This week's threat report: a flaw in SonicWall's VPN software is already being used by hackers to slip past multi-factor authentication, and the US government has confirmed real attacks are happening.
Criminals had a working exploit for a Zyxel network switch flaw before the fix was even released, and NHS cyber experts say more attacks are likely.
Researchers have shown how two flaws in Barracuda's email security devices can be chained together to give an attacker full control of the system with no password at all.
One of the world's biggest certificate companies, DigiCert, has admitted that a mistake left a server exposed to the internet for sixteen months, letting someone access customers' passports and other ID documents.
A cyber attack on Bristol City Council's schools system has ended with 320,000 files, including sensitive records from 39 schools, published on the dark web.
A review into last year's Royal Cornwall NHS data breach has found that staff drafted onto a support helpline at a day's notice were left carrying a serious emotional burden, with little training or support.
Hackers tampered with cold-storage controls at France's blood service, pushing temperatures as high as 110°C, in an attack linked to a wider wave hitting food and healthcare supply chains across Europe.
Microsoft has disclosed a critical flaw in Entra ID's device registration process, though it says the issue was fixed on its end before anyone could exploit it.
Read on to find out more...
SonicWall makes firewalls and VPN software that many businesses use to let staff connect securely to work from home or on the road. Researchers found a flaw in this software that lets someone who already has a valid username and password get past the extra multi-factor authentication check that is supposed to stop them, even without the one-time code. The US government's cyber agency, CISA, has confirmed that criminals are already using this flaw for real attacks and has ordered its own agencies to fix it urgently. SonicWall also released fixes for three other serious flaws in the same software at the same time, including two that could let an attacker take over the management screen used to control the firewall.
Multi-factor authentication is one of the main defences that UK businesses and NHS suppliers rely on to stop stolen passwords turning into a full break-in. A flaw that lets attackers walk straight past it removes that safety net for anyone using an affected SonicWall device, and VPNs like these are often the exact route staff and suppliers use to reach hospital and NHS supplier networks remotely. Because real attacks are already happening, this is precisely the kind of urgent, actively exploited flaw that DSPT and Cyber Essentials assessors expect organisations to patch without delay.
Recommendations:
Zyxel's GS1900 range of network switches, the devices that connect computers, printers and other equipment together on an office or hospital network, has a serious flaw that lets an attacker on the same local network take control of the device and run their own commands, without needing a username or password. Security researchers at Binarly found that criminals already had a working version of this attack before Zyxel had even published a fix, having spotted it sitting on infrastructure used by attackers. NHS England's cyber security team believes further attacks using this flaw are likely.
Network switches sit quietly in the background of almost every office, clinic and data room, and they are rarely top of mind for patching compared with firewalls or servers. Because this flaw does not need a password and was being used by criminals before anyone else even knew about it, any Zyxel GS1900 switch left unpatched on a hospital, GP practice or NHS supplier network is a ready-made foothold for an attacker who has already got onto the local network some other way. NHS suppliers should treat this as the kind of promptly-patched vulnerability that DSPT compliance expects, particularly for any network equipment that touches clinical or patient systems.
Recommendations:
Barracuda's Email Security Gateway is a device many organisations use to filter spam and malicious emails before they reach staff inboxes. Security researchers found two flaws in it that, used together, let an attacker with no username or password at all take complete control of the device, right up to its highest level of access. The first flaw lets an attacker get around the normal login checks, and the second lets them run their own commands once inside. Barracuda has released patches for both, and while there is no confirmed evidence yet of criminals using this exact chain, the same product was previously targeted by a nation-state hacking group in 2023, so further attacks are considered likely.
Email security gateways sit at the front door of an organisation's email system, which makes them an attractive target: breaking in can give an attacker access to sensitive emails, the ability to intercept communications, or a launchpad to attack the rest of the network. For NHS suppliers and digital health organisations, where email often carries patient or clinical correspondence, a fully compromised email security appliance would be a serious incident under DSPT and UK data protection rules. The fact that technical details and proof-of-concept code are now public makes it more likely that criminals will build working attacks soon.
Recommendations:
DigiCert is one of the world's largest providers of the digital certificates that make the padlock icon appear in web browsers and keep websites secure. The company has admitted that moving one of its internal systems to a new location by mistake left it exposed to the public internet for more than sixteen months. During that time, an account-creation feature that should never have been available on the system let an outsider set up accounts without needing multi-factor authentication, and a separate permissions mistake let them browse archived customer records. Some of those records included names, business contact details, and copies of ID documents such as passports, driving licences and utility bills. DigiCert says its certificate-issuing systems themselves were not affected and that customer certificates remain secure.
This is a reminder that even specialist security companies can be caught out by basic mistakes like a poorly reviewed server move, and that the fallout can include other people's personal and identity documents rather than just login details. UK businesses and NHS suppliers that rely on DigiCert, or any third-party vendor, for certificates or other services should remember that a supplier's data breach can still expose their own staff or customer information, which is exactly the kind of third-party and supply chain risk that DSPT and Cyber Essentials expect organisations to actively manage. It is also a useful case study in why monitoring needs to catch problems in weeks, not months.
