Cyber news for UK businesses, Sunday 8 November 2026
Fake AI event invites aim at work logins. Push Security found fake registration pages for OpenAI, SpaceX and Anthropic events. They ask for a work account to claim a reward, such as three months of ChatGPT Pro. The sign-in goes to phishing services built to defeat MFA. Never type a Microsoft device code that a web page gives you, and treat any prize that needs a work login as a scam. (Push Security) Full write-up: device code phishing and fake AI event invites.
SkyW4lker phishing kit keeps growing. ANY.RUN counted 618 sandbox analyses linked to it between June and 21 October, up from 20 in June to 200 in September. The UK is among the top submitting countries. These are samples, not confirmed victims. Ask your IT provider whether device code sign-in can be blocked in Entra Conditional Access. (ANY.RUN)
WordPress fix can still leave a gap while it installs. CISA lists the core flaw CVE-2026-119977 as exploited. The researcher who found it says the update that installs the fix can still be attacked on some sites. He advises blocking web access to the wp-content/upgrade folder first, then updating to 7.1.4 or your branch’s fixed release. (The Hacker News)
Related reading: phishing-resistant MFA, Microsoft 365 security basics, patch management and yesterday’s Zyxel switch patch post.
Two of today’s stories end with a stolen work sign-in. Phishy lets you test whether your staff would enter one: https://wolfcore.co.uk/phishing-simulation-software/