Cyber security and governance checks in plain English — grc-scan
Latest briefings
updated 19 Oct 2026 · next WednesdayWhat to patch now
This week's additions lean heavily on the appliances sitting at your network's edge — VPNs, firewalls, email gateways, remote-support tools — the exact systems built to face the internet directly. - Run a VPN, firewall or email-security appliance (Ivanti, Palo Alto, Fortinet, Cisco)? Check with whoever manages it that this month's patches are on. - Use an outsourced backup or IT-support provider? Ask whether they run Ahsay or BeyondTrust, and whether it's fixed. - Running Windows or a self-hosted Atlassian tool? Update now — both are widely deployed, so both get attacked fast.
- 01Ivanti Connect Secure VPN gateway — an outsider can run commands with no password at all (CVE-2026-104935)
- 02Microsoft Windows — a flaw lets an attacker slip past a built-in security check over the network (CVE-2026-96951)
- 03Ahsay backup software — a chained pair of bugs lets an outsider walk straight into the server holding your backups (CVE-2026-105133 and CVE-2026-105134)
Cybersecurity news
Almost every flaw attacked this week was in something sitting at the edge of a network — a VPN, a firewall's admin page, an email gateway, the remote-support tool an IT provider signs in with. - Take admin and management pages off the public internet: require the office network or a VPN. - Don't wait for a CVE or a news story — follow your key vendors' own security advisories. - Walk the building and list the network devices nobody owns; update them or unplug them.
- 01Microsoft Fixed a Record 1,411 Flaws, and One Was Already Being Used
- 02The Remote-Support Tool Your IT Provider Signs Into Has Been Attacked Since August
- 03An Ivanti VPN Flaw Was Chained With Two Others to Take Over Fully Patched Devices
ICO fines & breaches
Both breaches this week started with one ordinary employee account, and everything the regulator said alongside them came back to accountability you cannot hand to a supplier, a platform or a tool. - Turn on multi-factor authentication for every staff account that reaches customer data — including the ones that only log in to someone else's dashboard. - Draft your breach holding statement now: what you'll say, who signs it off, which channel it goes on. You may not get to break the news first. - Screen marketing lists against the TPS before every campaign, and keep the consent record that proves you were allowed to call.
- 01ASOS: the attackers announced the breach themselves, through ASOS's own app — and it started with one employee account
- 02Phase Eight, Hobbs and Whistles: the second UK fashion retailer in six days, and a textbook first statement
- 03Automated nuisance-call complaints hit a five-year high — and the ICO has issued £2.37m of fines since April 2025
US enforcement roundup
This month’s cases all started with something ordinary: a vendor, a phishing email, and a pile of data nobody needed to keep. - Write down every vendor that holds your customers’ data, and what you would do if they were breached tomorrow. - Turn on MFA on email and admin accounts, and take away access the day someone leaves. - Keep only the personal data you still need, and write down when you delete the rest.
- 0144 attorneys general to Labcorp: you cannot outsource the duty to protect patient data
- 02One phishing email, 225,370 people, and the same first question OCR always asks
- 03The FTC’s Illuminate order: keep less, say how long you keep it, and mean the breach timeline you publish
Reading about a breach — could it happen to you?
Most of these stories start with something visible from the outside — an exposed service, a spoofable domain, weak TLS. Check your own domain in about a minute. Free, nothing intrusive.
run the posture scan→Start from your country: UK → · US → · How we test & why you can trust it