GitHub's own code cloned via VS Code add-on

The UK's cybersecurity sector reached £14.7 billion in annual revenue in 2026, growing 11% year on year across 2,603 firms. DSIT announced £90 million in targeted funding for small businesses supplying the NHS, alongside a voluntary Cyber Resilience Pledge requiring board-level cyber ownership and basic supply-chain certification.

The Pledge is voluntary for now, but the Cyber Security and Resilience Bill working through Parliament would make comparable requirements legally binding. Research on earlier UK voluntary schemes shows that uncertified smaller suppliers only adopt in meaningful numbers once procurement mandates follow, not when pledges launch. Read full version ↓

CISA added two flaws to its mandatory patch list on 21 May 2026: a CVSS 9.4 flaw in Langflow, a popular tool for building AI agent pipelines, and a directory-traversal flaw in Trend Micro Apex One. The federal deadline is 4 June. Iran-linked group MuddyWater was documented exploiting the Langflow flaw in March 2026, two months before CISA acted.

Langflow is dangerous to attack because it stores access keys for every service it connects to in one place. Many deployments were set up by data science Teams without IT security oversight, meaning they often sit outside standard patch management programmes entirely. Read full version ↓

A SQL injection flaw in Drupal, rated Highly Critical by the Drupal project despite a moderate CVSS score of 6.5, was added to CISA's mandatory patch list on 22 May 2026 with a five-day deadline. Imperva recorded over 15,000 attacks against roughly 6,000 sites within 48 hours. The flaw affects only Drupal installations backed by PostgreSQL, which is less than 5% of all Drupal deployments.

Government and university sites are over-represented in that minority because they are more likely to run PostgreSQL than shared-hosting sites. The gap between Drupal's urgency rating and the CVSS score illustrates why organisations relying purely on CVSS for patch prioritisation can underestimate CMS-layer database flaws. Read full version ↓

Jacob Butler, 23, of Ottawa, known online as 'Dort', was arrested on 21 May 2026 and charged in the US and Canada as the alleged operator of Kimwolf, an IoT botnet of over a million enslaved consumer devices. The botnet generated a claimed record 30 terabits per second of DDoS traffic targeting US military networks and caused over $1 million in losses.

The botnet's infrastructure had been seized on 19 March 2026 alongside three competing networks. The arrest follows a now-established pattern: seize infrastructure first to remove attack capacity, then arrest the operator once evidence is consolidated. The enslaved devices remain compromised and can be recruited by a new operator. Read full version ↓