Weekly Roundup · Week of 19 to 25 October 2026
The week in business IT & comms
Much of this week was about the software and suppliers that sit behind a business rather than in front of it. Two critical flaws in PHP, the language behind WordPress and a large share of the web, led the NCSC to tell organisations to patch at once or consider taking systems offline, and 32 government services were pulled while fixes went in. ConnectWise, which sells cloud backup and management tools to IT providers, suspended services after attackers got hold of application credentials, and Microsoft says a China linked group then went after more than 2,250 Microsoft 365 tenants. The ICO reprimanded an IT provider and its client after a test account protected by Password1 let ransomware in. And a power event in Google Cloud's London region knocked out services for banks, retailers and delivery firms for several hours.
- 01Cyber Security
PHP2Shell: NCSC tells organisations to patch two critical PHP flaws at once, or consider taking systems offline
PHP released fixed versions on 21 October for CVE-2026-109618 and CVE-2026-109619, which can allow an attacker who has not logged in to run code on a web server. The NCSC says organisations using any version of PHP are affected. The Register reported that 32 UK government services were made unavailable and four partly unavailable, largely as a precaution. If your website runs on WordPress or another PHP system, ask your web host or developer whether it has been updated.
Read the full story - 02Microsoft & Cloud
ConnectWise suspends cloud backup services after a breach, and Microsoft says 2,250 Microsoft 365 tenants were targeted
ConnectWise suspended Cloud Backup, formerly SkyKick, and two linked services after finding unauthorised access to application identities on 15 October, The Register reported. Microsoft later said a China linked group it tracks as Storm-0940 used compromised ConnectWise application credentials to try to get into more than 2,250 Microsoft 365 tenants. If an IT provider manages your Microsoft 365, ask whether these tools are in use and whether your tenant has been checked.
Read the full story - 03Compliance & Data
ICO reprimands an IT provider and its client after a Password1 test account let ransomware in
The ICO said on 20 October that a test account created in 2012 and protected by Password1 was used in a ransomware attack on Data Cymru in November 2024, and that information about 3,300 people, most of them children, was taken. Both Ogi Networks, which provided the IT services, and Data Cymru were reprimanded. The ICO's message is that responsibility for security has to be clear when IT is outsourced.
Read the full story - 04Microsoft & Cloud
A power event in Google Cloud's London region disrupts banks, retailers and delivery firms
The Register reported that problems began at 06:08 UTC on 20 October in europe-west2-b, one of three availability zones in Google Cloud's London region, and that Google blamed a power event. Customers the report says were affected include Lloyds Bank, HSBC, Royal Mail, DPD, BT and Screwfix. Google's status page said service had resumed for most customers by 14:03 UTC. It is a reminder to know which of your everyday systems depend on a single cloud region, and what you would do for a working day without them.
- 05Microsoft & Cloud
Microsoft says October's Windows update did not fix the Always On VPN bug after all
BleepingComputer reported on 21 October that Microsoft had wrongly marked an Always On VPN connection problem as fixed in the October Windows 11 updates. The bug affects Windows 11 24H2 and later after the September updates, where connections using automatic protocol selection can get stuck on Connecting. Microsoft's workaround is to set the VPN profile to a single protocol, SSTP or IKEv2, and it says a fix is planned in the coming weeks. This is a separate problem from the NTLM sign in change we covered last week.
- 06Telephony & VoIP
Ofcom fines Tismi £437,500 for failing to stop scammers misusing its phone numbers
ISPreview reported on 21 October that Ofcom found Tismi had no appropriate measures in place to prevent misuse of numbers allocated to it between November 2022 and January 2025, exposing about 366,000 sub-allocated numbers to potential misuse. The fine includes a 30 per cent discount because Tismi admitted liability and settled. Ofcom's director of enforcement, George Lusty, said any company that puts customers at the mercy of scammers will face the consequences. If you buy numbers or calling services, ask your provider what checks it carries out.
- 07AI for Business
FCA says firms' incident reporting must cover significant AI failures and near misses
The Register reported on 20 October that Jessica Rusu, the Financial Conduct Authority's chief data, information and intelligence officer, said the regulator's existing incident reporting rules must extend to significant AI failures and near misses. The FCA's rules cover the firms it regulates, but any business using AI tools in its work can take the same step now: keep a simple note of when an AI tool gets something important wrong, and what you did about it.
What we’re watching
The PHP Foundation says a third PHP flaw, CVE-2026-115560, will be fixed in the next regular PHP release, and in the meantime recommends setting session.upload_progress.enabled to 0. Microsoft says a permanent fix for the Always On VPN problem is planned in an update in the coming weeks. The Register reported that the Cyber Security and Resilience Bill returns to the House of Lords on Monday 26 October. And Google has said it will publish an analysis of the London outage once its internal investigation is complete.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.