Recommendations:
Bristol City Council's "Trading with Schools" platform, used by 88 of its schools to buy in services such as IT support, meal ordering and HR, was infected with malicious software on 21 September and had to be shut down on 25 September. In early November, criminals published more than 320,000 stolen files on the dark web, taken from the 39 schools that relied on the platform most heavily. The council has since named the affected schools, which include nurseries and special educational needs settings, and said the platform could hold sensitive information such as educational psychology records. The South West Regional Organised Crime Unit is investigating, and the council says it is still working out exactly what data was taken and who it affects.
This is a reminder that a single shared, third-party-hosted platform can expose dozens of organisations and thousands of individuals at once if it's compromised, because all of their sensitive data sits in one place. Schools, NHS suppliers and other public sector bodies increasingly rely on shared administrative platforms for things like procurement, HR and pupil or patient records, and this incident shows why it's worth knowing exactly what sensitive data those platforms hold on your behalf and how well they're protected. It's also a good example of why clear, fast communication with the people affected matters: some parents in this case said they only learned of the risk to their children's data weeks after the council first suspected a problem.
Recommendations:
A newly published review has found that staff drafted into a helpline after the Royal Cornwall Hospitals NHS Trust's 2025 data breach faced distressed callers, safeguarding concerns and a "serious emotional impact," often with little training or warning. The breach itself happened because a spreadsheet published in response to a Freedom of Information request in February 2023 secretly retained sensitive sickness and health data for over 8,000 current and former staff, hidden inside its pivot tables. It sat publicly available for 33 months before a member of the public spotted the issue in November 2025. Staff were given around a day's notice before being put on the helpline, which was meant to run for two weeks but, due to the volume of distressed calls, ended up running for eleven. The trust has since introduced mandatory password protection for FOI spreadsheets and a senior information governance sign-off step before anything sensitive is published.
This wasn't a hack: it was a well-meaning team publishing a spreadsheet without realising hidden data was still buried inside it, which shows how easily sensitive information can leak through routine data-sharing and FOI processes rather than just through cyber attacks. For NHS organisations and suppliers, it's a useful case study in why FOI responses involving complex spreadsheets need the right expertise and sign-off, and a reminder that the human cost of a breach extends well beyond the people whose data was exposed to the staff left picking up the pieces.
Recommendations:
The French Blood Establishment (EFS) has confirmed that attackers compromised a refrigeration supplier and tampered with cold-storage settings used to keep blood samples and frozen plasma, including plasma for transfusion, at safe temperatures. Reports say criminals changed settings from -30°C to 110°C, though monitoring and alarm systems caught the anomaly quickly enough that no blood products were lost. The incident is part of a wider wave of attacks on refrigeration and cold-storage controllers across Europe, which has already caused supermarkets in several countries to throw away spoiled food after criminals remotely triggered defrost cycles; the UK's National Cyber Security Centre says it is aware of some impact on the UK food supply chain too. The attackers have not been identified, and it's not yet clear whether the same access method was used against EFS as against the affected supermarkets.
This shows attackers increasingly targeting the industrial control systems behind refrigeration and cold storage, not just office IT networks, and that these systems can sit behind critical healthcare supply chains like blood and plasma as well as food. It's also a genuinely reassuring example of resilience working as intended: because EFS had proper monitoring and alarms in place, a serious tampering attempt was caught and contained before it caused real harm. Any organisation relying on connected refrigeration or industrial control equipment, including hospitals, labs, pharmacies and food suppliers, should take this as a prompt to check their own exposure.
Recommendations:
Microsoft has disclosed a critical flaw, tracked as CVE-2026-109469, in the device registration process for Entra ID (formerly Azure Active Directory), the identity system behind sign-in for Microsoft 365 and countless other business applications. The flaw, an authorisation bypass caused by a user-controlled key, carries the maximum possible severity score of 10 out of 10 and could have allowed an attacker to elevate their privileges over the network. Microsoft says the vulnerability has already been fully mitigated on its own servers, that it was not publicly known or exploited before the fix went in, and that no action is needed from customers; the CVE was published purely for transparency.
Entra ID sits behind identity and access management for a huge number of organisations, so a maximum-severity flaw in it would normally be a serious concern. In this case, because Microsoft identified and fixed the issue server-side before disclosing it, there is nothing for IT teams to patch or configure themselves. It's still worth knowing about, both because it illustrates how much of modern security now depends on cloud providers fixing things on their end, and because DSPT and Cyber Essentials assessors may ask whether you're aware of vulnerabilities affecting services you rely on, even ones that required no action.
Recommendations:
Read our full breakdown of what happened and what it means on the Periculo blog: CVE-2026-109469: What We Know So Far About the Microsoft Entra Flaw.
Want help staying ahead of threats like these? Contact Periculo about our Threat Intelligence services.