Cyber Security Redefined
Why Partner with CyberWhite?
24 hours a day and seven days a week, we support clients irrespective of sector, size, or location.
We deliver information security advisory services, risk mitigation strategies and technical solutions to protect information within organisations.
We deliver innovative services, tailored to suit specific organisational requirements and risk profiles. We then map these against the appetite to address identified risks, providing a fully managed support network to ensure successful a project outcome.
Our Latest Resources
Here we discuss everything from cyber security news and knowledge updates to the latest technology and events.
AI users you never see
Non-human identities & AI agents – The users you never see: taming service accounts and AI agents. A primer on controlling non-human identities (NHIs)—service accounts, API tokens, AI agents—which can outnumber humans 80:1. Challenges: poor ownership, over-permissioning, no lifecycle. Guidance: discover/inventory NHIs, assign owners, automate lifecycle, and enforce guardrails under an identity security fabric. Your […]
SolarWinds Web Help Desk RCE
SolarWinds Web Help Desk RCE – Third time lucky? Patch Web Help Desk—again. SolarWinds issued hotfix 12.8.7 HF1 for CVE-2025-26399 (CVSS 9.8)—an unauthenticated AjaxProxy deserialisation RCE in Web Help Desk. It’s a patch-bypass of prior CVEs (2024-28986/28988). No known exploitation yet; history suggests urgency as earlier bugs hit CISA KEV. Upgrade immediately. Another critical RCE […]
Pandoc AWS IMDS
From document converter to cloud key-nicker. Pandoc CVE-2025-51591 → AWS IMDS. Researchers report in-the-wild abuse of Pandoc SSRF (CVE-2025-51591, CVSS 6.5) to query AWS Instance Metadata Service, stealing EC2 IAM credentials. Root cause: Pandoc renders <iframe> in HTML; mitigations include sandbox flags or sanitising input. Shows continued IMDS targeting via “quiet” dependencies. A flaw in […]
Cisco ASA zero-days
Cisco ASA zero-days: RayInitiator / LINE VIPER. Old firewalls, new tricks The UK NCSC and Cisco detail zero-day exploits against ASA 5500-X firewalls (often EoS), deploying a persistent GRUB bootkit (RayInitiator) and user-mode loader LINE VIPER. Flaws include CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 (6.5); a separate CVE-2025-20363 is patched. Tactics: disable logging, intercept CLI, crash […]
SVG to PureRAT
SVG → CountLoader / PureRAT – From picture to problem. Phishing emails impersonating Ukrainian authorities deliver SVG attachments that start a chain: SVG → ZIP → CHM → CountLoader → payloads like Amatera Stealer and PureMiner; related campaigns evolve to PureRAT backdoors. Fileless techniques (AOT, process hollowing) and credential theft feature heavily. Those harmless-looking SVGs […]
MS-LLM-crafted SVG phishing
AI meets phishing: SVGs with a suit and tie. Microsoft warns of a phishing campaign using LLM-generated, business-themed SVG files to hide malicious JavaScript and evade filters. The attack used self-addressed emails (BCC targets) and fake file-share lures; the SVG redirected via CAPTCHA to credential harvest pages. Microsoft’s analysis notes verbose, over-engineered code and business […]
SAP patches critical NetWeaver
SAP patches critical NetWeaver bugs (CVSS up to 10). Time to patch, not panic. SAP has released September patches addressing multiple flaws, including three critical issues in SAP NetWeaver (CVSS scores up to 10.0) that could allow code execution, arbitrary file upload, or unauthorised access—one via the RMI-P4 module. A high-severity bug in SAP S/4HANA […]
Salty2FA phishing kit
Salty2FA: the phishing kit that pinches your codes (not your chips) Researchers at ANY.RUN have identified Salty2FA, a phishing-as-a-service kit used across the US and EU that steals credentials and bypasses 2FA (including push, SMS and voice). Campaigns ramped up from June 2025 and target sectors such as finance, energy, telecoms, healthcare and government. A […]
Patch Tuesday September 2025
Microsoft Patch Tuesday (September 2025): 80 fixes, one very nosey SMB bug Microsoft’s September 2025 Patch Tuesday fixes 80 vulnerabilities: 8 Critical and 72 Important. None are known to be exploited, but one flaw was publicly disclosed before patching: CVE-2025-55234 in Windows SMB, which can enable relay attacks leading to privilege escalation if SMB signing/EPA […]
