Cobalt Briefing

Updated 26 October 2026

Business IT & comms, decoded daily

The news that actually affects how you run a business in the South West — the phone switch-off, cyber threats, Microsoft 365, connectivity and AI. No jargon, no scaremongering, just the useful version with a clear “so what.”

Lead storyCyber Security

PHP2Shell: two critical flaws in the software behind most websites, and what to ask your web host

PHP fixed two flaws on 21 October that can let an attacker run code on a web server without logging in. The NCSC says to patch now, and governments took sites offline while they did.

26 October 20264 min read

Read

Latest on the wire

Weekly Roundup · Week of 19 to 25 October 2026

The week in business IT & comms

This week: two critical PHP flaws take websites offline, a breach at an IT management vendor reaches Microsoft 365 tenants, and the ICO reprimands an IT provider over a 12 year old test account.

Read the roundup

Weekly Roundup

Earlier weekly roundups

Week of 12 to 18 October 2026Weekly Roundup, 19 October 2026

Week of 5 to 11 October 2026Weekly Roundup, 12 October 2026

Week of 28 September to 4 October 2026Weekly Roundup, 5 October 2026

Week of 21 to 27 September 2026Weekly Roundup, 28 September 2026

Week of 14 to 20 September 2026Weekly Roundup, 21 September 2026

Week of 7 to 13 September 2026Weekly Roundup, 14 September 2026

Week of 31 August to 6 September 2026Weekly Roundup, 7 September 2026

Week of 24 to 30 August 2026Weekly Roundup, 31 August 2026

Week of 17 to 23 August 2026Weekly Roundup, 24 August 2026

Week of 10 to 16 August 2026Weekly Roundup, 17 August 2026

Week of 27 July to 2 August 2026Weekly Roundup, 3 August 2026

Week of 14–20 July 2026Weekly Roundup, 20 July 2026

Week of 13–19 July 2026Weekly Roundup, 19 July 2026

Week of 9–15 July 2026Weekly Roundup, 15 July 2026

Week of 3–9 July 2026Weekly Roundup, 9 July 2026

Week of 22–28 June 2026Weekly Roundup, 28 June 2026

Week of 15–21 June 2026Weekly Roundup, 21 June 2026

The newsroom

Browse every story by topic

Filter the newsroom to what matters to you — the switch-off, your security, your connection, Microsoft 365 or AI.

Business IT & comms, decoded daily

PHP2Shell: two critical flaws in the software behind most websites, and what to ask your web host

The week in business IT & comms

Earlier weekly roundups

Browse every story by topic

PHP2Shell: two critical flaws in the software behind most websites, and what to ask your web host

A breach at an IT management vendor reached Microsoft 365 tenants. What to ask your IT provider

Password1 and a 12 year old test account: the ICO reprimands an IT provider and its client

350,000 business premises still need to leave the old phone network. What happens on 31 January?

Two more edge device zero-days: Cisco's email gateway and Ivanti's VPN are both under attack

A record Patch Tuesday, and an October Windows update that can break Wi-Fi and VPN sign-in

112 more exchanges join Openreach's Stop Sell. Is your digital phone ready for a power cut?

FortiBleed: the FBI says attackers are locking firms out of their own Fortinet firewalls

Older Windows PCs will be cut off from Windows Update in 2027. Here is the check to run now.

BT has agreed to buy TalkTalk and PXC out of administration. Here is what it means for business lines.

Microsoft says attackers are getting the benefit of AI first. The ways in are still the old ones.

Openreach kept its free migration offers open to 31 January. Copper line rental rises again on 1 October.

Windows 11 24H2 stops getting updates for Home and Pro on 13 October. Microsoft shipped 26H2 this week.

More than half of UK businesses are not confident doing at least one cyber security basic

Microsoft paused an Office update after it deactivated, and in some cases removed, Office 2016 and 2019

Openreach confirmed the safety net for lines that miss 31 January. It now carries broadband, and it costs more than moving.

