Loading story…
The UK government is moving to update the Computer Misuse Act (CMA), originally enacted in 1990, to better protect ethical hacking and legitimate cybersecurity research. The lack of exemptions for researchers in the original law has long been a concern, and recent recognition of the growing scale of cybercrime and the need for robust research has prompted calls for reform. The changes aim to ensure that cybersecurity professionals can conduct research without fear of prosecution, reflecting the evolving threat landscape and the importance of proactive defense.
In parallel, the UK's National Cyber Security Centre (NCSC) has highlighted the value and risks of cyber deception technologies such as honeypots and decoy accounts. Findings from the NCSC's Active Cyber Defense 2.0 program indicate that, when properly implemented, these tools can provide valuable threat intelligence and disrupt attacker confidence. However, the NCSC warns that poor implementation can generate noise, create vulnerabilities, or foster a false sense of security, emphasizing the need for clear strategy and ongoing management. The NCSC is working to help organizations invest in and deploy these technologies effectively as part of a modern defense strategy.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
The UK government is considering reforms to the Computer Misuse Act to give ethical hackers more freedom to test live infrastructure. The move reflects recognition of the need for more cybersecurity professionals and support for legitimate security research.
Polish police detained three Ukrainian nationals suspected of operating as traveling hackers. Authorities said they were equipped with penetration-testing tools and encrypted storage devices.
Police in Spain arrested a 19-year-old suspected of stealing and selling 64 million personal records. The arrest was reported as part of a roundup of notable security developments.
Ox Security revealed a security issue affecting Cursor and AWS Bedrock in which unprivileged users could change spending limits and expose API tokens. The flaw could have enabled major financial losses and credential leakage.
CISA released its 2025 list of the top 25 most dangerous software weaknesses and said cross-site scripting ranked first for the second consecutive year. The agency urged organizations to prioritize remediation of these weaknesses.
The UK introduced the Computer Misuse Act, criminalizing unauthorized access to and alteration of computer data. The law did not explicitly accommodate legitimate cybersecurity research or ethical hacking.
Four British hackers accessed the Prestel system, highlighting that the UK lacked adequate computer crime legislation. The incident later helped drive creation of the Computer Misuse Act.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government is actively considering amendments to the Computer Misuse Act, a law originally enacted in 1990 to criminalize unauthorized access to computer systems. Security Minister Dan Jarvis announced that the government is exploring the introduction of a "statutory defense" for security researchers, aiming to ensure that individuals engaged in responsible vulnerability discovery and bug bounty programs are not penalized under the current legal framework. This move is in response to longstanding concerns from the cybersecurity community that the existing law inadvertently stifles legitimate research and weakens the resilience of UK digital infrastructure. The proposed changes would allow security researchers to "spot and share vulnerabilities" without fear of prosecution, provided their actions are responsible and in good faith. The government acknowledges the critical role these researchers play in identifying and mitigating unknown vulnerabilities, and the potential legal reform is seen as a step toward fostering a more collaborative and secure cybersecurity environment in the UK. The initiative has been welcomed by industry experts who have advocated for clearer legal protections to support the growth and effectiveness of the British cybersecurity sector.
Jun 29, 2026
The UK government has announced plans to reform its outdated Computer Misuse Act to provide statutory defenses for ethical hackers and security researchers, aiming to protect them from prosecution when responsibly disclosing vulnerabilities. British security minister Dan Jarvis emphasized the need for these changes, acknowledging that the current law constrains legitimate research and that updated legislation would help strengthen the country's cyber resilience. The proposed reforms would allow researchers to spot and share vulnerabilities under certain safeguards, aligning the UK with similar protections already enacted in countries like the Netherlands, France, and Belgium. Meanwhile, Portugal has passed new legislation granting protections to security researchers, provided they do not seek financial gain or breach data protection laws. This move has been welcomed by the security community and increases pressure on the UK to modernize its own laws. The Portuguese law is described as "tightly scoped," requiring that security actions be strictly proportionate, and is seen as a positive step toward creating a safer environment for responsible vulnerability disclosure across Europe.
Jun 29, 2026
The UK government advanced its **Cyber Security and Resilience Bill** after publishing policy materials in 2024 and formally introducing the legislation to Parliament in November 2025, later adding an impact assessment, factsheets, supporting research, and notice that the Regulatory Policy Committee rated the assessment **fit for purpose**. The bill is part of a broader push to strengthen cyber resilience obligations as the government also signaled tougher online safety enforcement and wider expectations that critical services and digital platforms improve security governance. Government survey data published in 2026 showed why the pressure is increasing: **43% of UK businesses** and **28% of charities** reported a cyber breach or attack in the previous year, with **phishing** remaining the most common and disruptive threat. While ransomware among businesses fell to **1%**, the survey found repeat victimisation drove an estimated **5.19 million** cyber crimes against UK businesses, and more advanced controls such as **two-factor authentication**, formal incident response plans, VPN use, and supplier risk reviews remained uneven, especially among smaller organisations. Industry reporting said the findings are sharpening focus on resilience measures including **Cyber Essentials Plus**, phishing-resistant MFA, network segmentation, tested backups, dependency mapping, and board-level reporting on recovery and operational survivability.
Sep 2, 2026