The vulnerability

The flaw, tracked as CVE-2026-0257, affects the GlobalProtect portal component of PAN-OS, the operating system that runs Palo Alto’s PA-Series and VM-Series firewalls. Attackers abuse an authentication bypass vulnerability that allows them to circumvent multi-factor authentication and establish a foothold on networks connected to vulnerable appliances. Unit 42’s investigation, which began in early June, identified two ransomware groups — Qilin and Inc — as the primary operators leveraging the bug. Both groups have previously targeted critical infrastructure in the UK and Europe, raising alarms among British security agencies.

How the attacks unfold

Once inside a compromised network, the attackers use stolen credentials to perform lateral movement through RDP and SMB protocols, accessing domain controllers and VMware ESXi virtualisation hosts. A custom tool was found dumping credentials directly from ESXi VMDK files, giving the groups persistence across reboots and the ability to deploy ransomware payloads hours or days later. The attacks have affected organisations across education, finance, healthcare, technology, hospitality, manufacturing, professional services, government, transport, utilities and retail — sectors that handle sensitive data and cannot afford prolonged outages.

UK exposure

British organisations running PAN-OS GlobalProtect portals are advised to patch immediately, as the National Cyber Security Centre has added the threat to its security advisories. The NCSC’s latest alert notes that UK healthcare trusts, local councils and transport operators have been among the most aggressively targeted, with attackers exploiting remote access configurations that became ubiquitous during the shift to hybrid working. The vulnerability is particularly dangerous because firewalls sit at the network perimeter — compromising them can expose entire downstream infrastructures, including systems that were otherwise air-gapped or segmented.

Why it matters

For British citizens, the implications extend beyond corporate boardrooms. NHS trusts that process patient records through vulnerable endpoints, local councils managing social care data, and energy grid operators protecting critical systems all face elevated risk. The ransomware groups behind these attacks have shown willingness to leak sensitive personal data publicly when negotiations break down, which means medical records, council files and utility customer databases could end up exposed. The UK government is reportedly preparing updated cyber insurance guidelines in response to the wave of incidents.

What happens next

Palo Alto Networks released patches for CVE-2026-0257 in September, but Unit 42 warns that many organisations have not yet applied them. The NCSC expects the attack rate to persist through the end of the year as groups continue to exploit laggard deployments. Organisations that remain unpatched should disable GlobalProtect portals where possible, enforce network segmentation, and implement additional monitoring for unusual RDP and SMB traffic. Security researchers note that the sophistication of these attacks — particularly the ESXi credential dumping tool — suggests state-sponsored actors may be providing support to the ransomware groups, blurring the line between criminal and geopolitical threats.

The claim

“I told President Trump that if we want to prevent Iran from reconstituting its nuclear weapons programme, we must consider eliminating the regime in Tehran,” Netanyahu was reported as saying. Al Jazeera noted that the comments came amid heightened rhetoric following the UN General Assembly session, where both leaders signalled a hardline stance toward Iran’s regional activities. The Israeli leader has repeatedly framed Iran as an existential threat, citing its support for proxy groups across the Middle East. British officials have watched these statements with concern, as any shift toward military action would require rapid coordination with Washington given the special relationship between the two nations.

UK diplomatic challenge

Prime Minister Burnham finds himself navigating between Israel’s stated security concerns and the UK’s own strategic calculations. While London maintains a close defence partnership with Israel, British officials have repeatedly emphasised that military action should remain a last resort. The Foreign Office is monitoring the situation closely as diplomatic channels assess whether Netanyahu’s comments signal an imminent shift in U.S. policy. The Cabinet Office’s latest intelligence update warns that escalation risks could disrupt commercial shipping through the Persian Gulf, a route that carries a portion of the UK’s energy imports.

Why it matters

British households should understand that the UK’s stance on Iran directly affects national security priorities at home. Iranian cyber operations targeting critical infrastructure have increased in frequency, and the government has warned energy companies to raise their defences against potential reprisals. Any escalation in the region also threatens commercial shipping through the Persian Gulf, which carries a portion of the UK’s oil imports. Defence planners are reviewing response capabilities as diplomatic channels remain under strain.

