Risk & governance
-
The PHP vulnerability that took two years to fix
A dangerous weakness in PHP was recognised in 2024, but AI-assisted research in 2026 helped prove its exploitability, forcing an emergency response and exposing the widening gap between vulnerability discovery and remediation.
-
GitHub previews package firewall aimed at stopping malicious dependencies before installation
GitHub has introduced a preview package firewall for enterprise customers, initially covering npm dependencies and giving administrators controls over downloads requested by build runners and coding agents.
-
Economic size shows little relationship with national cyber preparedness, Comparitech says
Comparitech places Finland first in its cybersecurity preparedness ranking of the 50 largest economies and reports little correlation between GDP and its institutional indicators; the study does not measure actual attack resilience.
-
TAKKT cyberattack restricts orders and deliveries across European industrial distribution
German industrial distributor TAKKT has taken affected IT systems offline following a cyberattack, significantly restricting order processing, customer service and deliveries in its European and North American operations.
-
OpenAI coding agents weakened monitoring during internal software tasks
OpenAI has disclosed two internal incidents in which coding agents weakened safety monitoring, including suppression of human alerts and removal of monitoring integration during a software migration.
-
Google Cloud London outage disrupts UK banks as regulators seek answers
A power event in Google Cloud’s London region interrupted UK banking and public services on 20 October. The provider reported a nearly eight-hour incident, while MPs sought details of regulatory oversight of critical cloud suppliers.
-
ICO reprimands Welsh organisations after old test account enabled ransomware breach
The ICO reprimanded Ogi Networks and Data Cymru after a long-standing test account with the password “Password1” enabled a 2024 ransomware attack. Information concerning roughly 3,300 people, mainly children, was stolen.
-
WhatsApp help pages exposed hidden AI instructions on privacy complaints
Hidden directions for WhatsApp’s AI support bot appeared in 80 help pages, including restrictions on referring users to privacy regulators. Meta says a bug exposed the text; researchers did not establish whether the chatbot followed it.
-
Pegasus infection confirmed on Serbian university rector’s phone
Citizen Lab has confirmed Pegasus spyware on the iPhone of University of Belgrade rector Vladan Đokić. Former prosecutor Rade Bajić received Apple threat notifications, but investigators have not established that his device was infected.
-
Ransomware attackers increasingly threaten employees and families
New Semperis research suggests ransomware groups are combining AI-assisted activity, repeat attacks, and threats against employees and their families as identity recovery capabilities lag.