In 30 seconds
- Finance teams are still being targeted. GCSC is tracking a QuickBooks themed phishing campaign in the Channel Islands. Even if you do not use QuickBooks, the pattern is the same: a finance brand, a sense of urgency, and a path to credential capture or invoice fraud.
- Old vulnerabilities, live exploitation. CISA added multiple CVEs to the KEV catalogue on 8 October, including CVE-2023-22894. These are not new flaws. They are old ones that organisations have not patched, and attackers know it.
- AI governance is still on the table. JCSC published guidance on AI-enabled security risks. The risk is not rogue AI. It is sensitive data being pasted into tools nobody has formally approved.
Why it matters
Here is what actually gets regulated firms in trouble. It is not a single CVE in isolation. It is the combination of an exposed service that has been quietly sitting unpatched for years, plus a finance team being targeted with believable phishing and payment diversion. Both of those things are happening right now in the Channel Islands.
QuickBooks phishing: the process gap that costs money
GCSC's investigation points directly at QuickBooks themed phishing. The pattern is transferable even if you have never touched QuickBooks. Attackers use a finance brand to trigger urgency, capture credentials, and then pivot to invoice fraud or payment diversion. The damage is not a compromised mailbox. It is a misdirected payment, a client impact, and a messy recovery involving banks, auditors, and regulators.
The fix is process as much as technology. Call-back verification for bank detail changes needs to be mandatory and actually followed under time pressure. Finance mailboxes need attachment scanning, safe link rewriting, and alerting for unusual forwarding rules or OAuth app grants. If a finance account was compromised today, how quickly would you know?
KEV: old flaws, live attackers
CISA added multiple CVEs to the Known Exploited Vulnerabilities catalogue on 8 October, including CVE-2023-22894. For those less familiar, CISA is the US Cybersecurity and Infrastructure Security Agency, and their KEV catalogue is a public register of software flaws confirmed to be actively exploited in the wild. Every entry means someone, somewhere, is already using that vulnerability to break into organisations.
What makes this week notable is the age of the flaws. These are not zero-days. They are vulnerabilities from 2023 that are still being exploited because organisations have not patched them. Regulated firms tend to have long-lived systems and supplier-managed platforms, and that is exactly where "known exploited" issues hide. If the affected product is in your estate, including at third parties, identify it, confirm the patch level, document ownership, and set a deadline. Evidence, not intent.
AI governance: get your position on paper
JCSC published guidance on AI-enabled security risks, and it remains a live conversation across the islands. Boards and compliance teams are being asked to approve AI usage, and the risk is often data leakage and poor governance rather than "AI hacking". The near-term risk is sensitive client data being pasted into an external AI tool by someone trying to be productive.
A simple, plain English policy that says what is allowed, what is not, and where to go with questions is more effective than a 40-page framework nobody reads. Confirm what AI tools are approved, what data is allowed, and how you evidence compliance. If you do not have a position yet, now is the time to set one.
Questions to ask your team this week
- 1.Are finance users receiving supplier invoices via email protected with attachment scanning, link rewriting, and alerting for unusual mailbox rules?
- 2.If a finance mailbox was compromised today, how quickly would we detect unusual forwarding rules, OAuth app grants, or new inbox rules?
- 3.Do we have any legacy services still running that map to older KEV-listed CVEs, and can we prove they are not internet-facing?
- 4.Is call-back verification for bank detail changes mandatory, and is it actually followed under time pressure?
One thing to do this week
Run a 45-minute finance phishing drill. Pick 10 finance and operations users. Confirm MFA is enforced and that mailbox auditing and alerting is on. Re-brief the bank detail change process, including call-back verification. Then spend 15 minutes confirming whether any legacy systems in your estate match this week's KEV additions.