Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CYJAX profiles APT41’s BlackX UEFI bootkit campaign against Central Asian diplomatic agencies and the UAC-0099 and Sandworm compromise of a Ukrainian grain logistics company, with key takeaways and defensive guidance. APT41 is using a UEFI bootkit against Central Asian diplomatic agencies, while UAC-0099 appears to have handed a backdoor to Sandworm in Ukraine. CYJAX breaks down both threats and what defenders should do next.

PHP2Shell is a pair of critical PHP flaws that leaked before disclosure and drew instant interest from attackers. This post covers what CYJAX analysts have seen on cybercriminal forums and code repositories, and what organisations running PHP should do now.

his blog explains what multi-tenant threat intelligence is and why running one intelligence feed across many clients is one of the hardest jobs an MSSP has. It covers how a single compromise can spread across a client base, what MSSPs should look for in intelligence built for many tenants, and how the Cyber Security and Resilience Bill raises the stakes for UK providers.

Cyber attacks on UK retailers and manufacturers have shown boards that cyber risk is business risk. This blog explains why the whole organisation needs to understand the value of threat intelligence, and sets out the metrics that translate intelligence into language the board understands: money, time, exposure and reputation.

Open banking drives financial innovation but introduces new cybersecurity risks through APIs, exposed credentials and third-party integrations. Discover how cyber threat intelligence helps financial institutions identify emerging threats, improve visibility and strengthen security.

On 6 October 2026, ASOS customers received an extortion message through the retailer's own app claiming its Snowflake instance had been compromised. CYJAX looks at what happened, why third-party and cloud platform risk sits at the centre of the incident, and how organisations can monitor their extended supply chain before attackers do. By now, most people in the UK will have heard about the cyber incident that hit ASOS on 6 October 2026.

Most security teams aren't short of data. The harder problem is turning that data into intelligence they can act on. This guide sets out the seven criteria that separate an effective threat intelligence tool from another unused dashboard: dark web coverage, relevance, human analysis, speed, multi-audience outputs, integration and provider trust. It also covers the red flags to watch for during procurement and gives ten questions to ask every vendor.

Refund fraud has grown into an organised underground economy, with fraudsters selling refunds as a service and using AI to fabricate evidence. This blog explains the main techniques, why they are easy to miss, and how UK organisations can detect them.

Cybersecurity Awareness Month has encouraged safer online behaviour every October since 2004, but AI-enabled attacks are changing what awareness needs to look like. This article looks at the campaign's history, the latest UK threat data, and why organisations should ground their awareness efforts in real threat intelligence.

OpenAI agents exploited internal infrastructure to reach Hugging Face's production systems, while cybercriminal group ZeroBytes, which has exclusively targeted France, has gone quiet following two arrests. CYJAX rounds up what happened and what it means for defenders. OpenAI agents exploited internal infrastructure to reach Hugging Face's production systems, while cybercriminal group ZeroBytes, which has exclusively targeted France, has gone quiet following two arrests.