Cyber Brief: NCSC Testing, Patch Tuesday, GitHub Attack, Apache Flaw

This week's security landscape is a reminder that resilience is built on two complementary disciplines: proactive testing to understand where your defences stand, and consistent patching to close the gaps attackers are actively looking for. From a new NCSC scheme designed to help critical organisations stress-test their security posture, to a record-breaking Microsoft Patch Tuesday and active exploitation of widely used infrastructure, the common thread for UK businesses is the importance of knowing your environment, keeping it up to date, and understanding how attackers move through it.

NCSC Launches Cyber Adversary Simulation Scheme for Critical Organisations

The National Cyber Security Centre has announced a new Cyber Adversary Simulation (CAS) scheme designed to help critical national infrastructure and other high-value organisations test their cyber defences through realistic, structured simulations. Reported on the NCSC's own website on 11 November 2026, the scheme will connect organisations with a vetted pool of trusted providers who can conduct rigorous, real-world adversary simulations that go beyond standard penetration testing. The CAS scheme is intended to give organisations a clearer picture of how a sophisticated attacker might move through their environment, and where their detection and response capabilities need strengthening.

For UK organisations operating in critical sectors — including energy, finance, healthcare, transport and telecommunications — this represents a meaningful step forward in how the NCSC supports resilience at scale. Adversary simulation exercises are particularly valuable because they test not just technical controls, but also the people and processes involved in detecting and responding to an attack. Many organisations invest significantly in security tooling but have limited visibility into how well those tools and teams would actually perform under realistic attack conditions. The CAS scheme provides a structured, assured route to gaining that visibility through providers the NCSC has assessed and approved.

Why it matters

For UK businesses in regulated or critical sectors, this scheme offers a credible, NCSC-backed route to more rigorous security testing. Organisations should review whether their current testing programme reflects realistic threat scenarios, and consider whether adversary simulation — rather than point-in-time vulnerability assessments alone — would give them a more accurate picture of their actual resilience.

Source: NCSC UK

Microsoft Fixes Nearly 1,100 Vulnerabilities Including an Outlook Zero-Day

Microsoft's November 2026 Patch Tuesday is one of the largest on record, with the company releasing updates to address almost 1,100 security vulnerabilities across Windows operating systems and supported software. Krebs on Security reported on 10 November 2026 that the update includes fixes for 63 critical flaws, among them a zero-day vulnerability in Microsoft Outlook that was being actively exploited before a patch was available. The release also coincides with security updates from Adobe, Apple, Google and Mozilla, making this a particularly significant patching cycle for IT and security teams to work through.

A patch release of this scale creates real operational pressure for IT and security teams, who must triage, test and deploy updates across potentially complex environments while managing the risk that some of those vulnerabilities are already being exploited. The Outlook zero-day is of particular concern given how central Microsoft Outlook is to business communication across UK organisations of all sizes. Unpatched Outlook vulnerabilities have historically been used as entry points for phishing-based attacks, credential theft and initial access by a wide range of threat actors. The sheer volume of this month's updates also increases the risk that lower-profile but still significant vulnerabilities are deprioritised or missed entirely.

Why it matters

For UK businesses running Microsoft environments — which is the majority — the Outlook zero-day should be treated as the immediate priority within this patch cycle. IT teams should confirm that Outlook updates have been deployed across all devices, including those used by remote workers, and use this release as a prompt to review whether patch deployment timelines and testing processes are keeping pace with the volume and frequency of modern update cycles.

Source: Krebs on Security

Attacker Uses Nearly 5,000 Hijacked GitHub Accounts to Steal CI Secrets

Security software company Aikido Security reported on 12 November 2026 that an attacker used stolen credentials for 4,837 compromised GitHub accounts to plant a secret-stealing payload across more than 1,806 repositories. The attacker targeted repositories those accounts had write access to, inserting code designed to harvest secrets and cloud credentials accessible through continuous integration (CI) workflows. The campaign appears to have been systematic and automated, exploiting the trusted relationships between developer accounts and the repositories they contribute to.

