Critical PHP Vulnerabilities (PHP2Shell):CVE-2026-109618 and CVE-2026-109619 Explained
On the 21st of October 2026, the PHP project released emergency security updates for two critical vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and referred to collectively as “PHP2Shell”. Both are Remote Code Execution vulnerabilities, rated as Critical under the CVSS v4.0 rating system with scores of 9.2. The UK National Cyber Security […]
What Is Incident Response In Cyber Security?
Every organisation will, at some point, face some sort of cyber security incident. Not every organisation will face a breach that makes the news, but it should be stated that the once-held assumption of “we’re too small to be a target” has been disproven countless times. Attackers automate their scanning, phishing and access brokering, which […]
The Growing Security Risks of AI Infrastructure and LLM Deployments
Artificial Intelligence technologies are being adopted rapidly across many organisations. From internal automation tools to customer-facing applications powered by large language models (LLMs), AI systems are increasingly integrated into business processes. However, security practices for AI infrastructure are still developing. Recent research from OWASP Foundation highlights several emerging risks associated with AI and ML (Machine […]
Securing LLMs and AI Infrastructure: Moving from Experimentation to Control
Artificial Intelligence has crossed the threshold from lab experiment to live production. Large language models now sit behind customer-facing chat services, internal knowledge tools, developer workflows and management dashboards. The pace of adoption has been remarkable, but the security practices around these systems? These have not kept up. That gap matters. Businesses rolling out LLMs and the infrastructure that supports them are quietly adding attack surfaces that look nothing like the ones their security teams are used to. And as a breach disclosed just this month demonstrates, the consequences of getting this wrong are already playing out in public. The AI attack surface is different […]
Identity Security Beyond Passwords: addressing the modern attack surface
Identity has become one of the primary targets in modern cyber-attacks. Rather than exploiting software vulnerabilities or deploying malware, attackers increasingly focus on gaining access to legitimate user accounts. Once authenticated, they can operate within systems using valid credentials, potentially avoiding detection if they can blend into ordinary user traffic. This shift has significant implications […]
Strategic Cyber Incident Exercises: Preparing Leadership for the Moments That Matter
Most organisations have an incident response plan, but not all have tested how that plan would perform during a major cyber crisis. Recent cyber incidents continue to demonstrate that technical defences alone are not sufficient. When an organisation experiences a significant breach or ransomware attack, the challenge quickly becomes organisational as opposed to purely technical. […]
Penetration Testing vs GRC: Why Organisations Need Both to Manage Modern Cyber Risk
In many organisations, cybersecurity investment tends to follow one of two directions. Some focus heavily on governance, risk and compliance (GRC) activities such as policies, frameworks and risk registers. Others prioritise technical testing, including penetration testing and red teaming. In practice, both disciplines are essential. Recent industry reporting continues to highlight a growing volume of […]
When Smart Devices Become Security Risks: From Robot Hoovers to Connected Fridges
IOT or rather “connected devices” are now common in both homes and workplaces. From smart speakers and lighting systems to robot vacuum cleaners and internet-connected refrigerators, the number of Internet of Things (IoT) devices in use continues to grow rapidly. Whilst these devices offer convenience and automation, they also introduce new security considerations. Many consumer […]
Software Supply Chain Attacks Are Increasing: What Organisations Should Do Now
Software supply chains have become an increasingly attractive target for cyber attackers. Rather than compromising individual organisations directly, threat actors are focusing on widely used development tools and open-source components to distribute malicious code across multiple environments simultaneously. Recent research highlighted a campaign where attackers compromised widely used development tools including Trivy and Checkmarx integrations […]
From Vulnerability Discovery to Effective Remediation
Identifying vulnerabilities is only the first step in improving an organisation’s security posture. Many organisations discover that after a penetration test, audit or vulnerability assessment they are left with a significant list of technical findings but limited internal capacity to address them. In practice, remediation can be complex. Security issues often involve configuration changes, system […]