What happens next

In coming weeks, European allies are expected to coordinate a unified response to Iran’s nuclear programme at a series of diplomatic meetings. The UN Security Council will review the latest IAEA report on Iran’s compliance, while British ministers face questions in Parliament about the UK’s preparedness for potential escalation. Prime Minister Burnham is scheduled to host a quarterly National Security Council meeting where Iran’s regional ambitions and the threat of military action will be assessed. For now, the UK’s strategy remains anchored in diplomacy, even as the rhetoric from Tel Aviv and Washington grows more pointed.

The nationalism argument

“The war on Iran could strengthen Iranian nationalism rather than trigger regime change,” Negar Mortazavi told Al Jazeera at the Global Security Forum. “External military pressure tends to rally domestic support behind the current leadership, as Iranians close ranks against a perceived foreign threat.” This dynamic has played out repeatedly across the region — from the 2006 Lebanon conflict to the 2019 Gulf tensions — where attempted regime change through military means produced the opposite of its intended effect. Iranian officials have long framed Western intervention as evidence of hostility toward the Islamic Republic, a narrative that resonates with nationalist sentiment across the political spectrum.

UK strategic calculations

Prime Minister Burnham has so far stopped short of endorsing military action, instead supporting diplomatic pressure through the P5+1 framework and targeted sanctions. His government’s approach reflects concern not only about Iranian behaviour but also about the broader regional fallout from any escalation. British security services monitor Iranian cyber operations and proxy networks that operate across the Middle East, including through allied Shia militias in Iraq and Hezbollah in Lebanon. The Cabinet Office’s latest intelligence assessment notes that military action risks uniting Iranian factions that are otherwise divided over economic policy and social reforms.

Why it matters

British households and businesses face direct consequences if tensions with Iran escalate into conflict. Energy markets have already shown volatility during previous confrontations, and any disruption to shipping routes through the Strait of Hormuz could push up fuel and food prices. The UK’s Iranian diaspora community worries about family members trapped in the country, while defence contractors see stock prices fluctuate with each new development. Perhaps more fundamentally, the debate reveals a split within British foreign policy circles about whether pressure strengthens or weakens authoritarian regimes — a question that has shaped UK policy since the 2015 nuclear deal negotiations.

What happens next

Iran is expected to respond to new European sanctions with reciprocal measures within days, potentially targeting British financial institutions or energy sector interests. The UN Security Council meets next week to review the latest IAEA report on Iran’s nuclear programme, where the UK will seek to coordinate a unified Western response. Domestically, Prime Minister Burnham faces pressure from both those advocating regime change and those urging renewed diplomacy. The coming fortnight will be critical in determining whether the confrontation leads to negotiations or military action.

The day the mountain fell

Just after 9:15am on a Saturday morning, the coal tip above Aberfan began to shift. Within moments, 150,000 tons of slurry, water and coal debris cascaded down the mountainside, engulfing the school where children had gathered to prepare for their Christmas party. Rescue workers described “utter pandemonium” as they fought through mud and rubble in near-freezing conditions. The last survivor — eight-year-old Jeff Edwards — was pulled from the wreckage nearly 24 hours later. For families left behind, the grief has echoed across six decades.

Voices from the rubble

The BBC’s anniversary interviews capture the raw emotion that survivors still carry. Teacher Mair Morgan, then aged 25, recalled hearing the roar and running toward the school as the mountain moved. Six-year-old Gareth Jones described the dust and the eerie silence that followed. Jeanette Keane told of her desperate search for her daughter Edwina, while Denise Morgan spoke of losing her sister Annette in the collapse. Twenty-four pupils had left home for school that morning; only a handful walked away unharmed. These personal testimonies ensure that the human cost of the disaster remains vivid, not reduced to statistics.

Why it matters

The Aberfan disaster remains a defining moment in the relationship between the British state and its communities. The slow response from the National Coal Board and the government’s failure to provide adequate support for survivors and bereaved families left scars that took decades to heal. The tragedy shaped health and safety regulations across the UK, introduced new standards for industrial site management, and exposed the vulnerability of communities dependent on extractive industries. For today’s children learning about Aberfan in school, the story is a reminder of both community resilience and institutional failure.

