News & insights
The latest news, insights, and updates on information & cyber security, privacy, and AI governance from Taylor Baines.
Get the latest threats, vulnerabilities, and legal, standards, and AI updates in your inbox every Monday.
Get our weekly insights by email
Threat and vulnerability round-up: week ending 25 October 2026
Exploited PHP2Shell flaws in PHP, an Arista VeloCloud Orchestrator zero-day, and a chained Plex Media Server attack lead this week, alongside backdoored WordPress sites via stolen UpdraftCentral keys and a joint warning on SafePay ransomware.
UK proposes up to 14 years in prison for subsea cable sabotage
A UK government White Paper proposes replacing the Submarine Telegraph Act 1885 with new offences of up to 14 years for damaging subsea cables, plus security duties for operators.
Urgent: Arista VeloCloud Orchestrator vulnerability under active attack
Arista VeloCloud Orchestrator On-Prem flaw CVE-2026-114625 is under active attack: upgrade to a fixed release, restrict access, and check for compromise.
PHP2Shell: what the critical PHP flaws mean for your website
Websites worldwide were taken offline on 21 October 2026 after two critical PHP vulnerabilities were disclosed. Here is what it means for your business website and what to do now.
Judge orders Meta to pay New Mexico $25 billion over Facebook privacy
A New Mexico judge orders Meta to pay $25 billion after a jury found it misled Facebook users about privacy, in a case rooted in the Cambridge Analytica scandal.
Canada launches its first Children’s Privacy Code
The Privacy Commissioner of Canada has launched a Children’s Privacy Code setting expectations on consent, profiling, deceptive design, and privacy-protective defaults for under-18s.
One hacker uses AI agents to break into more than 100 company websites
Research reported by Reuters shows a Chinese-speaking attacker used autonomous AI agents to probe more than 1,200 websites and break into sites linked to over 100 companies.
Threat and vulnerability round-up: week ending 18 October 2026
Zero-days in Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, and PAN-OS lead this week, alongside ConnectWise Cloud Backup credentials used to break into Microsoft 365 tenants and attacks on supermarket refrigeration controllers.
Urgent: BeyondTrust Remote Support vulnerability under active attack
BeyondTrust Remote Support 26.2.3 and earlier has a critical flaw under attack (CVE-2026-102764): apply the BT26-05 patch now and check self-hosted appliances for compromise.
Urgent: Cisco Secure Email Gateway vulnerability under active attack
Cisco Secure Email Gateway flaw CVE-2026-76519 is under active attack: update Content Scanner Tools or AsyncOS now and check your appliances for compromise.
EU cites first harmonised AI Act standard on quality management
The European Commission has cited EN 18286:2026 in the Official Journal, the first harmonised standard under the AI Act, giving high-risk AI providers a presumption of conformity for the quality management requirements it covers.
ISO/IEC 27090 published to address security threats to AI systems
ISO and IEC have published ISO/IEC 27090:2026, guidance on understanding, detecting, and mitigating security threats specific to AI systems, designed to sit alongside ISO/IEC 27001 and 27002.