https://rto.me.uk/ Recent content on Robin Oldham Hugo -- gohugo.io en Copyright © Robin Oldham. https://rto.me.uk/newsletter/robins-newsletter-433/ Sun, 04 Oct 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-433/ This week I’ve been away this weekend helping at a large Scout camp for young people, so this week is an abridged round-up before I go and sort out our group’s kit (fortunately mostly dry, as the weather was kind!). Interesting stats 57% (2025: 49%) of UK businesses report a basic cyber skills gap, and 53% of cyber firms expect to grow their workforce in 2026, with 145,900 individuals being employed in cyber across the UK, and £30,001-£35,000 being the median graduate salary, 15 months after graduating, according to DCMS & DSIT. https://rto.me.uk/newsletter/robins-newsletter-432/ Sun, 27 Sep 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-432/ This week ShinyHunters breaches FBI systems OpenAI agents broke into Aussie government system NHS Trust accidentally overwrote maternity records Interesting stats 1,787 US water and wastewater organisations have passwords or credentials leaked by Infostealer malware, according to SpyCloud. 0.5% of Project Glasswing — Anthropic’s invite-only cyber programme — vulnerabilities have gone on to be exploited in the wild, and just 26% of AI-generated vulnerability fixes actually eliminated the issue, and 54% of the time they didn’t, or introduced another security issue. https://rto.me.uk/newsletter/robins-newsletter-431/ Sun, 20 Sep 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-431/ This week US boards two vessels, suspected cyber attack victims Google says Gemini compromised orgs, then stopped in testing Treasury Secretary says AI companies should be held liable EC President calls for co-ordinated response to cyber, sabotage Amazon lost data in missile strikes against ME data centres Interesting stats $10.5 million stolen by North Korean actors from job seekers across 100 countries, infecting 30,000 devices, and compromising 7,000 cryptocurrency wallets, according to the FBI and Japan’s National Policy Agency $1. https://rto.me.uk/newsletter/robins-newsletter-430/ Sun, 13 Sep 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-430/ This week This week marks Cydea’s 7th birthday. I founded the company back I n2019 to bring the world more positive security. Over 30 people have been part of the team in that time, delivering over 250 projects to customers starting with every letter of the alphabet but X (please get in touch if you can help with this! 😉). A big thank you to all colleagues, customers, and collaborators past and present! https://rto.me.uk/newsletter/robins-newsletter-429/ Sat, 05 Sep 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-429/ This week US pilot aims to boost water industry cyber resilience, but can it scale? Claims a US identity verification service has been breached, exposing 153M IDs Anthropic admits it hasn’t adopted good security practices Reports OpenAI agents ‘hijacked’ a German wiki to communicate UK government rejects calls to regulate AI in CSRB Interesting stats $1 billion worth of credits pledged by OpenAI for frontline cyber defenders to spend with OpenAI to shore up their defences as OpenAI released its “most capable” cyber model, Astra, this week. https://rto.me.uk/newsletter/robins-newsletter-428/ Sun, 30 Aug 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-428/ This week UK Gov reviewing “home defence” resilience plans; granting itself powers to block foreign tech. Alabama AG opens investigation into OpenAI hacking spree Manchester Airport Group data breach affects 8.7 million passengers Interesting stats X% your personal estimated identifiability, according to a diagnostic tool created by a researcher to show how identifiable you are (or aren’t!), based on common fingerprinting techniques used by data brokers and ad tracking firms to follow you around the internet: Glassbox. https://rto.me.uk/newsletter/robins-newsletter-427/ Sun, 23 Aug 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-427/ This week Small UK power plant offline for 4 days last month following cyber-attack AI firms promise better segregation, monitoring, in response to rogue models Copilot helpfully told researchers how to hack it 3.7M people affected by US electronic health records breach Poor expiry date checks may allow ‘zombie card’ contactless payments Interesting stats $100 at the lower end, up to $1 million at the top end offered by Medusa ransomware gang for access to 200 victims’ networks last