Weekly Roundup · Week of 5 to 11 October 2026
The week in business IT & comms
Three stories this week share the same lesson: old kit and old habits are getting harder to keep. Openreach named another 112 exchanges where copper lines will stop being sold, and its own migrations director reminded everyone the analogue phone network closes in under four months. In the US, the FBI and Secret Service warned that the FortiBleed campaign has now compromised more than 86,000 Fortinet firewalls worldwide and that some victims are being locked out of their own devices. And Microsoft set two dates in 2027 after which Windows PCs without newer certificates stop getting updates at all. Underneath that, the UK's fraud reporting service put a number on hijacked email and social media accounts and asked people to switch to passkeys, and ASOS showed how far one convincing impersonation can get an attacker.
- 01The Switch-Off
Openreach names 112 more exchanges for Stop Sell, covering 619,724 premises
Openreach published tranche 26 of its full fibre Stop Sell programme on 8 October. ISPreview reports it takes the total number of notified Stop Sell exchanges, including trial sites, to 2,325 and the premises covered to around 16.4 million. Stop Sell in these areas takes effect on about 4 November 2027, after which copper phone and broadband products cannot be sold to premises that can get full fibre.
Read the full story - 02Cyber Security
FBI warns FortiBleed attackers are locking organisations out of their Fortinet firewalls
A joint advisory from the FBI and US Secret Service, published on 6 October, says the FortiBleed campaign targets internet facing FortiGate firewalls and SSL VPN gateways, citing SOCRadar's count of more than 86,644 compromised devices across 194 countries. Attackers create their own admin accounts and, in some cases, delete or change the original ones, which can leave the owner locked out. The advisory also says FortiBleed has been used as a way in for ransomware affiliates.
Read the full story - 03Microsoft & Cloud
Windows PCs without new certificates will lose Windows Update in May and June 2027
Microsoft said on 8 October that the certificates used to connect to Windows Update expire on 17 May 2027 and 19 June 2027. Devices on supported versions that are up to date with monthly updates need no action, but devices on other Windows versions are told to upgrade, and devices without the replacement certificates will lose access to Windows Update after the relevant date.
Read the full story - 04Connectivity & Broadband
Rivals ask the government to keep TalkTalk's consumer business away from BT
A week after BT agreed to buy TalkTalk and PXC out of administration, ISPreview reported that Opus Broadband had published an open letter to the Culture Secretary, Lisa Nandy, arguing that the Competition and Markets Authority should require TalkTalk's consumer business to be sold to an independent owner. Opus says it had made a publicly reported offer of about £100m for that business. ISPreview says the letter partly echoes an approach taken by Virgin Media O2's chief executive, Lutz Schüler, earlier in the week.
- 05Cyber Security
Report Fraud urges passkeys as losses from hacked email and social accounts reach £6.3m
The UK's Report Fraud service launched a campaign urging people to switch to passkeys, Infosecurity Magazine reported on 6 October. It said cybercrime linked to email and social media hacking took £6.3m from victims in 2025/26, up from £1.2m the year before, with reports of this kind of account takeover up 34 per cent. Jonathon Ellison of the National Cyber Security Centre said passkeys are "simpler, faster and more secure to use".
- 06Cyber Security
ASOS says an attacker got in by impersonating a trusted contact
ASOS told customers on 8 October that an attacker had accessed personal and customer account data, Infosecurity Magazine reported. ASOS said the attacker gained access to an employee account "by impersonating a trusted contact to obtain log in credentials" and used them to reach third party platforms ASOS uses to communicate with customers, which is how a rogue push notification reached customers. ASOS said payment information was not compromised.
- 07Microsoft & Cloud
Outlook will block .msix and .msixbundle attachments from November
Microsoft is adding the two Windows app package file types to the attachment block list in New Outlook for Windows and Outlook on the web, The Register reported on 6 October. Users will no longer be able to download or open them by default. The rollout is scheduled for early to mid November 2026, and administrators who need these files can add them to the AllowedFileTypes setting of the relevant mailbox policy before then.
What we’re watching
13 October is the last update day for Windows 11 version 24H2 on Home and Pro editions, and the day Windows Server 2022 moves from mainstream to extended support, which still includes security updates. The Competition and Markets Authority has been asked to report on BT's purchase of TalkTalk by 19 October, and rival providers are pressing for the consumer business to be sold on. Outlook's block on .msix attachments arrives in early to mid November, and Windows 11 version 23H2 Enterprise and Education editions get their last update on 10 November. If you run a Fortinet firewall with remote access, the FBI's FortiBleed checklist is worth working through this week rather than next.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.