This week's threat report: Citrix has patched a NetScaler flaw so severe it scores 9.5 out of 10, and NHS England has issued a high-severity alert telling organisations to check their systems now.
Atlassian is telling every customer running Jira, Confluence or Bitbucket on its own servers to patch immediately, after finding a bug that lets strangers reach into company files without logging in.
A sign-on system that should have been switched off years ago let someone steal email addresses from Bromcom, whose school management software is used by more than 5,000 UK schools.
Fashion retailer Asos is contacting customers after criminals tricked a staff member into handing over login details, exposing names and contact information held on an outside data platform.
The UK and Germany have signed a new pact to share intelligence and disrupt Russian cyberattacks, as warnings grow louder about hostile activity aimed at critical infrastructure.
Read on to find out more...
Citrix has released a patch for a new flaw, CVE-2026-107406, in its NetScaler ADC and NetScaler Gateway products. These are devices that sit at the edge of a company's network and control secure remote access. The flaw is caused by a memory handling error and could let an attacker run their own commands on the device, or simply crash it, if the device is set up in certain ways to handle a type of single sign-on called SAML. It has been given a severity score of 9.5 out of 10. Citrix has not said whether anyone has used this flaw yet, but it is the latest in a long run of serious NetScaler problems disclosed over the past few months, some of which were already being attacked before a fix was ready.
NHS England thought this flaw was serious enough to issue its own high-severity alert, which is a strong signal for any NHS supplier or healthtech to pay attention. NetScaler devices are widely used across the NHS supply chain to manage secure remote access for staff and partner organisations. Because Citrix has had so many urgent NetScaler fixes recently, there is a real risk that organisations assume they are already covered when they are not. Anyone reporting through the NHS Data Security and Protection Toolkit (DSPT) should treat this as a fresh, separate check, not an extension of a patch already applied.
Recommendations:
Atlassian has told customers running its self-hosted "Data Center" products, which includes Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye, to patch a serious flaw, CVE-2026-21589, with a severity score of 9.3 out of 10. The bug lets someone with no account at all reach specific files inside the web application, as long as they already know the exact file name and location. They cannot browse a full list of files, but if sensitive information such as configuration files happens to sit in the wrong place, that could be exposed. Atlassian has already fixed the issue in its own cloud version, so only organisations running these tools on their own servers are affected.
Jira and Confluence are used across many UK businesses, NHS suppliers and healthtechs to manage projects, documentation and internal knowledge, sometimes including sensitive specifications, credentials or clinical system details. A self-hosted Confluence or Jira server reachable from the internet is now a real target. Organisations that have already moved to Atlassian's cloud service do not need to do anything, but anyone still running their own servers should treat this as urgent.
Recommendations:
Bromcom, which provides management software to more than 5,000 UK schools and 390 multi-academy trusts, has told customers about a data breach. An unauthorised third party accessed an old single sign-on (SSO) system that Bromcom thought it had replaced, but which had quietly been kept running because an internal system still relied on it. The intruder retrieved email addresses and some registration details, such as which sign-in provider was used and when someone last logged in. Bromcom says no passwords, authentication tokens, or pupil records from its main school management system were taken, and it has now withdrawn the old system from use.
This is a reminder that "legacy" systems quietly kept alive for one internal reason can become a hidden weak point, and it can happen to any organisation, not just schools. NHS suppliers and healthtechs often carry similar old components for compatibility reasons. Bromcom's customer list includes councils and the Ministry of Defence, showing how far these supplier relationships can reach. Anyone handling NHS data through a software supplier should also consider whether their own suppliers carry similar legacy risk.
Recommendations:
Online fashion retailer Asos has confirmed a data breach after customers received a fake notification through the Asos app, falsely claiming that criminals had broken into the company's systems and would leak information unless they were paid. Asos later explained what had actually happened: someone had pretended to be a trusted contact to trick a member of staff into handing over their login details. The attacker then used those details to get into some of the outside platforms Asos uses to store information, including a data warehousing service. Asos said names and contact details may have been accessed, but no payment card details or passwords. The company that runs the data warehousing service has said the break-in was not caused by any fault on its side. Asos's share price fell sharply when the news broke before recovering some of the loss.
This shows how tricking just one employee can expose data held well beyond a company's own systems, because the attacker moved sideways into third-party platforms the business relies on. UK digital health organisations and NHS suppliers often depend on a similar chain of outside platforms for storing and processing data, and a single successful social engineering attempt on one member of staff can be enough to reach them. It is a similar pattern to a wave of attacks on the same type of data warehousing service in 2024, which hit several large organisations and shows how effective this approach remains for attackers. Anyone completing the NHS Data Security and Protection Toolkit should treat staff awareness and third-party platform security as linked, not separate, risks.
Recommendations:
The UK and Germany have announced a new security partnership focused on countering cyberattacks and sabotage, particularly from Russia. The two countries say they will share information and coordinate efforts to monitor, deter and disrupt hostile activity, including threats to critical infrastructure. The announcement builds on an existing treaty between the two nations and comes as German intelligence officials warn that confrontation with Russia has entered a more dangerous phase, following incidents such as a suspected drone attack at a German airport.
The UK Prime Minister described these attacks as reaching "into people's homes and workplaces," which reflects a genuine rise in nation-state cyber activity aimed at UK organisations, not just government targets. For NHS suppliers, healthtechs and other organisations supporting critical infrastructure, this is a signal that the threat landscape is intensifying and that national authorities expect organisations to be prepared, not just reactive. While this announcement does not describe a specific new vulnerability, it reinforces why the vigilance shown elsewhere in this report matters.
Recommendations:
Want help staying ahead of threats like these? Contact Periculo about our Threat Intelligence services and find out how we support UK digital health organisations, healthtechs, and NHS suppliers with practical, hands-on cybersecurity assurance.