📝 Show notes
CyberAware Daily — 2026-09-14
- This week's patch cycle explained, including the unusually large batch of fixes from Microsoft, expected Tuesday 15 September
- Why home devices matter as much as office ones when updates land
- What DarkWatch is tracking this week and why its alerts are aimed at organisations, not households
- How fraud follows real news, and why no genuine update arrives by email with a link to click
- This week's takeaway: install your updates and switch on two step verification for your main email
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Monday the 14th of September and this is CyberAware UK.
I am your host and joining me is Alex.
We start every week the same way, looking at what's coming rather than what's already landed.
And that's the right way round, isn't it?
Most fraud stories are someone telling you what happened to them.
We'd rather you heard about it before it reached your inbox.
So today, three things.
The week's patch cycle, a couple of expected threat themes,
and what our monitoring team at Darkwatch is seeing in the background.
Let's start with Patch Tuesday.
For anyone who doesn't know the term, it's the second Tuesday of the month
when a lot of the big software makers push out fixes for security holes all at once.
That's tomorrow, the 15th.
And here's the thing most households get wrong.
They think updates are for big companies with IT departments.
They're not.
They're for your laptop at the kitchen table.
What's unusual about this month?
The sheer volume.
Microsoft has just shipped close to a thousand fixes in one go.
That's not a small update cycle, it's a very large one.
Does that mean I need to do anything special, or just let it install?
Just let it install, but don't put it off for weeks.
Set aside half an hour this week, plug the laptop in, and let it run.
That's the whole job.
And on phones.
Apple and Android push updates on their own schedule, but the same rule applies.
If there's an update waiting, take it.
Second thing for the week ahead.
Our monitoring team tracks what's circulating on the darker corners of the internet.
This week they logged just under half a million new captures, nearly 9,500 entities, and about 1600 alerts.
1600 alerts sounds like a lot.
Should listeners be worried?
Not directly.
Those alerts are aimed at organizations, not families.
There are five active targets on the watch list this week, and they're companies with exposed systems.
The useful part for us is the pattern.
That the gaps being hunted are the same dull ones every month.
Out-of-date software, remote access tools left open, logins without a second check.
Boring, fixable things.
On a home level, the second check is the big one, isn't it?
Two-step verification on your email.
It's the single highest value thing any listener can do this week.
If your email is protected with a second check, most of what circulates out there simply doesn't reach you.
Anything else on the week ahead radar?
Payment-themed texts, as usual.
And we'd expect a wave of messages pretending to be about the update itself.
Someone claiming you need to click a link to finish installing patches.
That's a good one to flag, because it plays on real news.
The patches are real.
The email asking you to download them isn't.
Exactly.
Your device updates itself.
Nobody needs to email you a patch, and nobody legitimate will ask for your card details to install one.
So what's the takeaway for the week?
Pick one evening this week, plug in your devices, and let every update install.
Then check that your main email account has two-step verification switched on.
20 minutes, once, and you're ahead of most of what we'll be reporting on for the rest of the month.
That's it for today.
We're back tomorrow with more.
Stay switched on.