📝 Show notes
CyberAware Daily — 2026-09-23
- Mid-Week Intel for Wednesday 23 September 2026: DarkWatch logged 34,511 captures, 13,346 entities, 1,889 alerts and 14 active targets overnight.
- Fresh dark web captures include an active leak site and a group calling itself DragonForce. These target organisations, not households.
- Check Point has warned of a critical zero day in its management server software, exploited in targeted attacks. A fix has been released and IT teams should apply it now.
- WordPress has patched a critical flaw that could allow code execution on some servers. Update your site or ask your web host to do it.
- A malicious npm package posing as a Twilio bug bounty probe can steal developer credentials. If you build software, review what you install.
- This week's action: turn on two step verification for your email or bank account, and change any reused passwords.
- CyberAware UK is a daily UK podcast helping families spot scams and stay safe online.
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Wednesday, the 23rd of September, and this is CyberAware UK,
the show that helps British families stay a step ahead of the scammers.
And on Wednesdays we do mid-week intel, where we look at what the Darkwatch team
has picked up overnight, plus the stories worth knowing from the last 24 hours.
Before we start, if you're new here, nothing we talk about today needs you to be a tech expert.
But we'll always tell you plainly who is affected and what, if anything, you need to do.
Right, let's start with the Darkwatch numbers.
Overnight, they logged 34,511 captures, 13,346 tracked entities, and 1,889 alerts.
They're also monitoring 14 active targets, and three fresh captures came in,
including an active dark web leak site and one called Dragonforce.
For most households, that's background noise.
These are criminal marketplaces and extortion blogs,
and the people directly in the frame are businesses and organizations, not families at the kitchen table.
The practical takeaway there is simple.
If your bank, your energy supplier, or any company you use emails you about a data breach,
don't panic, but do change that password and turn on two-step verification.
Now to the news, and the first one is a serious one for IT teams.
Checkpoint has warned about a zero-day in its management server software that's being used in targeted attacks.
It's rated critical, and the affected product is the central console that companies use to manage their security systems.
So this is one for the IT department, not for you at home.
The vendor has released a fix, and the guidance is to apply it straight away.
If you know someone who runs IT for a living, it's worth giving them a nudge this morning.
Next, WordPress.
A critical flaw has been patched that could allow code execution on some servers.
WordPress powers a huge number of small business and charity websites across the UK.
So who does this affect?
Anyone who runs a WordPress site, or pays someone to run one.
The action is to make sure your site is updated to the latest version, or ask your web person to do it today.
And here's the bit people miss.
A hacked website isn't just the owner's problem.
If you shop on a small site, your details could be sitting on a server that hasn't been patched.
It's a good reminder to use a card, or a payment service, rather than a debit card direct from your current account, on smaller sites you don't know well.
Third story, and this one is a proper lesson in healthy skepticism.
A malicious package has been found on NPM, pretending to be a Twilio bug bounty probe, and it can steal credentials.
For listeners, NPM is a place software developers share code.
So again, this is aimed at people who build software, not at your average household.
What it shows, though, is the pattern we see again and again.
If something arrives out of the blue, offering money, a reward, or a chance to be a hero, slow right down.
That's the same trick as the fake prize text, or the message saying you're owed a refund.
The details change, the shape of the scam doesn't.
So let's pull it together.
Three stories today, all aimed at businesses, developers, and website owners.
For a normal household, there's nothing here that needs urgent action.
But there is one thing worth doing this week.
Pick the account that would hurt most if it was taken over, your email or your bank,
and check that two-step verification is switched on.
And while you're in there, change the password if it's been reused anywhere else.
That single habit blocks more scams than anything else we talk about.
We'll be back tomorrow with a fresh look at what's landed.
Until then, stay switched on, and don't rush when something feels off.
Thanks for listening.
Take care of each other.