AsyncRAT rides ScreenConnect
AsyncRAT rides ScreenConnect: what’s going on? Researchers detail a campaign abusing ConnectWise ScreenConnect to deploy AsyncRAT and pinch credentials and crypto. Attackers either hijack a ScreenConnect session or lure victims with trojanised installers in phishing emails. Once in, they run a layered VBScript + PowerShell loader that fetches two payloads (“logs.ldk” and “logs.ldr”), sets up […]
FBI warning SalesForce
FBI warning: crime rings are nicking your Salesforce data The FBI has issued a flash alert about two financially motivated threat clusters, UNC6395 and UNC6040, actively raiding Salesforce environments for data theft and extortion. UNC6395 piggy-backed on the Salesloft Drift incident by abusing compromised OAuth tokens, a breach Salesloft links to an earlier GitHub account […]
HybridPetya
HybridPetya: the ransomware that slips past Secure Boot Security researchers (ESET) have analysed a new ransomware strain dubbed HybridPetya, which echoes Petya/NotPetya but adds a modern twist: it can bypass UEFI Secure Boot using a now-patched flaw (CVE-2024-7344) in a UEFI component. Samples appeared on VirusTotal in February 2025. HybridPetya works via an installer + […]
Automation is redefining pentesting
Automation is redefining pentesting (and yes, it’s about time) While penetration testing remains essential, the delivery of results hasn’t kept pace. Many teams still receive long, static PDFs and then manually copy findings into tools like Jira or ServiceNow—adding delays and eroding value. It promotes automated pentest delivery: streaming findings in real time into the […]
Citrix rushes fixes for NetScaler
Citrix rushes fixes for three NetScaler bugs — one’s already being exploited Citrix has released patches for three security flaws in NetScaler ADC and NetScaler Gateway. One of them—CVE-2025-7775 (CVSS 9.2)—is already being actively exploited. The others are CVE-2025-7776 (CVSS 8.8) and CVE-2025-8424 (CVSS 8.7). • 7775/7776 are memory overflow bugs that can lead to […]
edge devices in the firing line
Salt Typhoon: edge devices in the firing line “Salt Typhoon,” a China-linked APT, has been exploiting vulnerabilities in edge network devices (notably from Cisco, Ivanti and Palo Alto Networks) to break into organisations worldwide—around 600 victims across 80 countries, including the UK. Initial access involves known CVEs (e.g., Cisco IOS XE and Smart Install flaws, […]
Salesloft Drift OAuth breach
Google: Salesloft Drift breach bigger than expected Google and Mandiant warned that the recent Salesloft Drift OAuth breach is broader than first thought, affecting all Drift integrations, not just Salesforce. Attackers stole OAuth tokens and, in some cases, accessed Salesforce data and even a small number of Google Workspace mailboxes tied specifically to Drift’s email […]
attackers-abuse-velociraptor-forensic
Attackers turn Velociraptor into a C2 taxi • What happened: Researchers spotted attackers installing the open-source forensic tool Velociraptor and then using it to fetch and run Visual Studio Code in “tunnel” mode—turning a developer editor into a handy route back to an attacker-controlled C2 server. • How they got in: Windows msiexec pulled an […]
browser becomes attack surface
Browsers: your biggest risk you’re staring at all day This piece argues the humble web browser has become a prime battleground: the author claims over 80% of security incidents now start in browser-based apps and spotlights Scattered Spider (aka UNC3944 / Octo Tempest / Muddled Libra) for targeting identities and data inside Chrome, Edge, Firefox […]
Cisco FMC critical bug
Cisco’s Fire-fighting Console Has a Howler: Patch Your FMC, Pronto Cisco has patched a critical (CVSS 10.0) flaw in Secure Firewall Management Center (FMC) that sits in its RADIUS authentication code. An unauthenticated attacker can inject commands during login and achieve remote code execution—but only if RADIUS is enabled for the FMC web UI or […]
FortiSIEM critical wobble
FortiSIEM’s critical wobble: patch first, tea later Fortinet has disclosed a critical pre-auth command-injection flaw in FortiSIEM—CVE-2025-25256 (CVSS 9.8)—and says exploit code exists in the wild. The bug sits in the phMonitor process (port 7900), where inadequate input sanitisation can let an unauthenticated attacker run OS commands. Fortinet lists affected branches and fixed versions, notes […]
