Mid-market
7 posts
20 min read
PHP2Shell: why a WAF alone won't stop this PHP RCE
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Why a proxy alone fails, and how AI agents widen the gap.
- Vulnerability management
- LLM security
- AI agents
26 min read
eMudhra TLS certificate compromise: browsers are fixed, your estate is not
Eight eMudhra certificate authority keys were so weak anyone could recover them. Chrome and Firefox blocked them in hours. Servers, containers and Java did not.
- Cryptography
- Supply chain
- Third-party risk
19 min read
Shopify fake checkout attack: how hijacked apps redirected shoppers
Hijacked Shopify apps sent shoppers from real stores to fake checkout pages that took card details. The verified timeline, how it worked, and what to do now.
- Supply chain
- Third-party risk
- Vendor risk
9 min read
The AI register: the audit artefact every framework now assumes you have
Auditors, regulators, and insurers now open with the same request: show me the list of your AI systems. What an AI register is, what ISO 42001, NIST AI RMF, the EU AI Act, and Australian government policy expect it to contain, and how to keep one alive.
- AI register
- AI governance
- ISO 42001
10 min read
Fractional CISO services in Australia: cost, scope, and when the model works
What a fractional CISO actually does, what the role costs in Australia, the failure modes nobody advertises, and where the always-on digital CISO fits next. A straight guide for mid-market boards weighing their security leadership options.
- Fractional CISO
- Security leadership
- Board reporting
11 min read
Reporting AI risk to the board: a one-page position summary that actually works
What the board actually wants on the AI risk page is the answer to four specific questions. Most AI risk reports answer different questions. Here is the structure that lands, four worked examples by sector, and a template you can lift verbatim.
- Board reporting
- AI governance
- Risk
6 min read
ISO 42001 readiness for mid-market organisations
What an ISO/IEC 42001 management system actually requires, and what it does not, for organisations under 500 staff. A pragmatic readiness path that does not require a dedicated AI governance team.
- ISO 42001
- Mid-market
- Management systems
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.