This week's report:
Two more serious flaws in Citrix's NetScaler devices, one of which is already being attacked.
Iranian state-linked cyberattack that shut down a small UK power plant for four days.
A newly disclosed bug in GitLab was exploited within days of being made public.
Microsoft rushed to fix a maximum-severity flaw in its Entra ID identity service, though it later said the bug had not actually been used by attackers.
Criminals slipped malware into three popular building blocks used by software developers,
A suspected Russian state hacker has been caught hijacking accounts by abusing Google sign-in and WhatsApp.
Read on to find out what happened...
Citrix has released fixes for two separate flaws in NetScaler ADC and NetScaler Gateway, the devices many organisations use to let staff connect to work systems remotely, similar to a VPN. The first flaw, CVE-2026-19490, could let an attacker with no account at all get past the login screen completely. The second, CVE-2026-8452, was first thought to only cause devices to crash, but security researchers have since shown it can let an attacker run their own code on the device. NHS England says this second flaw has now been used in real attacks, after a working exploit was shared publicly, and rated it as almost certain that more attacks will follow.
NetScaler devices sit on the edge of a network, facing the internet, which makes them a favourite target for criminals. A break-in here can give an attacker a foothold inside an organisation's network, bypassing passwords entirely. NHS trusts, GP practices, and NHS suppliers often use these devices for staff and partner access, so an unpatched NetScaler could put patient systems at risk. Any organisation reporting incidents like this as part of its NHS Data Security and Protection Toolkit (DSPT) submission should treat this as a live risk, not a routine update.
Recommendations:
A small UK power plant was shut down for four days last month after a cyber attack, according to reports. The Telegraph says the attack was carried out by hackers linked to the Iranian regime. The Department for Energy Security and Net Zero (DESNZ) confirmed a small-scale generator was affected, but said there was at no point a risk to the UK's wider energy system. Neither the government nor the National Cyber Security Centre, which handles attacks on critical infrastructure, will say which site was hit, for security reasons, though they have confirmed it was not an essential service such as a large power station. DESNZ has since written to power companies to remind them of the risk of cyber attacks.
This is a rare confirmed case of state-linked hackers actually knocking a piece of UK energy infrastructure offline, even though the affected site was small and the disruption was contained. It is a reminder that critical infrastructure is a live target, not just a theoretical risk, and Iran is regarded as a capable cyber actor whose activity Western security experts have been watching closely amid its tensions with the US. UK digital health organisations and NHS suppliers that depend on continuous power for critical systems should also treat this as a prompt to check their own resilience and business continuity plans, since disruption to energy supply can affect any sector, not just the energy industry itself.
Recommendations:
GitLab, a platform many software teams use to store and manage their code, had a serious flaw made public this week. The flaw, CVE-2026-19478, let an attacker with no account modify or even delete public GitLab projects, and in some cases change their settings, without needing a password or any help from a user. Within days of the flaw being announced, a security firm called watchTowr said it had already reproduced the attack and seen it being tried against its own honeypot, a decoy system set up to attract attackers.
Software development platforms like GitLab often hold an organisation's most valuable asset: its source code. Any digital health company or NHS supplier that builds its own software could lose or have its code tampered with if this flaw is left unpatched. Because working attack methods appeared so quickly after the flaw was disclosed, the usual grace period organisations rely on before patching has almost disappeared.
Recommendations:
Microsoft fixed a flaw in Entra ID, its cloud service that handles logins and access for millions of businesses, that scored the maximum possible severity rating of 10 out of 10. The flaw could have let an attacker with no account run their own code on Microsoft's systems, without tricking anyone into clicking anything. Microsoft's own bulletin briefly stated the flaw had already been exploited, but the company corrected this after being asked about it, saying the bug had not actually been used by attackers. Because Entra ID is run by Microsoft rather than installed by customers, no action was needed from businesses; Microsoft fixed it centrally.
Entra ID (formerly known as Azure Active Directory) is the login system behind Microsoft 365 and many other cloud tools used by UK businesses, NHS trusts, and healthtechs. A flaw this severe in a system so many organisations depend on is a reminder of how much trust is placed in cloud providers, even when no customer action is required. It is also a useful lesson in why security bulletins should be treated as a starting point for questions, not the final word, since even vendors sometimes get early details wrong.
Recommendations:
Someone gained control of a developer's account on crates.io, the online library where programmers download reusable pieces of code written in the Rust programming language. They used it to publish tampered versions of three widely used packages that, put together, have been downloaded hundreds of millions of times over the years. The tampered versions contained a hidden step that downloaded and ran extra code automatically whenever a program using them was being built. The Rust security team caught and removed the bad versions within roughly 90 minutes, and says it has found no evidence that the malicious code was actually used against anyone.
Modern software, including tools built by NHS suppliers and digital health companies, is often built from hundreds of small, freely shared building blocks like these. If a criminal can slip bad code into just one of them, it can spread automatically into every piece of software that uses it, without any obvious warning sign. This incident was caught quickly and appears not to have caused harm, but it shows how a single compromised account can threaten a huge amount of software all at once.
Recommendations:
Google says three separate groups of suspected Russian state-backed hackers have been running patient, carefully targeted phishing campaigns against people working in academia, aerospace, defence, government, and research organisations across Europe and the US. Rather than using obvious fake login pages, the hackers abuse genuine sign-in processes, for example asking a target to share a verification code after a real Google login, or tricking them into linking their WhatsApp account to a device the attacker controls. Because these tricks use real, trusted systems, they can slip past people who have been trained to spot an obviously fake website.
Anyone in the UK working in research, policy, defence-adjacent industries, or with government contacts could be a target for this kind of patient, personalised phishing. The same techniques could just as easily be turned on staff at UK digital health organisations or NHS suppliers with valuable research, contracts, or contacts. Because these attacks exploit trust in genuine login and messaging processes, general "spot the fake website" training is not enough on its own.
Recommendations:
Want help staying ahead of threats like these? Contact Periculo about our Threat Intelligence services and find out how we support UK digital health organisations, healthtechs, and NHS suppliers with practical, hands-on cybersecurity assurance.