Decrypted: The UK Cyber Briefing
Oct 1, 2026 · 5 min · 5 segments
Attackers exploited CVE-2026-76504, a critical Cisco Catalyst SD-WAN Manager authentication bypass, before a fix existed. What UK organisations should check today, and the design choice that would…
Next, a spelling trick at the front door.
In plain English, a web address can write the same character two ways: as itself or as a percent code.
The letter J, for example, can also appear as percentage six-A.
Picture a doorman with a list of rooms guests may not enter.
He reads each badge literally and waves through anything that doesn't match a forbidden name.
The staff inside read the badge more cleverly, so a name written in an unexpected hand still sends the guest to the forbidden room.
The check and the action disagree about what the request says, and the attacker lives in that gap.
The result is that a crafted request reaches the management API with the privileges of the admin user.
It hasn't said who is behind the attacks.
Next, a spelling trick at the front door.
In plain English, a web address can write the same character two ways: as itself or as a percent code.
The letter J, for example, can also appear as percentage six-A.
Picture a doorman with a list of rooms guests may not enter.
He reads each badge literally and waves through anything that doesn't match a forbidden name.
The staff inside read the badge more cleverly, so a name written in an unexpected hand still sends the guest to the forbidden room.
The check and the action disagree about what the request says, and the attacker lives in that gap.
The result is that a crafted request reaches the management API with the privileges of the admin user.
It hasn't said who is behind the attacks.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
