Two critical PHP vulnerabilities can allow unauthenticated remote code execution. Here’s what UK website owners should patch, verify, and ask their hosting, web, or IT partner about now.

ASOS customers have received an apparent unauthorised push notification claiming that attackers compromised a Snowflake instance. Here is what is confirmed, what remains unverified and what UK businesses should do when a cyber incident is still unfolding.

A phishing email reportedly opened the door to thousands of Manchester City documents, and almost a decade later, the consequences are still unfolding. Here’s what UK businesses should learn about email security, access, monitoring and incident response.

Revolut was not breached through its core systems. Criminals used a legitimate government email domain to request sensitive customer data. The incident is a useful warning for every business that relies on email and trusted relationships.

GTA 6 has leaked again, with Cyberleek publishing apparent work-in-progress footage and a map ahead of Rockstar's official showcase. We look at what is confirmed, what remains uncertain, and the practical cyber security lessons for UK businesses.

MFA has been the sensible answer to a clear problem: passwords aren’t enough. But attackers have adapted, and now one-time codes can be intercepted, fake sign-in pages can relay credentials in real time, and push notifications can be abused.

Passkeys offer a more phishing-resistant alternative, without making security more frustrating for users. So, what are they, how do they work, and what should UK businesses do now?

Cyber resilience is moving from “something IT handles” to a board-level business discipline. The government’s July 2026 Cyber Resilience Pledge is aimed at larger organisations, but the practical message applies neatly to UK SMEs: know who owns cyber risk, use the free tools available, and make supply-chain security less vague.

A modern IT partner should be responsible for keeping core systems supported, secure, visible, resilient and aligned with the direction of the business. That includes responsive day-to-day support, proactive monitoring, cyber security, backup and recovery planning, supplier management, technology roadmapping, compliance support, and clear communication with leadership.

In short: they should help you deal with today’s issues, prevent tomorrow’s avoidable ones, and make better decisions about what comes next. Not a small job, then.

Backups are one of those things every business knows it should have.

They sit quietly in the background, reassuring everyone that if the worst happens, the data is safe and the business can carry on. But a backup is only useful if it can actually be restored.

That is why backup testing matters. It turns “we think we’re covered” into “we know what we can recover, how quickly, and what still needs fixing.” In the middle of a ransomware attack, cloud outage, accidental deletion, or failed migration, that difference becomes very real.

Confused by XDR vs MDR? Here’s what UK SMEs and mid-market organisations need to know about modern threat detection, why endpoint security alone is no longer enough, and how broader visibility plus managed response can help reduce blind spots across email, cloud, identity, endpoint, and network environments.

A new threat advisory issued in May 2026 warns of increased risk around software supply chain compromise, including underground activity that appears to reward scale and downstream impact. For UK SMEs and mid-market organisations, the takeaway is not panic. It is a reminder that modern cyber risk does not always start inside your business.

Cyber incidents aren’t always the result of sophisticated attacks. More often, they stem from everyday assumptions about how systems work, where responsibility sits, and who is actually at risk.

With around half of UK SMEs experiencing a breach or attack in the past year, it’s clear that those assumptions don’t always hold up. In this blog, we explore five common beliefs that continue to catch organisations out, and why they’re worth challenging.

April Fools’ Day is built on harmless deception, but phishing attacks are anything but. While prank emails might raise a smile, malicious ones are designed to catch you off guard and exploit trust, urgency or familiarity.

In this blog, we break down five common phishing tactics still catching people out in 2026, and what to look for before you click.

Cyber Essentials has become a baseline requirement for many UK organisations, whether for supply chains or government contracts. But as more businesses look beyond the badge, a key question keeps coming up: is Cyber Essentials enough, or does Cyber Essentials Plus offer something more meaningful?

In this blog, we break down the real difference between self-assessment and independent validation, and why that distinction matters when it comes to understanding your actual security posture.

Companies House is one of those systems most people assume simply works. It sits quietly in the background of the UK business environment, holding records for millions of companies and underpinning how organisations verify each other every day.

But recent reports of a vulnerability in the WebFiling system have raised serious questions about how secure that infrastructure really is. Beyond the technical issue itself, the incident highlights something broader: many of the systems businesses rely on sit outside their direct control.

When platforms like this experience problems, the consequences can ripple far beyond the organisation running them.

The UK government has launched a campaign urging businesses to “lock the door” on cyber criminals, highlighting a simple truth: many attacks succeed because basic protections are missing. From weak passwords to unpatched systems, small gaps can create big risks. Here’s why cyber hygiene still matters in 2026 and why the fundamentals remain your strongest defence.

Email remains one of the most trusted channels in business, yet it is also one of the easiest to abuse. If your domain is not properly protected, it can be spoofed without your knowledge, putting your brand and clients at risk. In this piece, we break down what DMARC actually does, why so many organisations still misconfigure it, and why domain protection should be treated as a baseline control in 2026.

Millions of Instagram users received unsolicited password reset emails over the weekend. We examine what happened, the data exposure risks, and the security lessons for organisations.

2025 was a defining year for cyber security. From major outages to supply-chain attacks, organisations were forced to confront systemic risk and the limits of assumed resilience. This review examines the cyber incidents that mattered and the lessons they hold for the year ahead.

The Christmas period is meant to be quiet, yet the Rainbow Six Siege breach shows how cyber incidents thrive when attention drops. As servers were taken offline and data integrity collapsed, the real story goes beyond gaming disruption, revealing the risks that always-on services face when attackers strike during holiday downtime.