year. https://rto.me.uk/newsletter/robins-newsletter-426/ Sun, 16 Aug 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-426/ A really cut-down list this week because I’ve got a 7-hour drive from Edinburgh to Oxford. Interesting stats 30% of manufacturers experienced a cyber incident in the past 12 months, according to industry body MakeUK. In brief President Trump has signed an executive order to open the way for private sector participation in “limited cyber operations at the direction of the US government”. This is a pretty nuanced area that would be very easy to get wrong. https://rto.me.uk/newsletter/robins-newsletter-425/ Sun, 09 Aug 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-425/ A slightly cut-down format this week as I’m travelling. Interesting stats 85% (2024: 17.7%) of Resilience’s incurred losses stem from exploiting human error (phishing, social engineering, transfer fraud), according to the insurance company who attribute the rise to AI making traditional techniques more effective against victims. 1/3 of dangerous AI coding agent requests were approved by humans in the loop, according to 40,000 runs of a simple online game published by a Belgian software developer. https://rto.me.uk/newsletter/robins-newsletter-423/ Sun, 26 Jul 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-423/ This week OpenAI agent attacks Hugging Face (and is bad at security?) Lawmakers scramble to bring in AI ‘kill switch’ legislation Researchers show AI workloads can be used to damage power grids Romania’s land registry busy rebuilding systems after attack Some continuity for UK cyber policy amidst departmental shuffle Interesting stats 54% of organisations affected by ransomware paid up, however 37% of those who paid received a second extortion demand, according to a Proofpoint survey of 953 companies. https://rto.me.uk/newsletter/robins-newsletter-424/ Sun, 26 Jul 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-424/ This week Have fun at hacker summer camp, if you’re heading to Vegas this week. Claude also likes to break out of sandboxes and into organisations Suspected Iranian attacks against 30 Minnesotan water systems Google rebrands its threat actor naming conventions Interesting stats 1.3% of Anthropic’s Project Glasswing vulnerabilities have been added to CISA’s known exploited vulnerabilities list, which is almost identical to VulnCheck’s non-AI dataset $4.99M (+12%) the global average cost of a data breach 92% of organisations reporting an AI-related breach lacked proper AI access controls 38% of breaches were identified by the IT or security team, 31% by an MSSP, 17% from attacker disclosure, and 14% from a third-party, according to IBM’s Cost of a Data Breach 2026 report (PDF) https://rto.me.uk/newsletter/robins-newsletter-422/ Sun, 19 Jul 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-422/ This week EU blames Russia for Poland grid attack Australian medical records breached at large provider Adversaries using spoofed app IDs to probe Entra creds South Korea is building a cyber vulnerability AI Using prompt injection against attackers in context bombing Interesting stats 55pp decrease (to 5%) in successful admin privilege escalation, and 35pp decrease (to 1%) in establishing persistence across five models and 152 attack runs by Tracebit, when using ‘context bombing’ prompt injections to help defence (see Five Things, below). https://rto.me.uk/newsletter/robins-newsletter-421/ Sun, 12 Jul 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-421/ This week Accenture downplays data breach Linux virtual machine escape vulnerability nets $250K payout UK financial regulators given powers over AWS, GCP, Microsoft and Oracle EU sues four member states for not implementing NIS2 HalluSquatting and GhostCommit tactics against AI coding assistants and agents Interesting stats 2,279 victims claimed by cybercriminal actors in Q2 2026, a 7% increase over Q1 2026, and 43% year-on-year increase from Q2 2025, with 40% of attacks are being conducted by one of five main ransomware groups, according to GuidePoint. https://rto.me.uk/newsletter/robins-newsletter-420/ Sun, 05 Jul 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-420/ This week Anthropic reaches agreement with US gov to restore access DeepSeek will ‘happily’ create ransomware for you EU-US data transfers in jeopardy following Supreme Court ruling Cyber company sued over potential hallucinations, poor research attribution Is it time to look at cyber security mission creep? Interesting stats 9% (a big drop from 2025’s 29%) of organisations