Weekly Roundup · Week of 26 October to 1 November 2026
The week in business IT & comms
The phone network deadline came back into sharp focus this week. Openreach says fewer than 100 days remain before the old analogue network is retired on 31 January 2027, with about a million lines still on it, 300,000 of them in business premises, and it warns that card machines, alarms, lifts and door entry systems are among the hardest to move. The UK domain registrar 123 Reg told customers that an AI driven attack in September exposed names, phone numbers, VAT numbers and details of the products on their accounts. Research from Arctic Wolf shows attackers posing as IT support in Microsoft Teams chats and getting from first message to running their payload in under 15 minutes. And the US cyber agency CISA confirmed that the PHP2Shell flaws we covered last week are now being exploited.
- 01The Switch-Off
Openreach: fewer than 100 days left to move off the old phone network, with 300,000 business lines still to go
Openreach said on 30 October that about one million copper based lines are still active, including 300,000 in business premises, ahead of the PSTN being retired on 31 January 2027. It warns that the lines left are the most complex to move, including payment terminals, lift phones, fire alarm panels, door entry and gate systems. If you are not sure what still runs over your phone lines, now is the time to find out.
Read the full story - 02Cyber Security
123 Reg says an AI driven cyberattack exposed customer contact and account data
The Register reported on 28 October that 123 Reg, the GoDaddy owned UK domain registrar, has told customers that an intrusion on 18 September exposed names, phone numbers, company VAT numbers and the products on their accounts. 123 Reg is advising customers to treat messages that appear to come from it with caution and to turn on two step verification.
Read the full story - 03Microsoft & Cloud
Fake IT support in Microsoft Teams chats: from first message to running code in under 15 minutes
Arctic Wolf says it has seen more than 400 incidents in which attackers used Teams external chat to pose as IT support, often after flooding the victim's inbox with sign up emails, Infosecurity Magazine reported on 27 October. Teams external access is on by default, and Arctic Wolf recommends limiting it to the partner domains you actually work with.
Read the full story - 04Cyber Security
PHP2Shell update: CISA confirms both flaws are now being exploited
A new development on a story we covered last week. The Register reported on 27 October that CISA has added CVE-2026-109618 and CVE-2026-109619 to its list of known exploited vulnerabilities, and that Delft University's Threat Intelligence Lab has tracked more than 50,000 exploitation requests from over 600 IP addresses in 70 countries. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your website runs on PHP and nobody has confirmed it is updated, ask your web host today.
- 05Cyber Security
UK online shop warns customers after malicious software is found on its website
Shelly Store UK, an independent reseller of smart home equipment, told customers that after a warning from its payment provider, Stripe, it found unauthorised software on its website and server, The Register reported on 30 October. It says payment card details, names, billing addresses and contact details may have been affected, and it has reported the incident to the ICO. If you take card payments on your own website, it is worth asking whoever runs it how it would spot code like this.
- 06Compliance & Data
A website supplier to GP practices goes into administration, and NHS England tells practices to plan around it
The Register reported on 30 October that Silicon Practice Digital Health Solutions, owned by Schappit Ltd, has gone into administration, and that some GP websites have gone offline. NHS England's CTO, Kevin Humphries, wrote to practices setting out priorities including preserving historical patient information and finding other ways for patients to get in touch, and said practices should consider whether they need to tell the ICO. For any business, it is a prompt to ask what you would do if a key online supplier stopped trading tomorrow.
- 07AI for Business
Government puts £130 million into AI powered cyber defence
The Register reported on 26 October that the UK government is spending £130 million on AI powered cyber defences, including £60 million for a National Cyber Shield with a £25 million challenge fund for UK cyber security firms, and £70 million for a new National Exposure and Real-Time Vulnerability Centre. It is part of a wider package of more than £600 million announced by the Treasury, which also includes £30 million for local AI partnerships.
What we’re watching
Openreach says further price rises for legacy lines are in the pipeline from February 2027, on top of the rises that took effect on 1 October 2026. 123 Reg customers should expect phishing that uses their real details; the company says it will never ask for passwords, payment details or verification codes by email, text or phone. Microsoft says it has fixed the Always On VPN problem we covered last week in the KB5127936 preview update, BleepingComputer reported on 30 October, and the single protocol workaround remains for anyone who would rather wait. And The Register notes it is still unclear when the government's new AI cyber defences will be deployed.
#WEARECOBALT
Got a question this raises?
If anything here makes you wonder where your business stands, ask us. We'll give you a straight answer for your setup, with no obligation.