What happens next

The 60th anniversary observances will include a service at St Matthias’ Church, where a memorial stands, and a wreath-laying ceremony at the disaster memorial garden. King Charles III, Queen Camilla and Prince William will join survivors and bereaved families at the village. A new exhibition at the Aberfan Heritage Centre opens this month, featuring previously unseen photographs and documents from the immediate aftermath. The survivor testimonies recorded by the BBC for this anniversary will be archived for future generations, ensuring that the personal stories behind the headlines are never forgotten.

The RAF Fairford investigation

RAF Fairford in Gloucestershire regularly hosts U.S. Air Force B-52 and B-2 strategic bombers on missions across the Middle East, making it a high-value target for adversaries seeking to gather intelligence or disrupt operations. Counter-terrorism sources say the fresh arrests are linked to an ongoing probe that began earlier this year, suggesting Iranian operatives may have been mapping security procedures or attempting to establish surveillance networks around the base. The two suspects, whose names have not been released, were first detained in September and rearrested after additional evidence emerged during the investigation.

Diplomatic implications

The case arrives as the UK and Iran navigate one of their most strained periods in decades. Prime Minister Burnham’s government has repeatedly condemned Tehran’s support for proxy groups across the Middle East and its nuclear programme expansion. Downing Street has not commented on the specific arrests, but diplomatic sources indicate that national security officials have briefed Washington on the investigation. The Foreign, Commonwealth & Development Office is expected to raise further concerns with Iranian officials through diplomatic channels in the coming days.

Why it matters

For British citizens, the re-arrests bring home a persistent reality: the UK remains a target for state-sponsored espionage and disruption campaigns. The focus on an RAF base that supports U.S. military operations also raises questions about the risks of being drawn into broader conflicts involving Iran. Every major deployment of British military assets abroad creates new vulnerabilities for adversaries to exploit, and the alleged Iranian plotting adds pressure on security services who must balance detection work with protecting sensitive operational details from leaks.

What happens next

The suspects will remain in custody while prosecutors decide on formal charges under the Terrorism Act. Investigators expect to pursue additional leads, including potential co-conspirators who may still be at large. With Defence Secretary Rachel Reeves due to appear before the Defence Select Committee this week, the government may face parliamentary questions about security at RAF bases and the broader threat landscape. The case also coincides with Prime Minister Burnham’s planned trip to Washington next month for talks with U.S. officials on Middle East strategy.

Pattern of Iranian activity

Britain has previously disrupted several alleged Iranian-planned attacks, including the 2017 Westminster incident and plots targeting transport hubs and energy infrastructure. Security sources note a pattern of using dual nationals and apparent lone actors, a tactic that complicates detection and prosecution. MI5’s director general recently warned Parliament that Iran’s Integrated Foreign Policy doctrine treats the UK as a priority target, using cyber operations, disinformation and human assets to advance what it describes as Tehran’s strategic interests against Western democracies.

UK government is expected to announce a long-awaited decision on whether to approve the Jackdaw gas field in the North Sea. It is widely believed in Westminster that Jackdaw will be approved but that a decision on the Rosebank oil field off Shetland will not yet be made.

What we know

The question of whether to approve the two sites has become hugely politically significant and has been delayed for several months. Multiple Whitehall sources have told BBC News the government would make an announcement on Jackdaw on Wednesday morning with the Energy Secretary Miatta Fahnbulleh expected to address MPs in the afternoon. Prime Minister Andy Burnham has spoken repeatedly of the need for a "flexible" approach to energy and is believed to be in favour of drilling more where licensing already exist in the North Sea. Labour's 2024 manifesto pledged not to issue any new oil and gas licences in the North Sea but to honour existing ones such as Jackdaw. Jackdaw, about 150 miles (241.4km) east of Aberdeen, is a gas field which its operators say could be connected to the UK network within months. Rosebank, about 80 miles (128.7km) north-west of Shetland, is Britain's largest untapped oil field, which would also produce some gas. The controversial fields have been the subject of years of debates, legal wrangling and public consultations, with arguments from both industry bodies and environmentalists being weighed up by the UK government. Licences for the fields were granted by the Conservative UK government in 2022 and 2023, which sparked legal challenges from environmental groups.

Originally reported by BBC UK.

