This week's roundup is up. Four things a UK board should know from 7–11 September: EU CRA Article 14 went live Friday — 24-hour vulnerability reporting is now law Microsoft's record Patch Tuesday: 973 CVEs, two zero-days already exploited — including one in the Update Stack itself CrowdStrike's Falcon sensor is the privilege escalation path. No patch. Just a workaround Parliament said no to personal director liability in the Cyber Security and Resilience Bill https://peterbassill.com/writing/the-week-in-cyber-7-to-11-september-2026 #cybersecurity #infosec #ukgov #PatchTuesday