are open to a purely automated security scanning approach, in part because 78% of security teams report “critical false negatives” from such tools, according to Cobalt. https://rto.me.uk/newsletter/robins-newsletter-419/ Sun, 28 Jun 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-419/ This week Five Eyes cyber agencies urge businesses to improve cyber resilience TfL attackers pleaded guilty to 2024 compromise Klue compromise leads to Salesforce data access Chinese company unveils Mythos-esque model Hospital probing medical records access of crocodile attack child Interesting stats 58% of claims are email-related business email compromise (BEC) and funds transfer fraud (FTF), while $1 million, the average initial ransom demand (up 47%), and 70% involved both encryption and data exfiltration (“double extortion”), though 100% of UK claims were restored within ransom demands being paid, according to Coalition’s 2026 Cyber Claims Report (h/t Tony for the reminder on this one! https://rto.me.uk/newsletter/robins-newsletter-418/ Sun, 21 Jun 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-418/ First up, some celebrations are in order: I’ve been writing this infosec newsletter every week since 24th June 2018: Happy 8th Anniversary to Robin’s Newsletter 🥳 This week FIFA’s World Cup broadcast systems were accessible to self-registered agent accounts FortiBleed campaign compromised over 70,000 Fortinet devices Unpatchable BootROM exploit affecting iPhone 11-era models discovered Three Microsoft secure boot certificates expire this coming week Fable ‘jailbreak’ amounted to “fix this code” Interesting stats $3. https://rto.me.uk/newsletter/robins-newsletter-417/ Sun, 14 Jun 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-417/ This week Claude Fable / Mythos released, restricted, all in the same week Microsoft GitHub repos suspended after second compromise in as many weeks CISA releases new ‘patch smarter’ obligations for US gov organisations  France says Israeli firm interfered in Scottish election OpenClaw acts just like an average user when given phishing emails Interesting stats 1/2 ‘hands on keyboard’ breaches at US tech companies in the past year were perpetrated by North Korean’s, according to CrowdStrike. https://rto.me.uk/newsletter/robins-newsletter-416/ Sun, 07 Jun 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-416/ This week Infosecurity Europe 2026 was a blast — thanks to those of you who came to say hi — here’s my roundup video. Meta’s chatbot used to hijack Instagram accounts Anthropic expands Project Glasswing access Open source AI models used to create self-propagating, evolving malware Twenty Dashlane password vaults stolen during API brute force attack Interesting stats 31% of breaches now start with software vulnerabilities, rather than stolen passwords, and 48% of all breaches now involve ransomware, though payouts are shrinking, while 40% higher click rates on mobile devices make them more attractive for phishing attempts than desktop clients, according to Verizon https://rto.me.uk/newsletter/robins-newsletter-415/ Sun, 31 May 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-415/ This week We’ve still got a few spaces for anyone wanting to join us for breakfast this Wednesday, 3 June, in Canary Wharf. I’ll also be hosting a table talk on mandatory incident reporting that day. Plus a variety of other Cydea events around Infosecurity Europe. Researcher promises ‘bone shattering’ Microsoft vulnerability in July Browser side-channel attack revealed website access Anthropic’s Project Glasswing update GCHQ boss says orgs need to 10x their cyber prioritisation Farage’s Russia hacking claims are baseless, says former NCSC chief Interesting stats 52% of knowledge workers admit to using unapproved AI tools, and 24% say they do it regularly, while 90% of executives have confidence in their organisation’s visibility into AI tools, according to Okta https://rto.me.uk/newsletter/robins-newsletter-414/ Sun, 24 May 2026 19:00:00 +0100 https://rto.me.uk/newsletter/robins-newsletter-414/ A shorter edition this week. I hope you’re enjoying your Bank Holiday or Memorial Day, and don’t forget your towel! Coming up You can catch me at a few events over the coming fortnight. Come say hi if you’re around Oxford Tech Week, InfoSecurity Europe or Pulse Cyber 100 Club: 28th May: Securing the AI Era: Defending Against Next‑Gen Cyber Threats, Westgate, Oxford, info/reg. 2nd—4th June: InfoSecurity Europe 2026, including some Communicating Cyber: Live recordings, ExCel, London, meet for coffee.