Threat Report 189

This week's report:

Two more serious flaws in Citrix's NetScaler devices, one of which is already being attacked.

Iranian state-linked cyberattack that shut down a small UK power plant for four days.

A newly disclosed bug in GitLab was exploited within days of being made public.

Microsoft rushed to fix a maximum-severity flaw in its Entra ID identity service, though it later said the bug had not actually been used by attackers.

Criminals slipped malware into three popular building blocks used by software developers,

A suspected Russian state hacker has been caught hijacking accounts by abusing Google sign-in and WhatsApp.

Read on to find out what happened...

Two More Serious Flaws Found in Citrix NetScaler Devices

Citrix has released fixes for two separate flaws in NetScaler ADC and NetScaler Gateway, the devices many organisations use to let staff connect to work systems remotely, similar to a VPN. The first flaw, CVE-2026-19490, could let an attacker with no account at all get past the login screen completely. The second, CVE-2026-8452, was first thought to only cause devices to crash, but security researchers have since shown it can let an attacker run their own code on the device. NHS England says this second flaw has now been used in real attacks, after a working exploit was shared publicly, and rated it as almost certain that more attacks will follow.

NetScaler devices sit on the edge of a network, facing the internet, which makes them a favourite target for criminals. A break-in here can give an attacker a foothold inside an organisation's network, bypassing passwords entirely. NHS trusts, GP practices, and NHS suppliers often use these devices for staff and partner access, so an unpatched NetScaler could put patient systems at risk. Any organisation reporting incidents like this as part of its NHS Data Security and Protection Toolkit (DSPT) submission should treat this as a live risk, not a routine update.

Recommendations:

• Check whether your organisation, or any IT provider working on your behalf, runs NetScaler ADC or NetScaler Gateway.
• Apply Citrix's fixes from advisories CTX696939 and CTX696604 as soon as possible.
• Treat any internet-facing NetScaler device as an urgent priority for patching.
• Ask your IT provider to confirm in writing that patching has been completed.
• Review NetScaler logs for unusual login attempts or unexpected activity.
• Report any suspected compromise to the NHS England Cyber Security Operations Centre on 0300 303 5222 or cybersecurity@nhs.net.

Suspected Iranian Hackers Shut Down a UK Power Plant

A small UK power plant was shut down for four days last month after a cyber attack, according to reports. The Telegraph says the attack was carried out by hackers linked to the Iranian regime. The Department for Energy Security and Net Zero (DESNZ) confirmed a small-scale generator was affected, but said there was at no point a risk to the UK's wider energy system. Neither the government nor the National Cyber Security Centre, which handles attacks on critical infrastructure, will say which site was hit, for security reasons, though they have confirmed it was not an essential service such as a large power station. DESNZ has since written to power companies to remind them of the risk of cyber attacks.

This is a rare confirmed case of state-linked hackers actually knocking a piece of UK energy infrastructure offline, even though the affected site was small and the disruption was contained. It is a reminder that critical infrastructure is a live target, not just a theoretical risk, and Iran is regarded as a capable cyber actor whose activity Western security experts have been watching closely amid its tensions with the US. UK digital health organisations and NHS suppliers that depend on continuous power for critical systems should also treat this as a prompt to check their own resilience and business continuity plans, since disruption to energy supply can affect any sector, not just the energy industry itself.

Recommendations:

• Review your organisation's business continuity and backup power plans in case of a similar disruption to your electricity supply.
• If your organisation operates or supplies equipment to UK energy infrastructure, review DESNZ's updated cyber security guidance and the National Cyber Security Centre's advice for the sector.
• Treat state-linked threats to critical national infrastructure as a standing risk when reviewing your own supply chain and third-party dependencies.
• Keep an eye on National Cyber Security Centre alerts for updates on Iranian state-linked cyber activity.
• Include dependency on external infrastructure, such as energy, water, and telecoms, in your organisation's business continuity and disaster recovery planning.

Newly Disclosed GitLab Flaw Attacked Within Days

GitLab, a platform many software teams use to store and manage their code, had a serious flaw made public this week. The flaw, CVE-2026-19478, let an attacker with no account modify or even delete public GitLab projects, and in some cases change their settings, without needing a password or any help from a user. Within days of the flaw being announced, a security firm called watchTowr said it had already reproduced the attack and seen it being tried against its own honeypot, a decoy system set up to attract attackers.

Software development platforms like GitLab often hold an organisation's most valuable asset: its source code. Any digital health company or NHS supplier that builds its own software could lose or have its code tampered with if this flaw is left unpatched. Because working attack methods appeared so quickly after the flaw was disclosed, the usual grace period organisations rely on before patching has almost disappeared.