Read the original report at BBC UK →

Latest violence

The casualties were reported in the Jabalia refugee camp and the Khan Younis area, where the Israeli Defence Forces said it was targeting Hamas operatives. The military confirmed that the strikes were carried out from the air and by drones, and said all targets were “terrorist infrastructure” — claims that the health ministry in Gaza disputes.

A 17-year-old boy and a 15-year-old girl were among those killed, according to the Palestinian Red Crescent, which treated survivors for shrapnel wounds. A married couple in their thirties were also confirmed dead at a local hospital.

UK response

Prime Minister Andy Burnham condemned the deaths of civilians and called for an immediate de-escalation, repeating the UK’s position that any Israeli military action must be proportionate and lawful. A Downing Street spokesperson said Mr Burnham is considering a further tightening of the government’s existing arms export controls on weapons that could be used in Gaza.

The Foreign Office confirmed that it is coordinating with partners on a humanitarian aid corridor, and that British charities have appealed for £20 million to support emergency medical supplies reaching the territory.

Humanitarian toll

The UN’s Office for the Coordination of Humanitarian Affairs reports that over 40,000 people have been displaced within Gaza since the escalation began three weeks ago, with shortages of clean water, medicine, and electricity affecting the entire population of two million.

Médecins Sans Frontières has evacuated its international staff but continues to operate surgical units through local medics, describing the medical situation as “critical” after major hospitals came under fire.

Why it matters

The cycle of violence in Gaza has global resonance, shaping diplomatic relations between the UK, the US, and regional powers including Iran. For British citizens, the conflict influences security policy, energy prices, and migration flows. The deaths of children in particular have mobilised protests across UK university campuses, reflecting the depth of public feeling about the civilian cost of the fighting.

What happens next

Emergency sessions of the UN Security Council are scheduled for tomorrow, where the UK — alongside European allies — is expected to propose a resolution calling for an indefinite humanitarian pause. Israel’s Security Cabinet meets tonight to decide on the next phase of operations. Aid agencies warn that the window for delivering supplies is narrowing, and the Foreign Office has recalled its ambassador to Israel for consultations. Prime Minister Burnham is expected to make a statement to the Commons on Thursday.

Clashes in Tirana

Demonstrators in central Tirana set fire to the headquarters of the governing Socialist Party and several bank branches, smashing shop windows and hurling stones at police lines. Riot police responded with water cannon and tear gas, and at least 30 officers and dozens of protesters were treated for injuries.

The unrest, now in its third day, follows the arrest of a prominent opposition MP on corruption charges last week. Opposition leaders say the charges are politically motivated and have called for fresh elections, while the government maintains that the rule of law is being upheld.

International reaction

European Union foreign policy chief Josep Borrell called for calm and dialogue, urging all parties to de-escalate. Prime Minister Andy Burnham’s office said the UK was monitoring the situation closely, noting Britain’s long-standing relationship with Albania through NATO and the Western Balkans partnership.

Downing Street confirmed that Mr Burnham had spoken with his Albanian counterpart by telephone, reaffirming the UK’s commitment to stability in the region. The Foreign Office issued an updated travel advisory for Tirana, though commercial flights continue to operate.

Root causes

The protests reflect a combination of economic frustration, political polarisation, and concerns over corruption that have simmered in Albania for years. Youth unemployment stands at over 30%, and several EU-funded infrastructure projects have stalled, fuelling public anger.

For the UK, the crisis in Albania — a NATO ally and candidate for EU membership — carries strategic weight. The country serves as a transit point for migration routes into Europe, and political instability there can ripple across the Western Balkans.

Why it matters

If the unrest continues unchecked, it risks undermining Albania’s path towards EU accession and destabilising a region that the UK has worked to keep firmly anchored in the Western alliance system. The fires in Tirana’s streets are a reminder that democratic institutions, once taken for granted, remain fragile in several Balkan states. For British policymakers, the crisis presents a test of diplomatic engagement without military involvement.

What happens next

Opposition leaders have announced plans for a fourth day of demonstrations tomorrow, while the government has pledged to hold an emergency cabinet meeting. The Albanian parliament is expected to convene a special session by the end of the week. International mediators from the EU and the US are understood to be preparing a joint statement calling for an immediate return to dialogue. Prime Minister Burnham’s team has said further UK statements may follow if the situation deteriorates.

