The NCSC tells us to patch security vulnerabilities. Its parent agency, GCHQ, exploits them to hack targets.
When GCHQ discovers a 0-day, does it disclose it to protect the public, or keep it secret to exploit?
Isn't this a massive conflict of interest?
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-…





