Cyber Brief: SVG flaws, vishing, GitLab, and Cyber Essentials

Today's stories share a thread that will be familiar to many security teams: the gap between assumed protection and actual protection. Whether it is a sanitiser that does not sanitise, a help desk caller who should have been challenged, a widely used platform with an actively exploited vulnerability, or a certification scheme that has quietly raised the bar, the common theme is that controls which feel solid deserve regular scrutiny. For UK organisations, each of these developments is a prompt to test assumptions rather than rely on them.

SVG sanitisers found to be bypassable in six out of eight tools tested

Security researchers at PortSwigger have published new research revealing that six of the eight most widely used SVG sanitiser libraries can be bypassed to execute JavaScript, even when the response body appears to contain entirely harmless XML. The research, titled "Scalable Vector Grief", demonstrates how a response header can be used to trigger script execution in Firefox, effectively circumventing the sanitisation step that many applications rely on to safely handle user-uploaded SVG files. The affected libraries include tools commonly embedded in web application frameworks and content management systems. PortSwigger's researchers tested the sanitisers methodically and documented the bypass techniques in detail.

SVG sanitisers are used by organisations that allow users to upload or embed SVG files, a common feature in document editors, design tools, marketing platforms, and content management systems. Many development teams implement these libraries with confidence that they provide a reliable security boundary against cross-site scripting attacks. This research shows that confidence may be misplaced in the majority of cases. For UK organisations running web applications that accept SVG input, this is a meaningful signal that their current sanitisation approach may not be providing the protection they expect, and that a review of how SVG content is handled is warranted.

Why it matters

For UK businesses running web applications that accept user-supplied SVG content, this research is a prompt to identify which sanitiser library is in use and check whether it is among those found to be bypassable. This is also a useful reminder that third-party security libraries should be treated as components to verify rather than guarantees to rely on. A targeted review of SVG handling, ideally through penetration testing, would help confirm whether applications are genuinely protected.

Source: PortSwigger Research

Attackers posing as IT help desk staff used names and email addresses to gain remote access

Cisco Talos Incident Response has published findings from multiple engagements during the third quarter of 2026 in which attackers successfully impersonated IT help desk staff to gain remote access to employee devices. Reporting from Help Net Security explains that the attackers contacted employees by phone, email, and Microsoft Teams, using real employee names and email addresses to appear credible. In at least one case, the access obtained through this social engineering technique led directly to a ransomware deployment. The attackers required very little information to be convincing, and in several cases employees opened remote access sessions without following established verification procedures.

This type of attack, often referred to as vishing or IT help desk impersonation, is not new, but the Talos findings highlight how effective it remains even when organisations have security awareness programmes in place. The use of Microsoft Teams alongside phone and email contact is particularly notable, as many employees treat Teams messages as inherently more trustworthy than external communications. The fact that attackers needed only names and email addresses, information that is often publicly available or easily obtained, underlines how low the barrier to entry is for this technique. For UK organisations, the risk is compounded by the widespread use of Teams as a primary communication platform.

Why it matters

For UK businesses, this is a prompt to review the verification procedures your IT help desk and employees follow before granting or accepting remote access. Specifically, organisations should confirm that staff know how to verify the identity of anyone requesting remote access, regardless of the channel used, and that Teams is not treated as an automatically trusted environment. Running a tabletop exercise or simulated vishing test can help identify where the gaps in awareness and process actually sit.

Source: Help Net Security

Actively exploited vulnerabilities in GitLab and Cisco Firewall added to CISA's known exploited list

The US Cybersecurity and Infrastructure Security Agency has added two new vulnerabilities to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation in the wild. The Hacker News reports that the first, CVE-2026-97229, is an integer overflow vulnerability in GitLab Community Edition and Enterprise Edition carrying a CVSS score of 10.0, meaning it is rated as the most severe class of flaw and can enable remote code execution. The second, CVE-2026-76418, affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software and can be exploited to cause a denial of service condition. Both vulnerabilities affect products that are widely deployed across UK enterprise and public sector environments.

