https://www.zarco.uk/blog/ Plain-English guides on Cyber Essentials, DCC, penetration testing and putting AI to work safely. en-gb Fri, 30 Oct 2026 00:00:00 GMT https://www.zarco.uk/blog/south-korea-ai-hacking-case https://www.zarco.uk/blog/south-korea-ai-hacking-case Fri, 30 Oct 2026 00:00:00 GMT Zarco Analysis Police say one attacker used AI tools to breach 60 organisations in six weeks. What happened in South Korea, who was hit, and what UK businesses should do. https://www.zarco.uk/blog/what-you-pay-for-in-a-penetration-test https://www.zarco.uk/blog/what-you-pay-for-in-a-penetration-test Tue, 27 Oct 2026 00:00:00 GMT Tom Reynolds Perspective Much of a traditional penetration test is scanning, waiting and report writing. What a penetration test should mean, and seven questions to ask before you buy. https://www.zarco.uk/blog/what-a-penetration-test-report-should-include https://www.zarco.uk/blog/what-a-penetration-test-report-should-include Tue, 27 Oct 2026 00:00:00 GMT Tom Reynolds Pentesting The sections that make a penetration test report useful, the warning signs of one that isn't, and how to act on the findings. https://www.zarco.uk/blog/dcc-level-0-and-level-1-explained https://www.zarco.uk/blog/dcc-level-0-and-level-1-explained Tue, 27 Oct 2026 00:00:00 GMT Tom Reynolds Defence Defence Cyber Certification for Ministry of Defence suppliers: who sets your level, what Level 0 and Level 1 require, and what to do next. https://www.zarco.uk/blog/cyber-essentials-or-cyber-essentials-plus https://www.zarco.uk/blog/cyber-essentials-or-cyber-essentials-plus Tue, 27 Oct 2026 00:00:00 GMT Tom Reynolds Compliance What Cyber Essentials and Cyber Essentials Plus each check, who usually asks for which, and how to prepare so you pass first time. https://www.zarco.uk/blog/http2shell-cve-2026-111497-technical-guide https://www.zarco.uk/blog/http2shell-cve-2026-111497-technical-guide Mon, 26 Oct 2026 00:00:00 GMT Tom Reynolds Advisory The fixed versions for Node.js, Bun, .NET, Python, Envoy, Istio and Brotli, and how to find every copy, contain it while you patch and prove the fix is live. https://www.zarco.uk/blog/website-attack-surface-security https://www.zarco.uk/blog/website-attack-surface-security Sat, 24 Oct 2026 00:00:00 GMT Tom Reynolds Guide Eight practical ways to reduce website exposure, protect recovery options and verify the controls your business depends on. https://www.zarco.uk/blog/the-internet-has-a-fever https://www.zarco.uk/blog/the-internet-has-a-fever Sat, 24 Oct 2026 00:00:00 GMT Tom Reynolds Perspective AI didn’t create this autumn’s vulnerabilities. It made looking for them cheap. Why the spike in disclosures is an immune response, not a collapse. https://www.zarco.uk/blog/http2shell-brotli-cve-2026-111497 https://www.zarco.uk/blog/http2shell-brotli-cve-2026-111497 Sat, 24 Oct 2026 00:00:00 GMT Tom Reynolds Advisory A critical flaw in Brotli, the compression code inside Node.js, Python and much of the web, can let an attacker run code without logging in. What to do now. https://www.zarco.uk/blog/black-october-ai-cybersecurity-attack-paths https://www.zarco.uk/blog/black-october-ai-cybersecurity-attack-paths Sat, 24 Oct 2026 00:00:00 GMT Tom Reynolds Analysis What October 2026’s PHP, OpenCode, Railway and LiteLLM disclosures reveal about application exposure, credential risk and adversarial testing.