Police arrested two men over a phishing service that skipped MFA on 12,000 Microsoft 365 inboxes

Openreach counted the copper lines left in ten cities. Bristol still has 43,775 to move.

Cyber Essentials just had its best year. It still reaches a sliver of British business.

Microsoft's record patch took Remote Desktop down with it. The fixes landed on 14 September.

Microsoft shipped 974 security fixes at once. Two were already being used against people.

Seven in ten UK staff are using AI tools their employer never approved

Ofcom has lowered the bar for taking the price cap off copper lines

Microsoft starts blocking mail from out-of-date Exchange servers this week

A phishing kit that walks victims through their own MFA prompt survived the takedown

Your IT provider will get 24 hours to report a breach, and a duty to tell you about it

Free Wi-Fi sign-ups are customer data, as three UK airports found out this week

A fake voicemail campaign got past Microsoft's spam scoring three times out of four

New rules for running fibre into buildings start on 1 September, and some installs have already slipped

Consumers get a fallback when the old phone network switches off. Business lines do not.

The newest phishing pages screen out personal email addresses. They only want the work login.

The NCSC has written down what to check before you let an AI agent near your systems

The ICO has just written up what happens when nobody owns the patching

Your connectivity supplier and your IT supplier are becoming the same company

One exposed key at a software supplier put its entire customer database in the wrong hands

Small firms are quietly going backwards on the cyber basics

Microsoft 365 business prices rose on 1 July, and the CMA is now looking at Copilot

Stop Sell hits all 1,572 Openreach exchanges on 20 August. Here is what it blocks.

US authorities have ordered a rush patch on a Fortinet security product. The lesson is one every business already knows.

The broadband regulator is investigating five fibre providers over their finances. Worth knowing who you are signing with.

Stolen logins have overtaken software flaws as the top way into a ransomware attack. Turn on MFA.

A new cyber law will regulate IT providers for the first time. If you outsource your IT, this is about you too.

Microsoft just shipped its biggest ever batch of security fixes, and two are already being used in attacks.

The government has added cyber attacks and major IT outages to its national risk register. The lesson scales down to small firms.

The UK has warned that Russian hackers are hunting for routers with weak passwords. The fix is basic hygiene.

Windows is turning off an old security setting this month. If a login or a background job breaks, this is why.

A flaw in a common website builder is under active attack. If your site runs Joomla, update it now.

Phone and text scams now drive more than a quarter of UK fraud losses. The fix is a habit, not a gadget.

Ofcom just fined Virgin Media £28m for making it hard to leave. Know your own switching rights.

A ransomware attack was just run start to finish by an AI. The lesson is an old one.

Another Citrix remote-access flaw is out. Patching your gateway can't wait.

A SharePoint server flaw is under active attack. If you run it on your own kit, patch now.

The Microsoft 365 Copilot app is installing itself on business PCs. You can turn that off.

Copper line prices rose again on 1 July. Staying put now has a real cost.

The Jaguar Land Rover hack was Russian. The lesson still lands on smaller firms.

Microsoft 365 prices rise on 1 July — what's going up and what isn't

The switch-off won't be a 'big bang' — but the deadline still stands

612,000 UK businesses were breached last year — most attacks start the same way

Ofcom is reviewing the price of full fibre and leased lines — change is due in October

Most UK firms now use AI — the gap is between using it and getting value from it

New UK data rules are now live — every business needs a complaints process

The phone switch-off enters its final stretch — and staying put now costs more

Cyber Essentials just got harder to pass — here's what changed

Microsoft 365 prices change on 1 July — what to check before they do

AI voice scams are aimed at your finance team — one rule stops the costly ones

Full fibre now reaches most of the UK — and copper is being wound down

AI crossed the halfway line in UK business — where a smaller firm should start

Guides & answers

Want this without the reading?