Ethical Hacking News
A recent security breach in the UK government has exposed over 100 serious vulnerabilities in publicly available code, putting sensitive data at risk. The researcher, Chris Nesbitt-Smith, used consumer-grade models to identify the flaws, and many of the issues could have been caught by a routine IT health check. This alarming discovery highlights the need for improved cybersecurity measures in the public sector.
The UK government has been criticized for its lack of attention to cybersecurity following a recent discovery of over 100 serious vulnerabilities in publicly available code. The government's decision to publish code openly has left departments vulnerable to cyber attacks due to neglect of maintenance and improvement of technology. A recent vulnerability in the Planning Inspectorate's code exposed sensitive libraries and private employee accounts, putting evidence at risk. The vulnerability was compounded by the agency's accidental publication of credentials, making it particularly dangerous. The issue highlights the need for improved cybersecurity measures in the public sector and regular IT health checks. Departments must prioritize their cybersecurity and take immediate action to address vulnerabilities to prevent similar breaches in the future.
The UK government has been criticized for its lack of attention to cybersecurity, following a recent discovery of over 100 serious vulnerabilities in publicly available code. The researcher, Chris Nesbitt-Smith, used consumer-grade models to identify the flaws, which were found in codebases across multiple departments, including the Department of Health and Social Care, the Home Office, and local authorities.
The UK government's decision to openly publish code it produces with public money has been touted as a transparent and cost-efficient measure. However, this approach has been criticized for leaving departments vulnerable to cyber attacks. Funding squeezes have led to departments neglecting maintenance and improvement of their technology estate, leaving them exposed to security risks.
One of the most serious cases identified by Nesbitt-Smith was the Planning Inspectorate, which handles land-use matters across England. The agency's failure to fully remove a login after it accidentally committed it to public repository GitHub exposed the complete Microsoft Entra ID, which would have given "god-tier" read and write access to all SharePoint sites and private employee OneDrive accounts. This would have granted access to sensitive libraries that safeguard evidence under legal hold for statutory planning inquiries and appeals.
The Planning Inspectorate's vulnerability was compounded by the agency's accidental publication of the credentials, which made it particularly dangerous for them. The researcher noted that the option for ransomwaring, encrypting all the data, or just stealing all the data was abundantly available.
A spokesperson for the Planning Inspectorate told WIRED that its cyber monitoring tools immediately detected Nesbitt-Smith's activity in August and that the agency had already been handling this as a cyber incident when ControlPlane made contact. The agency identified and fixed the vulnerability within 20 minutes of the report and verified that no data breach occurred.
The Planning Inspectorate's issue is not an open-source security issue, but rather a failure to follow good process, according to Amanda Brock, chief executive officer of nonprofit industry group OpenUK. "That data was exposed because of a failure not to follow good process," she adds. "That's not an open-source security issue."
Nesbitt-Smith's discovery highlights the need for improved cybersecurity measures in the public sector. Recently, there have been arguments for public sector departments to stop publishing source code in the open, now that AI has accelerated vulnerability discovery. The NHS reportedly ordered technology teams to transition away from open source code in May amid security concerns about the impact of AI models.
However, Nesbitt-Smith argues that doing so without immediately fixing the underlying issues would be the "worst case scenario." "Unless you're going to go and fix all of the problems, if anything, you're probably drawing more attention to it by closing it," he says. "Because you're like, 'Here be dragons over this space. Don't look here though, please.'"
Nesbitt-Smith's findings emphasize the importance of regular IT health checks and the need for improved cybersecurity measures in the public sector. The researcher's discovery serves as a wake-up call for departments to prioritize their cybersecurity and take immediate action to address the vulnerabilities he identified.
In conclusion, the recent security breach in the UK government highlights the need for improved cybersecurity measures in the public sector. The researcher's discovery emphasizes the importance of regular IT health checks and the need for departments to prioritize their cybersecurity. It is essential for the public sector to take proactive measures to address the vulnerabilities identified and to prevent similar breaches in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Weak-Links-A-Deep-Dive-into-the-UK-Governments-Cybersecurity-Vulnerabilities-ehn.shtml
https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/
Published: Tue Nov 10 02:27:50 2026 by llama3.2 3B Q4_K_M
