Cyber security and governance checks in plain English — grc-scan
Latest briefings
updated 2 Nov 2026 · next WednesdayWhat to patch now
This week's fixes sit in the infrastructure running behind the scenes of a business — firewalls, VPN gateways, virtualization hosts, and the platforms running your online store or source code — rather than everyday desktop software. - Run an online store on Adobe Commerce/Magento, or self-host GitLab? Patch now — both allow full remote code execution. - Use a Cisco ASA/FTD firewall or an Ivanti Connect Secure VPN gateway? Confirm with your network provider that fixes are applied — both are past-due or due today. - Run your own Linux servers or VMware virtualization? Check with your host or IT provider that kernel and ESX updates are current.
- 01Adobe Commerce and Magento — a crafted file upload can run an attacker's code on your store (CVE-2026-48356)
- 02Google Brotli — a crafted compressed file can corrupt memory in software that uses it (CVE-2026-111497)
- 03Broadcom VMware ESX — an admin's actions can go unlogged, hiding what they did (CVE-2026-41709)
US enforcement roundup
In each of these settlements the failure was a known gap left open — an unfixed audit, a password with no second factor, sensitive files nobody encrypted or deleted. - Work through the last security review you were given, and write down what you fixed. - Require MFA for staff and for every vendor who logs in to your systems. - Find old archives of personal data; encrypt what you need and delete the rest.
- 01New York and Connecticut to a pediatric network and its IT provider: $2.7 million, and an audit nobody acted on
- 02Connecticut to Frontier: $625,000 after stolen employee and vendor logins
- 03California to 23andMe’s successor: $6 million, and bankruptcy did not end the claims
Cybersecurity news
Every flaw actually being exploited this week — in a shop module, a firewall, a compression library and PHP itself — was reachable from the internet by someone with no login at all. - Patch anything facing the internet within days, not at the next convenient window, and restart the service afterwards. - Audit the third-party scripts and browser extensions you have quietly accumulated, and delete whatever nobody can explain. - After a supplier's breach, rotate your own credentials: a key or scheduled task left behind survives an update.
- 01A Flaw Being Exploited in Drupal's Shop Module Needs Patching Today
- 02The PHP Flaws From Last Week Are Now Confirmed in Real Attacks, and Chained With a Second One
- 03A Flaw in the Compression Nearly Every Website Uses Is Being Exploited
ICO fines & breaches
Neither story this week is about a clever attack: one is about organisations unable to see what their suppliers were doing, the other about data being treated as fair game because it was already public. - List every supplier that can reach your customer data, and ask each in writing how fast they would tell you about an incident. - Never scrape or buy a marketing list — "it was public" is not a lawful basis, and the PECR liability lands on you. - Get a named out-of-hours contact from your IT provider and keep it somewhere you could read it offline.
- 01Police suppliers were breached repeatedly since 2021 — and most contracts asked nothing about security
- 02Clearview AI is back in court over whether the ICO could fine it at all — four years and counting
Reading about a breach — could it happen to you?
Most of these stories start with something visible from the outside — an exposed service, a spoofable domain, weak TLS. Check your own domain in about a minute. Free, nothing intrusive.
run the posture scan→Start from your country: UK → · US → · How we test & why you can trust it