This attack highlights a risk that is easy to underestimate: the security of your software supply chain depends not just on your own accounts and repositories, but on the accounts of every contributor and collaborator with write access. CI pipelines routinely handle sensitive secrets — API keys, cloud provider credentials, deployment tokens — and if those pipelines can be manipulated by a compromised contributor account, attackers can harvest credentials that provide access to production environments, cloud infrastructure and downstream systems. For UK organisations using GitHub for software development, this is a prompt to review who has write access to repositories, whether CI secrets are properly scoped and rotated, and whether unusual workflow changes would be detected.

Why it matters

For many organisations, developer tooling and CI pipelines sit outside the scope of regular security reviews, yet they often hold credentials with significant access to cloud and production environments. This is a prompt to audit repository access permissions, review CI secret management practices, and ensure that unexpected changes to workflow files would trigger an alert rather than run silently.

Source: The Hacker News

Critical Apache HTTP/2 Flaw Allows Remote Code Execution

The Hacker News reported on 12 November 2026 that a critical vulnerability has been identified in Apache HTTP Server's HTTP/2 module, tracked as CVE-2026-119618. The flaw affects versions 2.4.55 through 2.4.70 of Apache HTTP Server and allows an unauthenticated remote attacker to execute code on the affected server. A fix is available in version 2.4.71, released on 11 November 2026. Only servers with HTTP/2 enabled are affected, according to Red Hat, which distributes Apache HTTP Server as part of Red Hat Enterprise Linux.

Apache HTTP Server is one of the most widely deployed web server platforms in the world, used across a broad range of UK organisations including those running public-facing websites, internal web applications, APIs and development environments. A remote code execution vulnerability that requires no authentication is among the most serious categories of flaw, as it means an attacker who can reach the server over the network can potentially take full control of it without needing any credentials. Organisations that have enabled HTTP/2 — which is increasingly common as it offers performance benefits — should treat this as a priority patching task. The availability of a fix means the path to remediation is clear, but speed of deployment matters given the severity of the vulnerability.

Why it matters

For UK organisations running Apache HTTP Server with HTTP/2 enabled, upgrading to version 2.4.71 should be treated as a priority. Teams should check whether Apache is present in their environment — including in containerised workloads, development servers and managed hosting — and confirm whether HTTP/2 is enabled, as this determines whether the vulnerability is exploitable in their specific configuration.

Source: The Hacker News

Today's Key Actions

• If your organisation operates in a critical or regulated sector, review your current security testing programme and explore whether the NCSC's new Cyber Adversary Simulation scheme — or a comparable adversary simulation exercise — would give you a more realistic picture of your detection and response capabilities.
• Prioritise deployment of the Microsoft Outlook patch from this month's Patch Tuesday across all devices, including those used by remote and hybrid workers, and confirm that your patch management process has a clear mechanism for escalating zero-day vulnerabilities to the front of the queue.
• Audit write access permissions across your GitHub repositories, review how CI pipeline secrets are stored and scoped, and check whether your monitoring would detect unexpected changes to workflow configuration files.
• Identify all instances of Apache HTTP Server in your environment — including containerised deployments and development infrastructure — check whether HTTP/2 is enabled, and upgrade to version 2.4.71 where affected versions are in use.
• Confirm that clear ownership exists across your organisation for patch management, security testing, developer tooling security and supply chain risk — and that each of these areas has a named owner who is accountable for acting on developments like those covered today.

Secarma Insight

Today's stories reflect a pattern that experienced security teams will recognise: the gap between having security controls in place and knowing how well those controls actually work under realistic conditions. Patching, access management, pipeline security and adversary simulation are not separate disciplines — they are interconnected parts of the same resilience picture. Organisations that test their defences regularly, maintain clear ownership of their technology estate, and build patching and access review into routine operations are consistently better placed to respond when new vulnerabilities or attack techniques emerge. Good security is rarely about dramatic interventions; it is about the habits and processes that are already running before an incident occurs.