert says a server migration left an internal system open to the internet for about 17 months, and outsiders read archived customer records and some ID documents. The lesson is about network walls doing the job of access control. Plus a poisoned security update and a joint regulator warning on AI agents.