Our Services
What Our Clients Say
“CyberWhite have been a pleasure to deal with by repeatedly demonstrating their professionalism and technical knowledge throughout the procurement process and execution of our project. From initially exploring our goals to a consultant working with us on-site and remotely, we’ve enjoyed a positive experience that has ultimately benefited our organisation and helped to improve our Cyber Security posture.”
“I would like to say a thousand “thank you’s” to CyberWhite after rescuing us from the commercial disaster we faced after being subjected to a very sophisticated fraud. Without the timely involvement and expertise from CyberWhite, we would undoubtedly have faced catastrophic consequences including a significant financial loss and possibly a forced closure of the business. We will always remember the kindness and professional approach taken by the CyberWhite team. They were able to successfully recover the critical data which was the life blood of our business. This expertise has allowed us to continue trading and provided us with the additional benefits of ensuring that we are more cyber risk aware and we now have a security partner to support us.”
“As an Operator of Essential Services, PX Group comply with advice provided by recognised security bodies such as NCSC. The advice is relevant to all organisations who provide infrastructure or support to the UK’s critical national infrastructure. PX Group engaged CyberWhite to undertake Third Party Security Audits (aligned to ISO28000:2007) against key suppliers who had access to information assets within the PX Group domain. CyberWhite created a comprehensive audit document set and supported this with interviews and visits in order to validate responses. The output from CyberWhite was comprehensive and provided security assurance to PX Groups stakeholders and interested parties that the key suppliers had a focus on security and understood and could demonstrate best practices in relation to the handling of PX Groups information assets. This process has been invaluable in validating what we believed and providing a platform from which we will continue to assess, review and benchmark all parties in our information supply chain.”
Do you know how secure your systems are?
We have a wide range of industry leading cyber security tools at our disposal. But first we will identify any vulnerabilities, specify our recommended solutions, then help you prioritise an effective schedule to greatly reduce your cyber risk exposure.
Meet the CyberWhite Team
CyberWhite News
Malware Takes Aim at Healthcare Industry
ResolverRat Malware Takes Aim at Healthcare Industry A malicious campaign using ResolverRat malware has been targeting healthcare providers globally, taking advantage of open RDP connections and phishing scams. The malware provides remote access to compromised systems, enabling attackers to exfiltrate medical data and potentially disrupt patient services. Security researchers warn that ResolverRat’s operators appear to […]
CyberWhite’s Path to Net Zero
At CyberWhite, we are determined to achieve net-zero carbon emissions by 2030. The video below showcases our efforts to reduce our carbon footprint significantly: Embracing Renewable Energy: We aim to minimise reliance on fossil fuels by investing in solar power. Green Transportation Solutions: Shifting to electric vehicles and encouraging remote work to cut down commuting […]
David Horn speaks on recent data breach at top UK organisations
At the end of May, 8 of the biggest organisations in the UK were hit with a cyber-attack exposing thousands of employees’ bank and personal data through their payroll system. So far only 3 of the companies have been named in the data breach: British Airways, Boots, and the BBC, with no official confirmation on […]
Partnership with Vianet Group PLC
CyberWhite Ltd announces partnerships with Vianet Group PLC and px Group for 3-year agreement’s to provide cyber security advice and support. David Horn and Matthew Hewison of CyberWhite met with px’s Mark Willis and Vianet’s Thom Menzies, to discuss how working closely together over the coming months and years will not only benefit businesses in […]
CyberWhite Open New HQ
CyberWhite are pleased to annouce the opening of their new HQ in Sunderland.
