Cyber security and governance checks in plain English — grc-scan
Latest briefings
updated 30 Oct 2026 · next MondayCybersecurity news
Every flaw actually being exploited this week — in a shop module, a firewall, a compression library and PHP itself — was reachable from the internet by someone with no login at all. - Patch anything facing the internet within days, not at the next convenient window, and restart the service afterwards. - Audit the third-party scripts and browser extensions you have quietly accumulated, and delete whatever nobody can explain. - After a supplier's breach, rotate your own credentials: a key or scheduled task left behind survives an update.
- 01A Flaw Being Exploited in Drupal's Shop Module Needs Patching Today
- 02The PHP Flaws From Last Week Are Now Confirmed in Real Attacks, and Chained With a Second One
- 03A Flaw in the Compression Nearly Every Website Uses Is Being Exploited
ICO fines & breaches
Neither story this week is about a clever attack: one is about organisations unable to see what their suppliers were doing, the other about data being treated as fair game because it was already public. - List every supplier that can reach your customer data, and ask each in writing how fast they would tell you about an incident. - Never scrape or buy a marketing list — "it was public" is not a lawful basis, and the PECR liability lands on you. - Get a named out-of-hours contact from your IT provider and keep it somewhere you could read it offline.
- 01Police suppliers were breached repeatedly since 2021 — and most contracts asked nothing about security
- 02Clearview AI is back in court over whether the ICO could fine it at all — four years and counting
What to patch now
This week's fixes sit mostly in software a business chooses and installs itself — a media server, a self-hosted office suite, a firewall module — rather than the big-name network-edge boxes of recent weeks. - Run Plex Media Server, even just at home on a device that touches your work network? Update it now — four flaws chain together. - Self-host Nextcloud with the built-in Collabora editor, or a web-server WAF module? Check the vendor's fix and apply it today. - Run multi-site SD-WAN (Arista) or Siemens industrial software? Ask your network or OT provider whether this week's patches are on.
- 01SiteGuard Server Edition — a built-in feature can be hijacked to run commands with full control of the server (CVE-2026-106931)
- 02Plex Media Server — four flaws chain together into running an attacker's own code on the server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656)
- 03Siemens Software Center — a logged-in user can trick it into loading a fake file and running their own code (CVE-2026-110936)
US enforcement roundup
This month’s cases all started with something ordinary: a vendor, a phishing email, and a pile of data nobody needed to keep. - Write down every vendor that holds your customers’ data, and what you would do if they were breached tomorrow. - Turn on MFA on email and admin accounts, and take away access the day someone leaves. - Keep only the personal data you still need, and write down when you delete the rest.
- 0144 attorneys general to Labcorp: you cannot outsource the duty to protect patient data
- 02One phishing email, 225,370 people, and the same first question OCR always asks
- 03The FTC’s Illuminate order: keep less, say how long you keep it, and mean the breach timeline you publish
Reading about a breach — could it happen to you?
Most of these stories start with something visible from the outside — an exposed service, a spoofable domain, weak TLS. Check your own domain in about a minute. Free, nothing intrusive.
run the posture scan→Start from your country: UK → · US → · How we test & why you can trust it