A security researcher has found more than 100 serious vulnerabilities in publicly available UK government code, putting sensitive data at risk as a result of poor cyber hygiene.
\n\nThe UK government has defaulted to openly publishing code it produces with public money for around a decade because it’s transparent, and making it easier for code to be reused is cost-efficient. This includes within the Department of Health and Social Care, and the Home Office, as well as local authorities.
\n\nBut funding squeezes have left departments neglecting maintenance and improvement of their technology estate. While ControlPlane security researcher Chris Nesbitt-Smith found the vulnerabilities using Claude’s Opus and Sonnet AI models, he says that he used consumer-grade models on a laptop and that many of the issues could have been caught by a routine IT health check. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” he tells WIRED. “It’s all daft stuff.”
\n\nIn the most serious case he identified, the Planning Inspectorate, which handles land-use matters across England, had failed to fully remove a login after it accidentally committed them to public repository GitHub. The fact the credentials gave such wide…
Original source: https://www.wired.com/