Recommendations:

• Check which version of GitLab Community Edition or Enterprise Edition your organisation runs.
• Update to the fixed versions: 19.2.4, 19.1.6, 19.0.8, or 18.11.11, as appropriate.
• If you cannot patch immediately, restrict access to your GitLab instance to trusted networks only.
• Review recent changes to your GitLab projects for anything unexpected.
• Include code repository platforms in your regular vulnerability management and DSPT evidence.

Microsoft Rushes to Fix Maximum-Severity Entra ID Flaw

Microsoft fixed a flaw in Entra ID, its cloud service that handles logins and access for millions of businesses, that scored the maximum possible severity rating of 10 out of 10. The flaw could have let an attacker with no account run their own code on Microsoft's systems, without tricking anyone into clicking anything. Microsoft's own bulletin briefly stated the flaw had already been exploited, but the company corrected this after being asked about it, saying the bug had not actually been used by attackers. Because Entra ID is run by Microsoft rather than installed by customers, no action was needed from businesses; Microsoft fixed it centrally.

Entra ID (formerly known as Azure Active Directory) is the login system behind Microsoft 365 and many other cloud tools used by UK businesses, NHS trusts, and healthtechs. A flaw this severe in a system so many organisations depend on is a reminder of how much trust is placed in cloud providers, even when no customer action is required. It is also a useful lesson in why security bulletins should be treated as a starting point for questions, not the final word, since even vendors sometimes get early details wrong.

Recommendations:

• No patching action is required for this specific flaw, as Microsoft has fixed it on its own systems.
• Use this as a prompt to review what would happen to your organisation if your identity provider (Microsoft, Google, or other) suffered a serious breach.
• Make sure multi-factor authentication is switched on for all Microsoft 365 and Entra ID accounts.
• Keep a record of vendor security bulletins relevant to your core cloud services for your DSPT or risk register.
• Subscribe to Microsoft's security advisories so you hear about future issues quickly.

Malicious Code Slipped Into Popular Rust Building Blocks

Someone gained control of a developer's account on crates.io, the online library where programmers download reusable pieces of code written in the Rust programming language. They used it to publish tampered versions of three widely used packages that, put together, have been downloaded hundreds of millions of times over the years. The tampered versions contained a hidden step that downloaded and ran extra code automatically whenever a program using them was being built. The Rust security team caught and removed the bad versions within roughly 90 minutes, and says it has found no evidence that the malicious code was actually used against anyone.

Modern software, including tools built by NHS suppliers and digital health companies, is often built from hundreds of small, freely shared building blocks like these. If a criminal can slip bad code into just one of them, it can spread automatically into every piece of software that uses it, without any obvious warning sign. This incident was caught quickly and appears not to have caused harm, but it shows how a single compromised account can threaten a huge amount of software all at once.

Recommendations:

• If your organisation writes its own software using Rust, check whether you use the affected packages: arrayref, interning, or append-only-vec.
• Clear your local package cache and confirm you are using a safe, current version of any affected package.
• Ask software suppliers and developers you work with how they check for tampering in the building blocks they use.
• Consider tools that alert you automatically when a dependency in your software changes unexpectedly.
• Treat supply chain risk in software development as part of your third-party risk assessments, not just physical or cloud suppliers.

Suspected Russian Hackers Hijack Accounts Through Google and WhatsApp

Google says three separate groups of suspected Russian state-backed hackers have been running patient, carefully targeted phishing campaigns against people working in academia, aerospace, defence, government, and research organisations across Europe and the US. Rather than using obvious fake login pages, the hackers abuse genuine sign-in processes, for example asking a target to share a verification code after a real Google login, or tricking them into linking their WhatsApp account to a device the attacker controls. Because these tricks use real, trusted systems, they can slip past people who have been trained to spot an obviously fake website.

Anyone in the UK working in research, policy, defence-adjacent industries, or with government contacts could be a target for this kind of patient, personalised phishing. The same techniques could just as easily be turned on staff at UK digital health organisations or NHS suppliers with valuable research, contracts, or contacts. Because these attacks exploit trust in genuine login and messaging processes, general "spot the fake website" training is not enough on its own.

Recommendations:

• Train staff never to share a verification code or approve a login prompt they did not start themselves, even if it looks genuine.
• Be especially cautious with WhatsApp "linked device" requests and Google account sign-in prompts received unexpectedly.
• Encourage staff in research, policy, or senior roles to report unusual or unexpected sign-in requests immediately.
• Review and limit which apps and devices are linked to important business and personal accounts.
• Include this style of targeted, trust-based phishing in security awareness training, alongside standard phishing advice.

Want Help Staying Ahead of Threats Like These?

Want help staying ahead of threats like these? Contact Periculo about our Threat Intelligence services and find out how we support UK digital health organisations, healthtechs, and NHS suppliers with practical, hands-on cybersecurity assurance.