Weekly Roundup · Week of 28 September to 4 October 2026
The week in business IT & comms
The story of the week ran right up to Monday morning. TalkTalk spent the week trying to sell its consumer business and its wholesale arm PXC before a large bill to Openreach fell due, and on 5 October BT agreed to buy both out of administration, with the government stepping in on public interest grounds. Underneath that, two reports put numbers on the same problem from opposite ends. The government's annual skills study found 57 per cent of UK businesses are not confident doing at least one basic cyber security task, and Microsoft's yearly threat report says attackers are getting the benefit of AI faster than defenders. Fortinet, meanwhile, had a mail security flaw under attack before it had fixes for most versions.
- 01Connectivity & Broadband
BT agrees to buy TalkTalk and its wholesale arm PXC out of administration
ISPreview reported on 1 October that the lead bidder for PXC had asked Openreach to waive over £100m of payments, and that BT had opened talks with the government about a takeover. On 5 October BT agreed to acquire both TalkTalk's consumer business and PXC, which between them serve around 2.5 million customers, 1 million of them wholesale. The Culture Secretary issued a Public Interest Intervention Notice the same day and asked the Competition and Markets Authority to report by 19 October. The government says TalkTalk customers do not need to take any action.
Read the full story - 02Cyber Security
57 per cent of UK businesses are not confident in at least one cyber security basic
The government's Cyber security skills in the UK labour market 2026 report, published on 29 September, puts the figure at about 808,000 businesses, up from 49 per cent last year. Detecting and removing malware is the widest gap, at 38 per cent of businesses. The report says the rise may reflect greater awareness of security rather than a fall in ability, and that almost half of those responsible for cyber security in businesses lacked the confidence to deal with a breach and had not outsourced it.
Read the full story - 03AI for Business
Microsoft's Digital Defense Report: phishing behind 23 per cent of intrusions, up from 7
Microsoft published its 2026 Digital Defense Report on 1 October, covering July 2025 to June 2026. It says the gap between a vulnerability being found in the wild and being weaponised can be well below 24 hours, projects a record 72,000 published vulnerabilities this year, and says attackers are currently getting the advantages of AI first. Phishing accounted for 23 per cent of observed intrusions, up from 7 per cent in 2025.
Read the full story - 04Cyber Security
Fortinet warns a FortiMail flaw is being exploited, with fixes still to come for most versions
Fortinet disclosed CVE-2026-104286, rated 9.8, in its FortiMail email security appliance on 1 October and says it is being exploited in the wild. It lets an attacker who has not logged in write files to the system through the web interface. BleepingComputer reported that FortiMail 7.2 users can fix it by moving to 7.4 or later, while fixed releases 7.4.9, 7.6.7 and 8.0.2 are listed as upcoming. Until then Fortinet's workarounds are to disable Identity Based Encryption if it is not needed, or to keep the management interface off the internet, and it has published signs of compromise to check for.
- 05Microsoft & Cloud
Windows 11 26H2 is out, and 24H2 Home and Pro stop getting updates on 13 October
Microsoft released Windows 11 version 26H2 on 29 September, and its release information lists 13 October as the end of updates for version 24H2 on Home and Pro editions. The Register reported on 1 October that 26H2 also turns on Windows backup and restore by default on Entra joined and hybrid joined devices, backing up settings and a list of installed Store apps to the cloud unless an administrator has opted out. It does not back up files.
Read the full story - 06Microsoft & Cloud
Microsoft deleted some nonprofits' Microsoft 365 data before their retention period ended
The Register reported on 28 September that, after Microsoft retired its free Business Premium grant for nonprofits, an error deleted remaining data from expired subscriptions before the retention and export window closed. Microsoft confirmed the deletion to The Register, said the data cannot be recovered, and said it cannot provide a list of what was deleted or whether anything was. It is offering affected organisations help setting up a new environment.
What we’re watching
The Competition and Markets Authority has been asked to report on BT's purchase of TalkTalk by 19 October, and BT expects TalkTalk to operate separately and keep competing while the review runs. 13 October is October's Patch Tuesday and the last update day for Windows 11 24H2 on Home and Pro. If you run FortiMail, watch for Fortinet's 7.4.9, 7.6.7 and 8.0.2 releases. The data protection regulator also changed shape on 30 September: the Information Commission replaced the Information Commissioner, still known as the ICO, now run by a board and based in Manchester, with a new corporate strategy promised that names AI and cyber resilience among its areas of focus. And the nonprofit deletion story is a reminder worth acting on: Microsoft 365 keeps your data on Microsoft's terms, so it is worth knowing where your own copy is.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.