Threat Analysis : Cyber News for Small Business

Zero-Day Threats and Linux Breaches: Essential Measures Mauven delves into two critical cybersecurity threats impacting UK businesses. The StyleSmuggler vulnerability affects Magento platforms through PHP code injections, compromising e-commerce security. Despite existing guidance from the National Cyber Security Centre, many businesses remain vulnerable, urging immediate action for secure transac...

Safeguarding Against BPFDoor and AVERAT Threats Join Mauven on today’s Threat Analysis as she explores crucial cybersecurity threats faced by UK businesses. With recent developments around BPFDoor variants and the new AVERAT implant, companies need to secure their network-edge appliances urgently. Attackers exploit SMTP traffic on port 25, integrating seamlessly into trusted mail operations. Small...

Critical Vulnerabilities in FortiMail and Dell CSM In today’s episode of Threat Analysis, Mauven dives into pressing cyber vulnerabilities affecting small and medium businesses. The episode focuses on a zero-day vulnerability in FortiMail, identified as CVE-2026-104286, which hackers actively exploit without requiring authentication. The episode stresses the necessity of timely patch management, a...

Evolving Cyber Threats to UK SMBs In today’s episode of Threat Analysis, Mauven MacLeod explores the escalating cybersecurity threats faced by UK small businesses. As technological advancements bring more complex cyberattacks, businesses encounter significant risks, beyond just IT concerns. The episode delves into 2CLoader, a sophisticated malware loader identified in August 2026, which utilises a...

Cyber Threats Facing UK Small Businesses In today’s episode of Threat Analysis, Mauven MacLeod explores pressing cybersecurity threats impacting UK small businesses. The discussion begins with ValleyRAT, a sophisticated malware posing as innocuous software discovered by AlienVault OTX. This threat utilises DLL sideloading to gain backdoor access to organizations’ systems, recording keystrokes and...

AI Risks and Cybersecurity Essentials for UK SMBs In today’s episode of Threat Analysis, Mauven delves into critical developments impacting UK small and medium-sized businesses (SMBs). We begin with OpenAI’s surprising decision to pause its GPT-6.1 Astra model due to unforeseen behaviours, raising concerns about AI oversight and control measures. This move underscores the importance of implementin...

Citrix and Oracle Vulnerabilities: A Wake-Up Call for UK SMBs In today’s episode of Threat Analysis, Mauven MacLeod delves into critical vulnerabilities affecting Citrix NetScaler ADC and Gateway products. These security flaws pose significant threats to businesses of all sizes across the UK, as cybercriminals actively exploit them. Despite existing advisories, many organisations have yet to imple...

Navigating Critical VeloCloud Flaws and Rising Malware Tactics In today’s episode of ‘Threat Analysis’, we delve into a critical vulnerability affecting VeloCloud Orchestrator environments. With a CVSS score of ten, this flaw allows remote attackers to potentially gain full control over VCO hosts, posing significant risks to small and medium businesses. We explore why robust systems alone aren’t e...

TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering CISA confirms ransomware gangs are actively exploiting a critical JetBrains TeamCity vulnerability patched in July, eleven weeks after the fix became available. UK SMBs face supply chain exposure through managed service providers and development partners with access to production environments. Meanwhile, the Canadian Cent...

Chrome Zero-Days, Android Banking Trojan, and VeloCloud Exploit Five Chrome V8 vulnerabilities are under active exploitation by Chinese threat actors right now. A single malicious page visit can compromise an unpatched device without user interaction beyond the click. Meanwhile, the RemControl Android banking trojan is targeting UK financial institutions through fake app downloads, stealing creden...

Seventeen Days of Silence, Autonomous AI Implants, and a Zero-Day Router Today’s briefing covers three active threats that exploit gaps in oversight and attention. First, Huntress published a timeline of an INC ransomware attack that compromised 175 endpoints after a 17-day period of apparent dormancy, demonstrating how patient adversaries use dwell time as a weapon. Second, Cisco Talos released d...

Evolving Cyber Threats Facing UK Businesses Join Mauven MacLeod for today’s Threat Analysis as we explore significant cyber threats impacting UK businesses. We begin with TraderTraitor, a subgroup of the Lazarus Group, which has shifted focus from cryptocurrency firms to IT services providers, highlighting a strategic expansion in their attack vectors. For small businesses, this underscores the im...

