Cyber Brief: SVG flaws, VMware exploits, AI bots and TLS gaps

Today's stories reflect a theme that runs through much of modern security practice: the gap between assumed protection and actual protection. Whether it is a sanitiser that does not sanitise, a virtualisation platform being quietly exploited, a democratic process undermined by automated bots, or IT leaders who believe their certificate management is automated when it largely is not, the common thread is that confidence without verification creates risk. For UK organisations, each of these stories offers a practical prompt to look more carefully at controls that may be working less reliably than expected.

SVG sanitisers bypassed in six out of eight cases, raising web application security concerns

Security researchers at PortSwigger have published findings showing that six of the eight most widely used SVG sanitiser libraries can be bypassed, allowing attackers to execute JavaScript in contexts where it should be blocked. The research, published on 28 October 2026, demonstrates that a specific response header configuration can cause Firefox to execute JavaScript even when the response body contains only apparently harmless XML. The bypasses affect sanitisers that many developers rely on to safely handle user-uploaded SVG files in web applications. PortSwigger's research team has documented the techniques in detail, including how the browser's handling of content types interacts with sanitiser logic in unexpected ways.

SVG files are commonly accepted in web applications that allow users to upload images, logos, avatars or documents. Many organisations assume that running uploaded SVGs through a sanitiser is sufficient to prevent cross-site scripting attacks. This research challenges that assumption directly. If a sanitiser can be bypassed, an attacker who can upload an SVG file to a platform may be able to execute JavaScript in the context of other users' sessions, potentially stealing credentials, hijacking accounts or exfiltrating data. This is particularly relevant for SaaS platforms, content management systems, customer portals and any application that accepts file uploads from untrusted users.

Why it matters

For UK businesses running web applications that accept SVG uploads, this research is a prompt to review which sanitiser library is in use and whether it is among those found to be bypassable. Development and security teams should check whether SVG upload functionality is genuinely necessary and, where it is, consider restricting accepted file types or converting SVGs to raster formats server-side as a more reliable mitigation. Penetration testing of file upload functionality should include SVG-specific test cases.

Source: PortSwigger Research

China-linked threat actor exploited VMware ESX zero-day to reduce audit trail visibility

CrowdStrike has revealed that a China-nexus threat actor tracked as Warp Panda exploited a zero-day vulnerability in Broadcom VMware ESX, identified as CVE-2026-41709, in attacks targeting the US legal sector. The vulnerability relates to insufficient logging within the ESX hypervisor, meaning that exploitation reduced the visibility of attacker activity within affected environments. The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalogue on 28 October 2026, as reported by The Hacker News. The flaw carries a significant CVSS score and affects a platform that underpins virtualised infrastructure across many enterprise environments globally.

VMware ESX is one of the most widely deployed virtualisation platforms in enterprise IT, used extensively across UK organisations in sectors including finance, legal, healthcare and the public sector. A vulnerability that reduces logging fidelity is particularly concerning because it undermines an organisation's ability to detect, investigate and respond to intrusions. Attackers who can operate with reduced audit trail visibility have more time to move laterally, exfiltrate data or establish persistence before being identified. The targeting of the legal sector is also notable, given that law firms and legal service providers frequently hold sensitive client data and may be targeted as a route into other organisations.

Why it matters

For UK organisations running VMware ESX, patching CVE-2026-41709 should be a near-term priority. Beyond patching, this is a prompt to review whether your virtualisation layer is generating sufficient log data and whether those logs are being collected, retained and monitored effectively. Organisations should also consider whether their SIEM or log management platform would detect anomalous activity in virtualised environments even if host-level logging were degraded.

Source: The Hacker News

AI bots flooded UK government consultation with fake responses in coordinated influence attempt

Research published by The Guardian on 27 October 2026 has revealed that three-quarters of all responses to the UK government's 2023 consultation on the disposable vapes ban were machine-generated. The coordinated campaign, believed to be the first of its kind targeting UK health policymaking, used AI bots to flood the consultation process with tens of thousands of fabricated submissions in an attempt to prevent the tobacco and vapes bill from passing into law. The effort ultimately failed, but the scale of the manipulation — with AI-generated content vastly outnumbering genuine responses — raises significant questions about the integrity of digital public engagement processes.

