Weekly Roundup · Week of 12 to 18 October 2026
The week in business IT & comms
The phone network deadline got a number this week. Openreach said around 1.2 million lines still have to move before the old analogue network is withdrawn on 31 January 2027, and about 350,000 of them are business premises. On the security side, two products that sit on the edge of a business network, Cisco's email gateway and Ivanti's remote access VPN, both had flaws that attackers were using before fixes were widely applied. Microsoft's October Patch Tuesday fixed 1,411 vulnerabilities, a record, and one of its changes can break Wi-Fi and VPN sign-in for firms still relying on an old authentication method. Closer to home, Ofcom's mobile report put West Devon at the bottom of the UK table for connection quality.
- 01The Switch-Off
Openreach: 1.2 million lines still to move off the old phone network, 350,000 of them business premises
ISPreview reported on 15 October that Openreach is warning customers in Northern Ireland, and the rest of the UK, that the analogue phone network is withdrawn on 31 January 2027. About 15 million lines have moved so far. Lines will not simply be cut off on the day, because a temporary Emergency Voice Access service will cover those who have not moved, but it is limited and costs more. Check what is plugged into your phone lines, such as alarms, card machines and lift phones, and ask your provider for a date.
Read the full story - 02Cyber Security
Cisco email gateway zero-day (CVE-2026-76519) is being exploited, with no workaround
The Register reported on 14 October that Cisco and the US government have both issued advisories for a 9.8 rated flaw in Cisco Secure Email Gateway that lets an attacker run commands as root by sending a malicious email. Cisco says it is aware of active exploitation. The only fix is to upgrade AsyncOS. If you run one of these appliances, or your email provider does, ask now whether it has been updated.
Read the full story - 03Cyber Security
Ivanti patches a Connect Secure VPN zero-day that Volexity saw being used in attacks
Ivanti released updates for CVE-2026-104935, an authentication bypass rated 8.6 that lets an unauthenticated attacker run commands on Connect Secure appliances, The Register reported on 14 October. Ivanti says it was already being used against a limited number of customers. A separate privilege escalation flaw in the same attack chain is still waiting for a fix. Update, run Ivanti's Integrity Checker Tool, and check for signs of compromise.
Read the full story - 04Microsoft & Cloud
Microsoft's October Patch Tuesday fixes a record 1,411 vulnerabilities
Infosecurity Magazine reported that the 13 October release includes one zero-day already being exploited, a Windows Shell security feature bypass (CVE-2026-96951), and a 9.8 rated Outlook Reading Pane flaw (CVE-2026-70242). Microsoft puts the record down to its use of AI to find flaws. For a small business the advice does not change: apply the October updates promptly, starting with the PCs that open the most email.
Read the full story - 05Microsoft & Cloud
October's Windows update can block Wi-Fi and VPN sign-in that still uses NTLMv1
The Register reported on 16 October that after the update, Windows blocks NTLMv1 derived credentials used for single sign-on, where it previously only logged a warning. Microsoft says the change is by design. Administrators can set the BlockNtlmSSO registry value to 0 as a temporary exception. If staff report network sign-in failures since the update, this is a likely cause, and it is worth fixing the underlying setup rather than leaving the exception in place.
Read the full story - 06Connectivity & Broadband
Ofcom: no UK council area reaches 90 per cent good mobile connections, and West Devon is lowest at 68
ISPreview reported on 16 October on Ofcom's Mobile Matters 2026 report, based on crowdsourced Opensignal data from August 2025 to July 2026. Across the UK a good connection was available 81 per cent of the time, 75 per cent in rural areas, and none of the four networks met Ofcom's 90 per cent target. EE scored highest at 85 per cent and O2 lowest at 77. If your team relies on mobiles in the South West, check coverage at your own sites and consider Wi-Fi calling or a second network.
- 07Cyber Security
Hobbs, Phase Eight and Whistles owner reports a cyber incident, with systems still offline two days later
The Register reported on 13 October that TFG London, which owns the three fashion brands, found a cyber security incident on 11 October. Stores stayed open but online orders could be delayed. The company has told the Information Commissioner's Office, which says it is assessing the report, and has not said how attackers got in or whether ransomware was involved. It is a reminder to write down, before you need it, what you would run on if your systems were offline for several days.
- 08Compliance & Data
Government says AI safeguards may be added to the Cyber Security and Resilience Bill
AI minister Kanishka Narayan said on 12 October that changes to the Bill are planned to address AI powered threats, including mandatory reporting of serious incidents and near misses, Infosecurity Magazine reported. The Register reported on 15 October that officials told MPs the amendments are still under consideration. Which organisations would be covered is not yet clear, so there is nothing to act on yet beyond keeping a note of how you would record an incident.
- 09Compliance & Data
Legal Aid Agency breach reached back further than first reported: records from 1978
The Register reported on 15 October that a government update says about 250,000 stolen records predate 2007, the earliest date given before, and the oldest dates from 1978. The data may include names, addresses, dates of birth and National Insurance numbers. The government says the figure is not a count of affected people and that there is no sign the data has been published. The lesson for any business is how long old records sit on old systems: know what you hold and delete what you no longer need.
What we’re watching
The Competition and Markets Authority's report on BT's purchase of TalkTalk and PXC is due to the Culture Secretary by 5pm on 19 October, and she then decides whether the deal goes to a full Phase 2 investigation. Ivanti says a fix for the remaining privilege escalation flaw in its Connect Secure attack chain will follow in the coming weeks. The government says a National Cyber Action Plan will be published soon, and amendments to the Cyber Security and Resilience Bill are expected. And the analogue phone network closes on 31 January 2027, so any business line you have not yet moved should have a date this month.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.