FaultyPacket Live UK Cyber Threat & CVE Advisory Radar

From industry concern to practical action: the value of working… (UK NCSC (all))

Tue, 27 Oct 2026 12:00:00 +0000

[UK NCSC (all) · GOV / OFFICIAL VENDOR VERIFIED] How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

Critical security issue affecting PHP (UK NCSC (all))

Wed, 21 Oct 2026 12:00:00 +0000

[UK NCSC (all) · CISA KEV + CVE-2026-109618 ACTIVELY EXPLOITED] Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619). — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Introducing a new AI chapter in the NCSC research problem book (UK NCSC (all))

Tue, 20 Oct 2026 12:00:00 +0000

[UK NCSC (all) · GOV / OFFICIAL VENDOR VERIFIED] A revolution is underway at the intersection of AI and cyber security. — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

China-linked malicious actors called out by UK and… (UK NCSC News)

Thu, 08 Oct 2026 12:00:00 +0000

[UK NCSC News · GOV / OFFICIAL VENDOR VERIFIED] Joint advisory with international partners highlights malicious targeting of organisations from a range of sectors across the globe. — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

Incident affecting ASOS customers (UK NCSC News)

Tue, 06 Oct 2026 12:00:00 +0000

[UK NCSC News · GOV / OFFICIAL VENDOR VERIFIED] ASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed. — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

Exploitation of vulnerabilities affecting Citrix NetScaler ADC… (UK NCSC News)

Mon, 28 Sep 2026 12:00:00 +0000

[UK NCSC News · GOV / OFFICIAL VENDOR VERIFIED] The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited. — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

Help the NCSC understand how organisations approach external… (UK NCSC Blog)

Mon, 12 Oct 2026 12:00:00 +0000

[UK NCSC Blog · GOV / OFFICIAL VENDOR VERIFIED] We're looking to hear from people involved in evaluating, selecting or adopting EASM. — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

CVE-2026-118527: Ivanti Connect Secure Generation of… (CISA KEV)

Fri, 30 Oct 2026 00:00:00 GMT

[CISA KEV · GOV/VENDOR + CVE-2026-118527 VERIFIED] Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known Due date: 2026-11-13. — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-111357: Ivanti Connect Secure Missing Authentication… (CISA KEV)

Fri, 30 Oct 2026 00:00:00 GMT

[CISA KEV · GOV/VENDOR + CVE-2026-111357 VERIFIED] Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chai Due date: 2026-11-02. — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload… (CISA KEV)

Tue, 27 Oct 2026 00:00:00 GMT

[CISA KEV · GOV/VENDOR + CVE-2026-48356 VERIFIED] Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gainin Due date: 2026-11-10. — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-55186: [silverstripe/mfa] MultiFactor Authentication… (GitHub Security Advisories)

2026-10-29T16:32:39Z

[GitHub Security Advisories · GITHUB GHSA-68wq-phq7-p2vg + CVE-2026-55186 VERIFIED] ### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… (GitHub Security Advisories)

2026-10-27T21:07:12Z

[GitHub Security Advisories · GITHUB GHSA-mf2p-h6hf-fcwm + CVE-2026-116675 VERIFIED] ### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with th — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… (GitHub Security Advisories)

2026-10-27T19:01:50Z

[GitHub Security Advisories · GITHUB GHSA-2v3c-qxhr-7vpv + CVE-2026-109413 VERIFIED] ### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `m — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… (GitHub Security Advisories)

2026-10-27T19:01:39Z

[GitHub Security Advisories · GITHUB GHSA-r925-mgvr-h9cc + CVE-2026-108082 VERIFIED] ### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?

BIMI Logo Not Showing in Gmail? Checklist | FaultyPacket