All Briefs
The full archive of Monday Morning Cyber Briefs. Plain English cybersecurity news and analysis for business leaders in the Channel Islands.
One new KEV addition to act on, PHP patching is still not done, and developer tooling just became a supply chain risk
CISA added new KEV CVEs on 30 October. If you have not patched PHP since last week's php2shell disclosure, the window is closing. A malicious Cursor extension planted SSH backdoors, a reminder that developer tooling is a soft spot.
php2shell just made every web server a target, and SafePay is the ransomware group you should have heard of by now
Critical PHP vulnerability allows unauthenticated remote code execution on any PHP web server. SafePay ransomware has hit 600 organisations. CISA added eight new actively exploited vulnerabilities to the KEV catalogue.
Your remote support tool just became the fastest way in, and CISA is not waiting for you to catch up
BeyondTrust Remote Support is in CISA's crosshairs. Ivanti Connect Secure is being actively exploited again. Channel Islands cyber security centres are running free awareness events. This week: remote access is the attack surface.
QuickBooks phishing is still live in the islands, and your legacy systems are on CISA's list
GCSC is tracking QuickBooks themed phishing targeting finance teams. CISA added multiple older-but-exploited CVEs to KEV. JCSC published guidance on AI-enabled security risks. This week: tighten finance controls, check legacy exposure, and get your AI governance position on paper.
NetScaler is under active exploitation, one more KEV item lands, and AI governance is still the conversation you need to have
CISA has flagged critical zero-day vulnerabilities being actively exploited in Citrix NetScaler ADC and Gateway. One more exploited CVE added to the KEV catalogue. AI governance remains a live topic across the Channel Islands.
Kiteworks is telling customers to shut down their servers, and CISA just added two more to the pile
Kiteworks urged emergency server shutdowns over a potential zero-day. CISA added two more exploited vulnerabilities to the KEV catalogue. WordPress is under active exploitation. This week: emergency response speed is the differentiator.
Cisco ISE is being exploited, one more KEV item, and AI risk just became a governance question
CISA added CVE-2026-85706 to the KEV catalogue. Cisco warns of a max severity ISE zero-day being exploited. Jersey Cyber Security Centre published guidance on AI-enabled security risks. This week: close the obvious doors.
Patch Tuesday just got heavier, and your browser is still a frontline risk
CISA added CVE-2026-85706 to the KEV catalogue. Microsoft's September 2026 Patch Tuesday is unusually large. Google is still patching exploited Chrome zero-days. This week: tighten patch discipline and browser hardening.
One more KEV entry, finance phishing still live in the islands, and edge devices remain the fastest way in
CVE-2026-85046 is confirmed exploited, QuickBooks phishing continues to target Channel Islands finance teams, and SonicWall SMA1000 zero-day reports put edge appliances back in the spotlight. This week: patch the KEV item, tighten payment controls, and check your remote access kit.
QuickBooks phishing is hitting the islands, and exploited vulnerabilities are still the fastest way in
Guernsey has flagged a QuickBooks themed phishing campaign, while CISA KEV additions and PaperCut exploitation show how fast attackers weaponise common systems. This week: stop payment fraud, close the obvious doors.
Actively exploited vulnerabilities keep stacking up, and the bar for asset ownership just got higher
Emergency patching and industrial control warnings raise the bar for asset ownership and patch discipline. KEV additions, TrueConf Server exploitation, ASP.NET emergency patches, and Siemens S7 PLC advisories.
Clop is back, vCenter is under fire, and your supplier register just became urgent
Clop's latest data theft claims, critical VMware vCenter RCE exploitation, and a new CISA KEV addition. This week is about patching crown jewels and tightening third-party assurance.
Exploited vulnerabilities are piling up, and the patching window just got shorter
CISA added multiple actively exploited vulnerabilities to the KEV catalogue. The UK NCSC reiterated urgent action for on-premises SharePoint Server exploitation. Cisco SD-WAN exploitation is driving very short remediation windows.
Want to discuss anything from a previous brief?
Join the conversation on LinkedIn