Meet the neighbours – Northern Spire Ltd
We were delighted this week to appear in Wear Business as they ran a featured article Northern Spire ltd, welcoming CyberWhite as business neighbours in Defender Court. Northern Spire specialise in providing a wide range of financial services and operate as a senior partner practice of St James’s Place Wealth Management. CyberWhite’s relationship with Northern […]
CEO Sleepout – Fundraising Total
CEO SLEEPOUT – FUNDRAISING UPDATE You may remember earlier in the year that our Director, Matt Hewison took part in the CEO Sleepout event in Middlesbrough city centre. We can now inform you that the event raised a phenomenal c£21,800.00!!! Over 40 people bedded down at Middlesbrough Town Hall in the pouring rain, to raise […]
Weekly Round Up 19th – 23rd July
Welcome CyberWhite followers to our latest week in review. We’d like to first of all thank all of our current and new followers. It means a great deal to us that our security advice is able to reach you. It would be fantastic if you could lend us a helping hand simply by liking our […]
New Middlesbrough office for cyber security firm
Middlesbrough Mayor, Andy Preston with CyberWhite directors Matt Hewison and David Horn CyberWhite, an established provider of cyber security and cyber risk mitigation solutions for business, has opened a new office in Middlesbrough’s Boho Zone. The technology solutions provider is proud to be at the centre of a number of key local developments for the […]
CyberWhite’s Week in Review – 17 May to 21 May
We’d like to take a moment of your time and share with you what CyberWhite have been up to during the last week in case you’ve missed any of our activities. Please click the button below to download our week in review. We hope you enjoy it. Any questions, please get in touch. Click here […]
Businesses urge local authorities to take action
A group of North East businesses has written to the newly elected police and crime commissioner for Cleveland to call on him to put tackling fraud at the heart of his agenda as increasing numbers of people and businesses are targeted. Active Chartered Financial Planners, a Stockton-based finance specialist, Cyberwhite, a cyber security specialist with […]
Budget 2021
We’re sure you’ve all been keeping up to date with the 2021 Budget unveiled by Chancellor Rishi Sunak in the House of Commons. As we look ahead to life on the other side of the pandemic, the Chancellor released several initiatives that look to have a hugely positive impact on the North East, and in particular, the Tees valley region. As a growing business […]
CyberWhite Newsletter Summer 2020
Summer is officially here and so is our much anticipated Summer 2020 Newsletter This edition contains a fantastic interview with industry veteran Bruce Hockin, Channel Sales Director from Arcserve plus interviews with our very own Jemma Cavana-Cole and Charlotte Topping. You can also find out more about what we’ve been up to during lockdown including […]
Finalist in the ‘Small Business of the Year’
We are delighted to announce that CyberWhite Ltd has been named as a finalist in the ‘Small Business of the Year’ category in the upcoming UK Social Mobility Awards. CyberWhite Ltd is committed to making a difference and we are incredibly humbled to have our efforts recognised in these flagship awards.
CyberWhite Sponsors Young Teesside Cricketers
CyberWhite, a cybersecurity firm based in Seaham, is sponsoring Saltburn Cricket Club Under 13s following a disturbed start to the season due to COVID 19. Matt Hewison, chief operating officer of the firm, has been coach and manager of the team for the past two seasons, and wanted to increase his support of the club […]