Inquiry findings

The inquiry’s latest report, published today, criticises the absence of a coordinated PPE supply chain that left care homes reliant on private suppliers unable to meet demand, and the policy that led to thousands of hospital patients being transferred into care homes without adequate testing. Chair Lady Justice Macur concluded that these decisions directly contributed to an estimated 20,000 excess deaths across England’s care sector.

The report notes that the government’s own scientific advisers had warned of the risks of the discharge policy, yet ministers proceeded, and that the lack of preparedness for PPE procurement had been flagged for years in official briefings.

Political response

Prime Minister Andy Burnham, who served as Foreign Secretary during the first wave, will make a statement to the Commons tomorrow, facing calls from bereaved families for a formal apology and a compensation scheme. His office confirmed that he will set out the government’s response to the inquiry’s recommendations in full.

Compensation and accountability

The inquiry’s findings reignite a long-running debate over whether the government should establish a dedicated compensation pot for care home families who lost relatives. Campaign groups have argued that the scale of the failings amounts to a public health disaster that was foreseeable and preventable.

The Department of Health has indicated that discussions are under way on an enhanced redress scheme, though legal experts note that any new settlement would need to clear parliamentary hurdles before the end of the year.

Why it matters

England’s care homes house over 400,000 residents, many of them elderly and clinically vulnerable. The inquiry’s findings expose how policy decisions made in the space of weeks fundamentally altered the trajectory of the pandemic for an entire generation of older people. As the country grapples with an ageing population, the lessons are not merely historical — they determine how the next health crisis will be managed.

What happens next

Prime Minister Burnham is due to address the Commons tomorrow afternoon, where he is expected to outline the government’s response to the inquiry’s recommendations. Opposition parties have tabled an urgent question for the Health Secretary. Bereaved families’ groups are planning a rally outside Parliament next week, calling for both an apology and a statutory compensation scheme. The inquiry itself continues its hearings through November, with a final report due in the spring.

Counter-terror police action

The Metropolitan Police Counter Terrorism Command confirmed that both individuals are being held on suspicion of assisting a foreign intelligence service, following the earlier incident at the US-operated airbase in Gloucestershire. Under the National Security Act, the maximum penalty for the offence carries a sentence of up to 15 years in prison.

The re-arrests follow an investigation launched after an unidentified person gained unauthorised access to a restricted area of the airbase earlier this month. RAF Fairford, which regularly hosts US Air Force B-52 strategic bombers and C-17 transport aircraft for refuelling missions, sits within a secured perimeter that has come under renewed review.

Political reaction

Prime Minister Andy Burnham has been briefed on the ongoing investigation and is expected to receive a full security assessment from officials at the Home Office and MI5 within days. A spokesperson for Downing Street said the government takes any threat to the integrity of UK military installations seriously, though stopped short of naming the foreign state involved.

Broader intelligence concerns

The case adds to a string of recent national security incidents involving suspected Iranian-linked activity, including a disrupted plot to infiltrate parliamentary networks last year. Parliament’s Intelligence and Security Committee has been due to publish its annual report on foreign interference, and the matter is likely to feature prominently.

Home Secretary Yvette Cooper is set to address the Commons on Thursday, where opposition parties are expected to press for details of the government’s response to the broader threat environment.

Why it matters

RAF Fairford is not only a domestic facility but a symbol of the UK’s integration into NATO’s strategic airlift network. Any compromise of its security reverberates across the alliance, and demonstrates how foreign intelligence services are increasingly willing to operate on allied territory to gather intelligence or stage disruption. For British voters, the case underscores the real-world consequences of national security policy under Prime Minister Burnham’s watch.

What happens next

Both suspects remain in custody and are due to appear before magistrates in Oxford within 48 hours for formal charging decisions. The Crown Prosecution Service will determine whether to pursue charges under the National Security Act, and Parliament’s Intelligence and Security Committee is expected to open a formal review of the incident. The Home Secretary’s statement to the Commons on Thursday will be the first opportunity for elected representatives to question the government’s handling of the case and the wider threat of foreign interference.