https://www.nanorisk.co.uk/content.html Vulnerability analysis, threat intelligence and security commentary from the Nanorisk testing team. en-gb Thu, 10 Sep 2026 14:59:49 +0000 https://www.nanorisk.co.uk/content/magento-zero-day-patch-urgent-warning.html https://www.nanorisk.co.uk/content/magento-zero-day-patch-urgent-warning.html Adobe has patched CVE-2026-75650, a CVSS 10.0 zero-day affecting Magento Open Source and Adobe Commerce, following confirmed exploitation in the wild… Wed, 09 Sep 2026 10:30:43 +0000 https://www.nanorisk.co.uk/content/data-egress-and-removable-media-controls.html https://www.nanorisk.co.uk/content/data-egress-and-removable-media-controls.html A breach isn't always required for data to leave your organisation. In many cases, it just walks out through gaps that nobody has formally assessed. Three… Fri, 04 Sep 2026 14:00:46 +0000 https://www.nanorisk.co.uk/content/hardcoded-secrets-in-mobile-apps.html https://www.nanorisk.co.uk/content/hardcoded-secrets-in-mobile-apps.html Shipping a mobile app or frontend bundle with hardcoded credentials is not a calculated risk. It is handing every user who downloads the app the keys to… Wed, 02 Sep 2026 10:00:39 +0000 https://www.nanorisk.co.uk/content/nasa-ait-gui-spacecraft-command-vulnerability-disclosure.html https://www.nanorisk.co.uk/content/nasa-ait-gui-spacecraft-command-vulnerability-disclosure.html Cycode have disclosed a vulnerability chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as… Tue, 01 Sep 2026 12:00:43 +0000 https://www.nanorisk.co.uk/content/bank-holiday-security-awareness-reminder.html https://www.nanorisk.co.uk/content/bank-holiday-security-awareness-reminder.html Bank holidays are a reliable opportunity for attackers, and the reason is straightforward: staffing drops, response times slow, and security alerts sit… Fri, 28 Aug 2026 13:00:44 +0000 https://www.nanorisk.co.uk/content/nanorisk-achieves-crest-accreditation-milestone.html https://www.nanorisk.co.uk/content/nanorisk-achieves-crest-accreditation-milestone.html We're pleased to confirm that Nanorisk is now a CREST accredited organisation. CREST accreditation is an independently assessed standard covering the… Thu, 27 Aug 2026 10:55:23 +0000 https://www.nanorisk.co.uk/content/free-vulnerability-retesting-offer.html https://www.nanorisk.co.uk/content/free-vulnerability-retesting-offer.html A penetration test produces a report. What happens after that report is where most engagements fall short. Remediation takes time and resource, and it's… Wed, 26 Aug 2026 10:45:23 +0000 https://www.nanorisk.co.uk/content/adcs-esc1-privilege-escalation-explained.html https://www.nanorisk.co.uk/content/adcs-esc1-privilege-escalation-explained.html Active Directory Certificate Services is present in the vast majority of enterprise Windows environments, and ESC1 is one of the most consistently… Mon, 24 Aug 2026 09:00:22 +0000 https://www.nanorisk.co.uk/content/explaining-our-scoping-call-process.html https://www.nanorisk.co.uk/content/explaining-our-scoping-call-process.html A question we get regularly: how do you scope a penetration test if you're not sure what you need? The honest answer is that figuring out what you need is… Fri, 21 Aug 2026 11:20:23 +0000 https://www.nanorisk.co.uk/content/macos-screen-sharing-exploit-warning.html https://www.nanorisk.co.uk/content/macos-screen-sharing-exploit-warning.html The Netherlands' NCSC has issued an active warning: a macOS Screen Sharing authentication bypass vulnerability is being exploited in the wild, following… Thu, 20 Aug 2026 10:00:25 +0000 https://www.nanorisk.co.uk/content/office-printer-security-risk-explained.html https://www.nanorisk.co.uk/content/office-printer-security-risk-explained.html Tip Tuesday: the network printer is a more useful foothold than most IT teams expect. Printers running an unauthenticated web management interface -… Tue, 18 Aug 2026 01:45:43 +0000 https://www.nanorisk.co.uk/content/choosing-a-penetration-testing-supplier-wisely.html https://www.nanorisk.co.uk/content/choosing-a-penetration-testing-supplier-wisely.html Before you commission a penetration test, ask the supplier one question: can I see a sample report? Scope and day rate get most of the attention during… Mon, 17 Aug 2026 10:45:23 +0000 https://www.nanorisk.co.uk/content/explaining-different-types-of-password-attacks.html https://www.nanorisk.co.uk/content/explaining-different-types-of-password-attacks.html Password attacks get discussed as though they're a single problem. They aren't, and treating them that way leads to defences that only address part of the… Fri, 14 Aug 2026 10:30:41 +0000 https://www.nanorisk.co.uk/content/nation-state-ios-exploits-now-widely-proliferating.html