Know what's exposed. Know what you'd be asked.
Cyber security and governance, in plain English — free scans, readiness checks and a weekly briefing, written for the curious, not just the pros. No sign-up, nothing kept beyond a short grace window.
This week's briefings
updated 19 Aug 2026ICO fines & breaches
Every case this fortnight was a control that existed on paper but nobody actually owned day to day — a second check, a patch, a permissions setting. - Require a second person to check any document or export before it leaves your organisation. - Write down, in the contract, exactly who patches what when you split hosting and development across suppliers. - Ask whoever built your website or portal to confirm anonymous visitors can't read customer or staff data through it.
- 01Metropolitan Police Service issued an enforcement notice and reprimand after handing a stalking victim's new address to her alleged stalker
- 02ACRO Criminal Records Office reprimanded after a hacker had access to its systems for seven months, with nobody applying the patches
- 03PNLD police-legal database breach exposes contact details for over 100,000 officers and staff after being published on the dark web
What to patch now
This week pairs three brand-new flaws in firewall, Windows and dashboard software with a stack of resurfaced fixes — several over a week overdue — that MSPs, developers and AI tooling still haven't applied. - If you self-host Metabase for dashboards, patch it now — attackers need no login to reach your connected databases. - Ask your IT provider or MSP whether N-able N-central, TeamCity, Tomcat, LoadMaster or Langflow are patched — several fixes are now over a week overdue. - On Windows machines, install this month's update — it's what turns a smaller break-in into full admin control.
- 01Cisco firewalls — a crash bug that can knock your firewall or VPN offline (CVE-2026-20349)
- 02Windows networking driver — turns a smaller break-in into full control (CVE-2026-68820)
- 03Metabase — a dashboard tool with a hole that hands over your connected databases (CVE-2026-72898)
Cybersecurity news
This week's stories share a common thread: the gap between a warning and real damage keeps shrinking, whether that's a ransomware gang weaponising a patch note within hours or a fake job candidate walking straight through the front door of a hiring process. - Patch anything reachable from the internet — firewalls, VPNs, load balancers, server-management tools — the moment a fix ships; don't wait for a quiet week. - Verify the identity of any remote hire or contractor you've never met in person before giving them access to anything. - Before connecting an AI tool to real business data, get a plain answer on what it can do without your approval first.
- 01A Shipping Company's Breach Just Delayed Deliveries for Big-Name Retailers and Exposed Their Customers' Data
- 02Criminals Turned Last Week's Warning Into an Actual Ransomware Attack — Within 24 Hours
- 03A Single Server Flaw Gave Attackers a Permanent Back Door Into Companies in 47 Countries
Reading about a breach — could it happen to you?
Most of these stories start with something visible from the outside — an exposed service, a spoofable domain, weak TLS. Check your own domain in about a minute. Free, nothing intrusive.
run the posture scan→UK small business? Start from the UK page → · How we test & why you can trust it