https://garzoncybersolutions.com/insights.html Threat Landscape briefings from Garzon Cyber Solutions. Threat briefings and market analysis from Garzon Cyber Solutions. Cyber security incidents, regulatory change and what both mean commercially for organisations operating in the UK, the EU and the Americas. en-gb Garzon Cyber Solutions jonathan@garzoncybersolutions.com (Jonathan Garzon) jonathan@garzoncybersolutions.com (Jonathan Garzon) Fri, 09 Oct 2026 05:27:01 +0000 Fri, 09 Oct 2026 09:00:00 +0100 GCS RSS generator https://garzoncybersolutions.com/gcs_threat_briefing_pushchannel/ https://garzoncybersolutions.com/gcs_threat_briefing_pushchannel/ On 6 October 2026 ASOS customers received a push notification from the official ASOS app announcing the company had been hacked. The app was not broken into. ASOS has confirmed an unauthorised party obtained an employee account's log in credentials by impersonating a trusted contact, then used them to reach third party platforms the retailer uses to communicate with customers. The exposure sits in the customer engagement layer, which holds the customer record, the behavioural history that makes phishing convert and the authenticated right to publish under the brand, usually behind a single login procured on a marketing budget. Fri, 09 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_validcerts/ https://garzoncybersolutions.com/gcs_threat_briefing_validcerts/ On 6 October 2026 Google disclosed domain hijacks in the .gh, .sl and .as country-code namespaces. Attackers compromised the third-party registries, rewrote authoritative DNS and obtained publicly trusted HTTPS certificates for names they did not own. Google says its own systems were not compromised and that it has no reason to believe the issuing certificate authorities did anything wrong. Every stage of the failure sat outside the organisations named on the certificates, which is what makes this a governance problem rather than a patching one: the incident window is the hijack plus the validation reuse period, and the rules permit that to run to two hundred days. Thu, 08 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_fixversion/ https://garzoncybersolutions.com/gcs_threat_briefing_fixversion/ Dell published DSA-2026-448 on 1 October for Container Storage Modules: thirteen proprietary flaws, six critical, two at CVSS 10.0 for missing authentication sitting in front of storage administrator credentials. The Workarounds and Mitigations section reads None. The harder problem is the table underneath. Affected is given as versions prior to 1.17.0 and the fix as 1.18.0 or later, one listed flaw is recorded against 1.18.0 itself, and the critical entries cite component versions rather than the release. The question of whether you are exposed cannot be answered from the advisory, which makes this an inventory problem before it is a patching one. Mon, 05 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_fortimailibe/ https://garzoncybersolutions.com/gcs_threat_briefing_fortimailibe/ Fortinet disclosed CVE-2026-104286 in FortiMail on 1 October, an unauthenticated arbitrary file write at CVSS 9.8, reported to be exploited in the wild. CISA catalogued it the same day with a remediation date of 4 October. The fixed builds are labelled upcoming in the advisory and have not shipped, and the 7.2 branch gets no in branch fix at all. With nothing to install, the vendor's first suggested workaround is to disable the encryption feature regulated firms use to send confidential mail to clients. That is a governance decision about which obligation to suspend, not a patch window. The published indicator set points at the appliance's own logging. Fri, 02 Oct 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_identifiedentrypoint/ https://garzoncybersolutions.com/gcs_threat_briefing_identifiedentrypoint/ ENISA published its Threat Landscape 2026 on 22 September, analysing 8,257 incidents recorded across 2025. The figure being quoted is 73%, the share of recorded events involving essential and important entities under NIS2. The one nobody is quoting sits seven pages earlier. Unauthorised access was 39.5% of recorded activity, and ENISA could identify an intrusion vector in only 5.2% of it, around 2% of the dataset. An organisation that cannot establish an entry point cannot tell a regulator what was affected, tell a customer whether their data moved, or make a clean insurance claim. Thu, 24 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_deadlineaugust/ https://garzoncybersolutions.com/gcs_threat_briefing_deadlineaugust/ This week CISA warned that ransomware gangs have joined the attacks on a VMware vCenter flaw, CVE-2026-59310, that Broadcom patched on 29 July. The federal deadline to apply it was 21 August. Root on vCenter is root on the console that runs the whole virtual estate. Ransomware arriving seven weeks after the fix is a signal about the defenders, not the attackers: enough unpatched, internet-facing control planes remain to make it worthwhile. A passed deadline is not a closed risk, and patching does not evict an intruder already inside. Wed, 16 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_tsacode/ https://garzoncybersolutions.com/gcs_regulatory_briefing_tsacode/ Version 1.1 of the Telecommunications Security Code of Practice landed on 14 July 2026. Its explanatory memorandum says the law has not changed, and that there is no significant impact on businesses outside Tier 1 and Tier 2. The first is true. The second describes the document rather than the market: privileged access, API and patching guidance all reach suppliers through contracts, and the 2028 deadline is a procurement date for anyone selling into a large operator. Wed, 16 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_arrive/ https://garzoncybersolutions.com/gcs_threat_briefing_arrive/ A crafted email gives an unauthenticated attacker root on the Cisco Secure Email Gateway built to inspect it. Nobody opens anything and nothing is clicked. Cisco reported active exploitation before the advisory existed, there is no workaround, and every physical and virtual appliance is affected regardless of configuration. CISA listed it as exploited the same day. The device that reads every inbound message in clear text is also the one that can erase the evidence it was compromised. Tue, 15 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_fakerequest/ https://garzoncybersolutions.com/gcs_threat_briefing_fakerequest/ Revolut released customers' identity documents, verification selfies, IBANs and full transaction histories to a fraudster who emailed from a genuine government agency domain. Nothing was hacked. The message passed domain authentication because it really did come from that domain, and the lawful request team released the files. Almost every organisation that holds customer data has the same channel and almost none of them monitors it. Mon, 14 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_threat_briefing_patchgap/ https://garzoncybersolutions.com/gcs_threat_briefing_patchgap/ A fix for a Chrome flaw sat in public Chromium source for 27 days before it reached the version people run. Someone read the diff, built a working exploit, chained it with a Windows kernel flaw, and within six days five named espionage clusters were using the same kit against NGOs, aerospace suppliers and finance across four countries. Fri, 11 Sep 2026 09:00:00 +0100 GCS Threat Briefing Jonathan Garzon