Cyber Monthly Wrap-up (UK, EMEA and the US) – October 2026

Welcome to HSF Kramer's October 2026 summary of top picks for cyber-related news in the UK, EMEA and US. 

In a world overflowing with individual incidents and long-form analysis, our short articles are aimed at cutting through the noise, pointing you to key developments, providing you with learning points at a glance and signposting you to longer form content. If you would like to find out more, do reach out to one of our international team. 

UK updates:

Britain steps up national defences against growing AI risks

Government Press Release – 12 October 2026

The UK government announced that it will explore strengthening parts of the Cyber Security and Resilience Bill and the wider legislative regime. One of the priorities is to increase protection for the UK’s essential services such as hospitals and utilities from emerging AI-related risk. The National Cyber Security Centre (NCSC) and the AI Security Institute are also undertaking work to consider how to respond to incidents involving autonomous AI agents. Additionally, the government will look at how near-miss incidents can also be identified and reported to learn lessons quickly and reduce the risk of future harm. The details of any measures will be worked through with Parliament and with technical experts and operators.

Corporate reporting – FRC guidance on Provision 29 in the UK Corporate Governance Code and cyber security controls

HSF Kramer – 9 October 2026

This HSF Kramer article highlights the FRC’s second Mythbuster in relation to Provision 29 of the UK Corporate Governance Code 2024. The Mythbuster discusses various cyber security-related issues for Provision 29 purposes, including: (1) the FRC’s expectations in relation to disclosures about cyber controls, whereby the FRC confirms that there is no obligation to include commercially sensitive information or specific details on the technical controls; (2) confirmation that the Provision 29 declaration does not require boards to guarantee cyber security; and (3) what companies should do in the event of a cyber breach. For more details on Provision 29, see our HSF Kramer Corporate Governance snapshot here.

ASOS confirms hackers sent ‘unauthorised’ notification to app users

BBC – 6 October 2026

On 6 October, an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials (see also statement published by ASOS). Those credentials were then used to access information on certain third-party platforms used by ASOS. As a result, some customers received an unauthorised push notification from ASOS. In the statement, the company clarified that no payment card information or account passwords were accessed, and the affected platforms were immediately locked down.

NCSC publishes guidance on reducing the risk associated with disruptive cyber attacks

National Cyber Security Centre – 1 October 2026

The NCSC has published guidance materials on 3 areas to help organisations address the risk associated with disruptive cyberattacks: (1) recovering from a highly disruptive attack, which covers the immediate response, recovery to minimum viable operations, and the longer-term rebuild of affected organisations; (2) preparing for highly disruptive cyber incidents, which provides guidance on preparing the plans, people, technical capabilities and decision-making processes in advance; and (3) reducing the risk of highly disruptive cyberattacks, regarding early action to reduce the likelihood and impact of an attack.

EMEA updates:

First harmonised standard supporting the AI Act published in the Official Journal

European Commission – 19 October 2026

The European Commission has published the reference to the first harmonised standard supporting the implementation of the AI Act in the Official Journal of the European Union. The standard is said to provide a clear legal pathway for providers of high-risk AI systems to comply with the quality management system requirements under article 17 of the EU AI Act. The standard exists in addition to current international standards (e.g. ISO/IEC 42001) without replacing them. Organisations without ISO/IEC 42001 that plan to place high-risk AI systems on the EU market can therefore use this new harmonised standard to build a quality management system that fulfils the article 17 requirements.

Hackers force French supermarket fridges to heat up to 50C in ‘unprecedented’ cyber-attack

The Guardian – 12 October 2026

Hundreds of French supermarkets have been hit by a cyberattack that caused their fridges to heat up, spoiling fresh and frozen food estimated to be worth millions of euros. France’s national cybersecurity agency ANSSI initially suggested that this was linked to a vulnerability in software supplied for refrigeration management systems. However, the director of ANSSI later explained to the French Senate that the main cause of the incident was that the relevant systems could be reached directly from the Internet, without firewall protection, and their administration interface was protected only by weak passwords (see report by Le Monde Informatique). 

US updates:

Pentagon hit with class action over data breach affecting millions of military members

Reuters – 21 October 2026

A class action lawsuit was filed against the US Department of War in the District Court for the District of Columbia, alleging the Department failed to protect sensitive personally identifiable information from a cyber breach last year. The cyber breach at the Defense Manpower Data Center has allegedly resulted in the disclosure of Social Security numbers, dates of birth and other personal information belonging to millions of current and former military members. The Plaintiffs and class members allege that the Department failed to establish appropriate administrative, technical, and physical safeguards, such that they are entitled to damages under the Privacy Act of 1974.

General updates:

Websites taken down worldwide as cyber-security update issued related to PHP vulnerabilities

BBC – 21 October 2026

International governments and agencies have urged websites to address two critical cyber-security flaws in the PHP (PHP Hypertext Preprocessor) programming language, which is a widely used server-side scripting language designed for web development. The flaws were said to have gone undetected for more than a decade and were discovered only recently using AI tools. The UK National Cyber Security Centre has encouraged all organisations to identify systems running PHP across their infrastructure, update to the latest fixed version of PHP, and continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP.

Managing AI token consumption for operational resilience

Canadian Centre for Cyber Security – 22 October 2026

AI usage limited by tokens presents new operational risks for organisations adopting AI services, especially critical national infrastructure operators. One potential risk is a denial-of-tokens attack, where threat actors intentionally generate excessive AI usage to exhaust token allocations, consume budgets and resources, or trigger rate limits. To address the risks associated with AI token usage, the authors recommend organisations to strengthen governance and oversight measures, including greater oversight over how token allocations are prioritised.

Securing the agentic insider 

Official Microsoft Blog – 19 October 2026

Microsoft warns that there is a risk for "agentic insiders" to potentially cause cyberattacks from within companies. In response, it is developing an agentic security system that uses Microsoft's new cyber stack to help defend both external AI-driven attacks and potential attacks from agentic insiders. These "Guardian Agents" will actively and continually supervise every action of every agent and surgically respond as the risk profile increases, in real time.

Microsoft publishes Digital Defense Report 2026

Microsoft – 5 October 2026

In its latest Digital Defense Report, Microsoft notes that AI is “changing the physics of cybersecurity”, as AI is compressing attack timelines, reducing the cost of sophisticated capabilities, and allowing attackers to operate with greater speed, scale and autonomy. Meanwhile, the report suggests that people remain a heavily exploited initial-access path, and attackers will continue to take advantage of unnecessary privileges, persistent access and weak identity governance. Looking ahead, the report explains that the biggest future threats are likely to come from open-source supply chain compromise and attacks against edge devices that provide an entry point into core networks with AI as a force multiplier for malicious activity.