GitLab is used extensively by UK development teams for source code management, CI/CD pipelines, and DevOps workflows, meaning a remote code execution vulnerability in this platform carries significant risk for organisations that have not yet patched. A compromise of a GitLab instance could expose source code, credentials, pipeline secrets, and provide a foothold into wider development infrastructure. The Cisco Firewall vulnerability is equally relevant for organisations relying on ASA or FTD appliances as a primary network security control. The inclusion of both flaws in the KEV catalogue confirms that exploitation is not theoretical.

Why it matters

For UK organisations running GitLab or Cisco Secure Firewall products, patching these vulnerabilities should be treated as a near-term priority given confirmed active exploitation. Teams should verify which versions are deployed, check whether patches are available and applied, and review access logs for any unusual activity on these systems in recent weeks. Where patching cannot be completed immediately, consider what compensating controls or network segmentation measures can reduce exposure in the interim.

Source: The Hacker News

Cyber Essentials scheme updated: what has changed and what it means for your organisation

GRC Solutions has published a detailed summary of the latest updates to the UK government-backed Cyber Essentials certification scheme, outlining the changes that organisations seeking or renewing certification will now need to meet. The updates reflect the evolving threat landscape and include revised guidance on areas such as cloud services, home working environments, multi-factor authentication requirements, and the scope of what must be included in an assessment. Organisations that have previously achieved Cyber Essentials certification should not assume that their existing controls will automatically meet the updated requirements at renewal.

Cyber Essentials remains the baseline certification for UK organisations seeking to demonstrate a credible security posture, and it is a mandatory requirement for many government contracts and supply chain relationships. The scheme's updates are designed to ensure that certification continues to reflect meaningful security practice rather than becoming a tick-box exercise against outdated criteria. For organisations that have not revisited their Cyber Essentials scope or controls recently, the updated requirements may reveal gaps, particularly around cloud-hosted services and remote working setups that have become standard since earlier versions of the scheme were written.

Why it matters

For UK organisations holding or planning to pursue Cyber Essentials certification, this is a prompt to review the updated requirements against your current environment before your next assessment or renewal. Pay particular attention to how cloud services and remote working are scoped, and whether your multi-factor authentication implementation meets the revised expectations. Organisations in supply chains where Cyber Essentials is a contractual requirement should also confirm that their certification remains valid and that any changes to their IT environment have been properly reflected in their assessment scope.

Source: GRC Solutions

Today's Key Actions

• Identify any SVG sanitiser libraries used in your web applications and check whether they are among those found to be bypassable in PortSwigger's research. If you accept user-supplied SVG content, consider commissioning a targeted review or penetration test of that functionality.
• Review your IT help desk verification procedures and confirm that staff know how to validate the identity of anyone requesting remote access, including requests that arrive via Microsoft Teams. Consider whether a simulated vishing exercise would help identify gaps in awareness or process.
• Check whether your organisation runs GitLab CE or EE, or Cisco Secure Firewall ASA or FTD products, and confirm that patches for CVE-2026-97229 and CVE-2026-76418 have been applied. Review access logs on these systems for any anomalous activity.
• Review the updated Cyber Essentials requirements against your current IT environment, particularly around cloud services, remote working, and multi-factor authentication. If renewal is approaching, begin a gap assessment now rather than at the point of submission.
• Confirm that clear ownership exists across your organisation for patch management, help desk security procedures, web application security, and certification compliance, so that each of today's action points has a named person responsible for following through.

Secarma Insight

What today's stories collectively illustrate is that security controls are not static. A sanitiser library that was considered fit for purpose when it was first integrated may no longer provide the protection it was chosen for. A certification achieved two years ago may not reflect the environment that exists today. Verification procedures that worked well in an office-based world may have gaps when Teams and remote access are the norm. The organisations that manage these risks most effectively are not necessarily those with the most sophisticated tooling, but those that build in regular, structured review of whether their controls are still doing what they are expected to do. Practical discipline, clear ownership, and the habit of testing assumptions are what make the difference.