https://www.nanorisk.co.uk/content/nation-state-ios-exploits-now-widely-proliferating.html The Coruna and DarkSword iOS exploit chains have moved beyond nation-state use. According to reporting from Dark Reading, these sophisticated iPhone… Thu, 13 Aug 2026 12:00:42 +0000 https://www.nanorisk.co.uk/content/smb-share-permissions-misconfiguration-warning.html https://www.nanorisk.co.uk/content/smb-share-permissions-misconfiguration-warning.html On internal penetration tests, misconfigured SMB shares have become one of the most consistent findings we're documenting - and the misconfiguration isn't… Wed, 12 Aug 2026 11:40:40 +0000 https://www.nanorisk.co.uk/content/polish-power-plant-ot-network-breach.html https://www.nanorisk.co.uk/content/polish-power-plant-ot-network-breach.html Attackers shut down a steam turbine and process-water treatment system at a Polish combined heat and power plant this month. The plant supplies heat to… Tue, 11 Aug 2026 10:20:23 +0000 https://www.nanorisk.co.uk/content/five-interesting-cybersecurity-facts.html https://www.nanorisk.co.uk/content/five-interesting-cybersecurity-facts.html A few facts worth knowing - not the usual statistics recycled from vendor whitepapers. 1. The average dwell time for an attacker inside a network before… Fri, 07 Aug 2026 11:35:37 +0000 https://www.nanorisk.co.uk/content/external-infrastructure-assessment-methodology-explained.html https://www.nanorisk.co.uk/content/external-infrastructure-assessment-methodology-explained.html Most external infrastructure assessments follow the same pattern: run a scan, map the output to CVEs, produce a report. That process has value, but it… Thu, 06 Aug 2026 11:05:43 +0000 https://www.nanorisk.co.uk/content/russian-apt-targeting-public-wi-fi-networks.html https://www.nanorisk.co.uk/content/russian-apt-targeting-public-wi-fi-networks.html Midnight Blizzard, the Russian state-sponsored threat group previously linked to the SolarWinds compromise, has been operating a credential theft campaign… Wed, 05 Aug 2026 14:00:39 +0000 https://www.nanorisk.co.uk/content/introducing-nanorisk-client-security-portal.html https://www.nanorisk.co.uk/content/introducing-nanorisk-client-security-portal.html One of the less glamorous but genuinely important parts of running a structured assessment service is what happens after the test - how findings are… Tue, 04 Aug 2026 11:16:38 +0000 https://www.nanorisk.co.uk/content/explaining-scan-vs-pentest-vs-red-team.html https://www.nanorisk.co.uk/content/explaining-scan-vs-pentest-vs-red-team.html These three terms get used interchangeably far too often, and it leads to organisations paying for the wrong thing. A vulnerability scan is automated. It… Mon, 03 Aug 2026 11:45:30 +0000 https://www.nanorisk.co.uk/content/openai-astra-ai-capability-milestone.html https://www.nanorisk.co.uk/content/openai-astra-ai-capability-milestone.html OpenAI has revealed Astra, an as-yet unreleased model that has already produced ten significant advances in mathematics and theoretical computer science… Mon, 03 Aug 2026 09:45:22 +0000 https://www.nanorisk.co.uk/content/sysadmin-appreciation-day-shoutout.html https://www.nanorisk.co.uk/content/sysadmin-appreciation-day-shoutout.html Today is Sysadmin Appreciation Day, and it's one we're genuinely happy to mark. Penetration testing doesn't happen in isolation. Behind almost every… Fri, 31 Jul 2026 10:45:39 +0000 https://www.nanorisk.co.uk/content/promoting-nanorisk-key-selling-points.html https://www.nanorisk.co.uk/content/promoting-nanorisk-key-selling-points.html If you're evaluating penetration testing providers, here's what we think you should be asking for - and what we deliver as standard. Every Nanorisk… Wed, 29 Jul 2026 11:00:25 +0000 https://www.nanorisk.co.uk/content/wordpress-rce-chain-mass-exploitation-explained.html https://www.nanorisk.co.uk/content/wordpress-rce-chain-mass-exploitation-explained.html The wp2shell exploitation campaign is a useful case study in why chained vulnerabilities are disproportionately dangerous compared to isolated findings… Tue, 28 Jul 2026 10:00:24 +0000 https://www.nanorisk.co.uk/content/coca-cola-fairlife-ransomware-data-theft.html https://www.nanorisk.co.uk/content/coca-cola-fairlife-ransomware-data-theft.html Coca-Cola has confirmed that data was stolen from Fairlife, its dairy subsidiary, as part of a ransomware attack earlier this month. The detail worth… Mon, 27 Jul 2026 16:30:22 +0000 https://www.nanorisk.co.uk/content/new-nanorisk-website-launch.html https://www.nanorisk.co.uk/content/new-nanorisk-website-launch.html We've launched our new website at nanorisk.co.uk, and we'd genuinely encourage you to take a look - not because it's new, but because it sets out clearly… Mon, 27 Jul 2026 14:35:33 +0000