Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years
The NCSC warns that ‘tech on the cheap’ has left UK organisations exposed to AI uncovering and exploiting longstanding cyber security weaknesses and calls for urgent investment in resilience.

From industry concern to practical action: the value of working with regulators
How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity

Critical security issue affecting PHP
Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

Introducing a new AI chapter in the NCSC research problem book
A revolution is underway at the intersection of AI and cyber security.

Post-quantum updates to our TLS guidance
The NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate.

Help the NCSC understand how organisations approach external attack surface risk
We're looking to hear from people involved in evaluating, selecting or adopting EASM.

China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
Joint advisory with international partners highlights malicious targeting of organisations from a range of sectors across the globe.

Incident affecting ASOS customers
ASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed.

Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.

One does not simply defend agentically
Defenders can’t use AI in the same way attackers can, but there’s much they can do to unlock the potential of agentic cyber defence.

Cyber Adversary Simulation (CyAS): scheme documents now available
Our view of good cyber adversary simulation – and how assured providers can deliver it.

UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists
UK and allies provide advice to help organisations and individuals at risk detect and counter the threat from CHOSEN BRICK malware.

Iranian cyber targeting of dissidents, activists and journalists
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.

The hidden risks of shadow AI
Understanding why staff use unapproved AI tools is key to managing the security challenges they can create.

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices
Owners of operational technology encouraged to address avoidable vulnerabilities, and build long-term cyber resilience.

Managing the cyber risk of agentic AI
Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.

How BitLocker PINs help protect your data and devices
Using a PIN mitigates many BitLocker vulnerabilities. Make sure you’re ready for the next one...

Help shape the future of resilient private 5G
The NCSC wants to collaborate with organisations developing technologies and approaches for secure, resilient and deployable private 5G

Water sector example added to the NCSC’s Secure connectivity principles
New guidance is the first content authored by the Industrial Control System COI to appear on ncsc.gov.uk.

NCSC statement in response to recent incidents resulting from frontier AI evaluations
A statement from Ollie Whitehouse, Chief Technology Officer at the NCSC, on AI security following recent incidents.