For organisations involved in public affairs, regulatory engagement or consultation responses, this story highlights a growing challenge: the authenticity of digital participation can no longer be assumed. For UK businesses, the implications extend beyond government consultations. The same techniques used to flood a public consultation could be applied to manipulate online reviews, customer feedback systems, employee surveys or any other mechanism that aggregates text-based input at scale. Organisations that rely on consultation data, market research or stakeholder feedback to inform decisions should consider what verification or anomaly detection measures are in place to identify artificially generated responses.

Why it matters

For UK organisations that run or participate in consultation, feedback or engagement processes, this is a prompt to review how responses are validated and whether there are any controls to detect coordinated or automated submissions. For those involved in regulatory affairs or public policy engagement, understanding how AI-generated content may distort consultation outcomes is increasingly relevant to how organisations interpret and respond to regulatory signals.

Source: The Guardian

Survey reveals significant gap between perceived and actual TLS certificate management maturity

A survey of 500 senior IT and security leaders, conducted by certificate authority Sectigo and reported by Help Net Security on 29 October 2026, has found a striking disconnect between confidence and reality in TLS certificate management. Forty percent of respondents said they were very prepared for monthly TLS certificate renewals because automated systems were already in place. However, only four percent said their certificate management was actually fully automated, and 61 percent reported that their organisation had experienced a certificate-related outage or incident in the past 12 months. The findings suggest that many organisations are significantly overestimating the maturity of their certificate management practices.

TLS certificates are foundational to secure communications across web services, APIs, internal systems and cloud infrastructure. When certificates expire unexpectedly or are misconfigured, the results can range from service outages and broken integrations to security warnings that erode customer trust. With certificate lifespans continuing to shorten — monthly renewals are now a realistic operational requirement for many organisations — the gap between assumed automation and actual automation becomes a meaningful operational risk. For UK businesses with complex IT environments, hybrid cloud deployments or a large number of internet-facing services, unmanaged certificate sprawl is a genuine and underappreciated vulnerability.

Why it matters

For UK IT and security teams, this survey is a prompt to conduct an honest audit of certificate management practices. Specifically, organisations should establish whether they have a complete and current inventory of all TLS certificates in use, what the renewal process actually is for each, and whether any certificates are approaching expiry without automated alerting in place. The gap between perceived and actual automation is worth examining directly — confidence in systems that do not exist is more dangerous than acknowledged uncertainty.

Source: Help Net Security

Today's Key Actions

• Review any web applications that accept SVG file uploads and confirm which sanitiser library is in use. Check whether it is among those identified as bypassable in PortSwigger's research, and consider whether server-side conversion or file type restriction is a more reliable control.
• Prioritise patching CVE-2026-41709 in VMware ESX environments and review whether your logging and monitoring configuration would detect anomalous activity in virtualised infrastructure even if host-level logging were partially degraded.
• If your organisation runs or participates in digital consultation, feedback or stakeholder engagement processes, review what controls exist to detect automated or AI-generated submissions, and consider how you would identify and respond to coordinated manipulation of input data.
• Conduct a practical audit of TLS certificate management, including a full inventory of certificates in use, their expiry dates, and whether renewal processes are genuinely automated or dependent on manual steps that may be missed.
• Ensure that ownership of each of these areas — web application security, virtualisation patching, digital engagement integrity and certificate management — is clearly assigned to named individuals or teams, with review dates in place.

Secarma Insight

What today's stories share is a reminder that security maturity is built on verified understanding rather than assumed competence. The organisations best placed to manage these risks are not necessarily those with the most sophisticated tools, but those that regularly test whether their controls are working as intended, maintain honest visibility into their own environments, and assign clear ownership to the areas that matter most. Good security practice is less about reacting to each new development and more about maintaining the habits — patching, monitoring, auditing, reviewing — that mean you are already in a stronger position when new threats emerge. The discipline of checking what you think you know is one of the most valuable things any security team can invest in.