Paul Oggelsby - Report URI Blog

php2shell

What the PHP Security Crisis Reveals About Cyber Preparedness

Over the last few days, a serious security vulnerability in a technology most people have never heard of has caused disruption across the internet. Government websites have been taken offline, security teams have been working around the clock, and organisations around the world have been urgently reviewing their exposure. The

Why We Joined the W3C

One thing I've learned over the years is that the best businesses don't simply react to change. They position themselves where change is happening. That applies just as much to cybersecurity as it does to any other industry. Every year, organisations invest millions in new security

The WooCommerce Attack Every Security Executive Should Pay Attention To

A recent WooCommerce attack, analysed by Scott Helme, Report URI's CEO, exposed something many organisations are still struggling to fully grasp: Your website can be actively stealing customer payment data while appearing to function completely normally. No outage. No ransomware. No obvious breach. No backend compromise alerts. Customers

White Paper

Passkeys Are a Big Security Upgrade — But They’re Not the Whole Story

Passkeys are one of the best improvements to online security in a long time. They are designed to replace passwords with a safer, easier way to sign in. That means no more reused passwords, much less risk from phishing emails, and far better protection against attackers trying stolen login details

NCSC

When Free National Security Tooling Goes Away: Why the Retirement of Web Check and Mail Check Matters

Most organisations don’t have a clear view of their external attack surface, what’s exposed, what’s changed, and where risk may be building over time. For many UK organisations, the National Cyber Security Centre’s Web Check and Mail Check services have quietly filled part of that gap.

Stripe Is Quietly Raising the Bar on Website Security. Most Security Leaders Haven’t Noticed Yet

Stripe has recently updated its security guidance to explicitly require merchants to have visibility into what code is running on their websites. In their certification process is a clear expectation: organisations handling payments should be monitoring client-side behaviour, not just backend systems. This isn’t a new regulation or

Magecart

What the European Space Agency Attack Teaches Security Leaders About Client-Side Risk

In late 2024, extending into 2025, the European Space Agency was forced to take its online store offline following a Magecart-style attack that compromised customer payment data. The incident was not the result of a traditional breach, stolen credentials, or a failure of perimeter security. It happened quietly, inside