This week's threat report: hackers are already exploiting a Cisco firewall flaw that can crash ASA and FTD devices without needing a password.
WordPress has rushed out a fix after criminals began scanning the internet for sites still vulnerable to a bug that can hand over control during the upgrade process.
A phishing campaign has stolen Microsoft 365 sign-in tokens from 97 accounts across 79 organisations, letting attackers slip past multi-factor authentication altogether.
A UK reseller of smart home devices has warned customers their payment card details may have been stolen after malicious software was found hidden on its website.
Read on to find out more...
Cisco has released a fix for a flaw in its ASA and FTD firewall software, which many organisations use to protect their networks from the internet. Cisco says criminals are already using the flaw for real. An attacker doesn't need a password to use it. They simply send a specially crafted message to a firewall that's set up in a certain way, which makes the device crash and restart, knocking it offline. NHS England has rated this a medium-severity alert, but the attack is already happening and further attacks are expected.
Firewalls like these are often the first line of defence protecting a hospital, GP practice or supplier's network from the internet. If a firewall keeps crashing and restarting, it can disrupt the VPN connections that staff and suppliers rely on to work remotely, and it may create brief windows where protection is weaker than usual. NHS suppliers using Cisco ASA or FTD devices should treat this as the kind of vulnerability DSPT expects organisations to patch quickly, given it is already being used by attackers.
Recommendations:
WordPress, the software behind a huge share of the world's websites, has released an update fixing several security problems. The most serious could let an attacker take control of a website while it is in the middle of updating itself. Security researchers have already spotted criminals scanning large numbers of websites to find ones that have not been updated yet. No official bug number has been issued yet, but WordPress is treating it seriously enough to backport the fix all the way back to very old versions of the software. Everyone is being told to move to version 7.1.4 or later.
WordPress runs a huge number of business websites, including patient information pages, booking portals and marketing sites used by NHS suppliers and digital health companies. Because criminals are already scanning for unpatched sites, any delay in updating increases the chance of being found and attacked. A compromised website can be used to steal visitor data, redirect patients to fake pages, or act as a foothold into wider company systems, all things DSPT and Cyber Essentials assessors expect organisations to have guarded against.
Recommendations:
Security researchers at Huntress have uncovered a campaign where criminals stole Microsoft 365 sign-in "tokens", a kind of digital pass created after someone logs in, rather than guessing passwords. By tricking victims into entering their details on a fake sign-in page that secretly sits between them and the real Microsoft site, the attackers captured these tokens and reused them to get into accounts without needing a password or a one-time code. Between July and September 2026, this was used to break into 97 accounts across 79 different organisations. Once inside, attackers often registered their own authenticator app, and in 19 organisations they removed the victim's real multi-factor authentication method and replaced it with their own.
Multi-factor authentication is one of the best defences UK businesses and NHS suppliers rely on to protect email and Microsoft 365 accounts, so an attack that bypasses it entirely is particularly serious. Attackers who get into a Microsoft 365 account can read confidential emails, including patient or staff correspondence, set up hidden rules to hide their activity, and use the trusted account to send convincing phishing emails on to colleagues and suppliers. This is exactly the kind of identity-based attack DSPT's access control expectations are designed to catch.
Recommendations:
Shelly Store UK, an independent reseller of Shelly smart home products, has told customers their payment card details may have been stolen after malicious software was discovered hidden on its website. The company was alerted by its payment provider, Stripe, and later found the unauthorised software had been quietly collecting customer data. At least one customer reported a fraudulent transaction on their card in Australia just hours before being notified of the breach, suggesting stolen card details had already been used elsewhere. Shelly Store UK has reported the incident to the Information Commissioner's Office and is contacting affected customers.
This kind of attack, often called web skimming, can affect any UK business that takes online payments, not just large retailers. Customers' trust and their money are both on the line, and under UK data protection law, businesses must report incidents like this to the ICO and tell affected people. For NHS suppliers that run online shops, booking systems or payment pages for patients or staff, the same kind of hidden malicious code could just as easily target card or personal details collected through those services.
Recommendations:
Want help staying ahead of threats like these? Contact Periculo about our Threat Intelligence services.