Third-Party Trust Exploited: Brevo, Clop, and RMM Abuse On 14 September 2026, attackers compromised Brevo’s infrastructure, injecting malicious code into JavaScript assets that reached over 100,000 customer websites. WordPress administrators had backdoor plugins silently installed while logged in; regular visitors faced ClickFix credential-harvesting overlays. Meanwhile, the Clop threat group cont...

Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action Two critical threats require immediate attention from UK businesses today. Cisco has disclosed an authentication bypass vulnerability in its Identity Services Engine with a maximum CVSS score of 10.0, and exploitation is already confirmed as active. ISE functions as a network gatekeeper for VPN, device compliance, and access c...

ScreenConnect Exploited, OAuth Device Phishing, and Pixel Zero-Day CISA has confirmed active exploitation of a critical ConnectWise ScreenConnect vulnerability, the remote access tool used by countless UK IT providers to support small business clients. Attackers are targeting managed service providers to gain indirect access to entire client portfolios. Meanwhile, the GhostCode phishing campaign i...

Web Skimmers, IoT Botnets, and Search Engine Fraud: Trust Under Attack Three active cybercriminal campaigns are exploiting trust in routine business systems. GrelosGTM injects payment skimmers into Google Tag Manager containers on compromised e-commerce sites, bypassing traditional file integrity checks and PCI compliance tools. Two IoT malware families, KATARU and Evooo1Bot, are scanning for unpa...

Revolut Social Engineering Breach and GitLab Path Traversal Exploit A major fintech data breach demonstrates how impersonation attacks bypass technical defences entirely, whilst a maximum-severity GitLab vulnerability enters active exploitation. This episode examines Revolut’s disclosure of customer financial and passport data released following a fraudulent government agency impersonation, highli...

Russian State Actors Target Business Travellers via Hotel Wi-Fi This episode examines three active threat campaigns with direct SMB relevance. Russian state group APT29 (Midnight Blizzard) is conducting large-scale credential harvesting through compromised hotel and conference Wi-Fi networks across the UK and Europe, specifically targeting business travellers. The operation exploits captive portal...

WatchGuard Ransomware Exploitation and Chrome Zero-Day Chain Target UK SMBs Two active exploitation campaigns are affecting UK small businesses today. Ransomware operators are exploiting a critical WatchGuard Firebox vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalogue in December 2025, yet remains unpatched in many deployments nine months later. The flaw allows remote,...

UK Cybersecurity: Patch Tuesday and New Threats In today’s briefing, Mauven examines key cybersecurity threats relevant to UK businesses. Microsoft’s record Patch Tuesday reveals 973 vulnerabilities, with 113 rated as critical, highlighting the urgency for timely updates. Two zero-day vulnerabilities pose active risks. Small and medium UK businesses often underestimate their appeal to cybercrimina...

Cyber Threats Every UK SME Must Address Today In this episode of Threat Analysis, hosted by Mauven, we delve into pressing cybersecurity threats facing UK small and medium-sized businesses (SMEs). We begin with the StyleSmuggler zero-day vulnerability targeting Magento and Adobe Commerce. Identified as CVE-2025-54236, this flaw allows unauthorised remote code execution, which underscores the impor...

Magento Zero-Day Threat and Crypto Heist Insights Mauven delves into pressing cybersecurity issues facing UK businesses. The alarming zero-day vulnerability in Magento, known as Stylesmuggler, threatens e-commerce operations with unauthorised remote code execution risks. The episode stresses the importance of immediate action, such as disabling unnecessary services and utilising robust web applica...

Access Management Failures: Teams Impersonation, Infostealer Sessions, and Leaver Risk Three separate incidents this week reveal a single, critical vulnerability across UK small businesses: access management. Microsoft Threat Intelligence has confirmed an active campaign exploiting Teams external collaboration to impersonate IT helpdesk staff, tricking employees into installing remote access tools...

SonicWall Zero-Days, Teams Vishing Campaign, and Third-Party Identity Risk On 2 September 2026, SonicWall disclosed two vulnerabilities in the SMA1000 remote access appliance series being actively chained together for remote code execution at the time of public disclosure. This episode provides immediate guidance for organisations running SonicWall perimeter devices, including patch verification a...

Exchange Auth Bypass, PaperCut Data Theft, and Softaculous Supply Chain Attack Nearly 22,000 Microsoft Exchange servers remain unpatched for a critical authentication bypass vulnerability allowing complete mailbox takeover. PaperCut print management software, deployed across thousands of UK offices, is actively exploited for data theft days after a patch was released. A 33-hour BGP hijack of Softa...