Cyber risk, explained
Breach analysis while it still matters, and plain-English guides to what our scans actually do. Written by the CyberLab security team. For interviews and podcast episodes, see Tales from The CyberLab.
11.7 million gaming accounts exposed. Is yours one?
Capcom says details linked to 11.7 million CAPCOM ID accounts were exposed and 196 players were locked out. What it means for you, and a simple check of the accounts you've forgotten.
PHP2Shell: CISA confirms attacks, what we know now
CISA now confirms PHP2Shell attacks, with some successful. A third flaw has no emergency fix and a big claim was retracted. What's confirmed, and what UK small businesses should check this week.
UK firms face 2,213 attack attempts a day
UK businesses faced an average of 2,213 automated attack attempts a day in Q3 2026, with remote access tools the top target. Here's how small firms can close the doors that matter.
Fake quote requests are phishing your sales team
Emails mentioning RFQs rose about 12-fold in a year, and nearly 73% led to a fake sign-in page. Why sales and procurement teams are the target, and what to do this week.
970 fake apps targeted UK phones. Is one on yours?
McAfee found 970 fake apps aimed at UK phones, posing as PayPal, Netflix and popular games. How the scam works and a five-minute check to see what's really on your phone.
PHP2Shell is now under attack: patch or pull your website
Attackers are now exploiting the PHP2Shell flaws, and 32 UK government services went offline while fixes went in. Here's how to check your website is patched, and what to do if it isn't.
GitLab's maximum-severity flaw: patch self-hosted servers now
GitLab has fixed a maximum-severity flaw that lets an attacker run code on self-hosted servers without logging in. No attacks reported yet. Here's what UK small firms and IT providers should check today.
The 12-year-old login that let hackers in
A test account made in 2012 with the password 'Password1' let ransomware attackers in. The regulator has reprimanded a Welsh data body and its IT provider. Here's what small firms should check.
Two critical PHP flaws land today: is your website ready?
PHP will ship emergency fixes today for two critical flaws after details leaked. Websites and web apps on PHP are in scope, so here is how UK small businesses and IT providers can get ready.
One cloud outage hit banks, parcels and the NHS
A Google Cloud fault hit UK banking apps, delivery firms and NHS England. The cause isn't confirmed, but the lesson for small businesses is clear: know what your business depends on.
Your stolen phone is only the start
London phone thefts are falling, but criminals are turning to fake 'we've found your phone' calls to get passcodes and accounts. How to lock your phone down before anything happens.
Phishing emails that trick your AI assistant
Phishing emails now hide instructions for the AI that summarises your inbox, making scams look urgent and genuine. How it works, and the simple checks UK small firms can put in place this week.
Passkeys: the login phishing kits can't steal
Phishing kits behind a billion scam messages were just disrupted, and passkey use has nearly doubled. What passkeys are, why phishing can't easily steal them, and how UK small firms can start this week.
Patch Outlook now: a preview could be enough
Microsoft's record October update fixes more than 1,400 flaws, including five in Outlook that can be triggered just by previewing an email. Here's what UK small firms should check this week.
October 2026 in cyber security
Two breaches, and a flaw under attack, and what each one means for your business
Hacked, but the shops stayed open
The owner of Hobbs, Whistles and Phase Eight was hit by a cyber attack on 11 October, but its shops kept trading. Here's what UK small firms can learn from how it limited the damage.
What the NCSC's frontier AI guidance means for your businesses
The NCSC says AI is making attacks faster and cheaper. Here is what that changes for your business, and what to do about it.
Hackers turned supermarket fridges into ovens
Hackers reached refrigeration controls in hundreds of French supermarkets and set them to defrost at up to 50°C. Here's what UK small firms with connected kit should check this week.
What happens when cyber insurance kicks in
What happens when a cyber attack hits and you call your insurer? Lessons from Beazley and Capsule on the first 72 hours, ransom negotiation and claims
ASOS confirms customer contact details were exposed
ASOS has confirmed that some customers’ names and contact details were exposed after the ‘ASOS HACKED’ alert. Here’s what changed and what to check.
£101m lost to fake 'new bank details' requests
UK victims reported losing more than £101m to payment diversion fraud in 2025/26, with invoice fraud the most common type. Here's how the scam works and five checks to stop it.
ASOS customers receive a hacker's threat via the app
ASOS app users received an "ASOS HACKED" alert on 6 October. Here's what we know so far and what to check in your own business.
How to read your HackRisk report: a walkthrough
Your HackRisk Report is a snapshot of where you stand, delivered free of charge and within 24 hours.
Over half of UK firms lack basic cyber skills
57% of UK businesses aren't confident with at least one basic cyber task, a new government survey finds. Here's what the gaps are and how to cover them without hiring an expert.
Your staff are already using shadow AI
71% of UK employees have used unapproved AI tools at work. The NCSC says shadow AI puts company data at risk. Here's what small businesses can do this week, without banning AI.
WordPress flaw exploited within hours
A critical WordPress flaw (CVE-2026-87902) was attacked within hours of its 22 Sept fix. What it means for UK small businesses and what to check this week.
Your IT provider is about to be regulated
The Cyber Security and Resilience Bill brings medium and large IT providers under cyber rules, with 24-hour incident reporting and big fines. Here is what it means for UK small businesses.
Half of UK SMEs were breached last year
49% of UK SMEs had a cyber incident last year and recovery took over four weeks. Here's what caused them and the checks that would have stopped most of them.
AI hackers now cost $25 a target
Autonomous AI agents breached 27+ online retailers in weeks at around $25 a target. Here's what it means for UK small businesses and what to do this week.
Cyber risk in technology companies
Technology companies are often the most exposed: fast-moving stacks, cloud sprawl and developer access create risks that technical skill alone doesn't cover.
September 2026 in Cybersecurity
Three breaches, three different ways in, and what each one means for your business
Revolut data breach explained
Revolut has confirmed that customer data was handed over to scammers after staff were targeted by a phishing email impersonating a government agency.
Recon Scan explained
Before an attacker tries to get into your systems, they look first. A recon scan shows you what they see: every domain, server and service you expose.
Security Awareness Training explained
Most businesses already run some kind of security training. An annual video. A policy document everyone signs and nobody reads again.
Dark Web Scan Explained
Most business owners assume a data breach is something that happens to other companies - bigger companies, with bigger targets on their backs.
Supply Chain Risk explained
You can patch your systems, train your staff and lock down your network, and still be exposed. A breach doesn't have to start with you to affect you.
Phishing Simulations explained
Most businesses have told their staff not to click suspicious links. Phishing simulations test whether the message actually stuck, safely and without blame.
Vulnerability Scan explained
Every piece of software your business runs -- your website, your email system, the apps that keep everything ticking over -- occasionally has flaws in it.