The threat landing on your doorstep this week Five separate sets of actively exploited vulnerabilities were confirmed between 26 and 30 October 2026, and several of them point directly at the kind of software a typical small business website runs. PHP, WordPress plugins, Magento, Drupal Commerce and GitLab all appeared on CISA's Known Exploited Vulnerabilities catalogue within the same week. That catalogue only lists vulnerabilities with confirmed, real-world exploitation. When something lands on it, the debate about whether to patch is already over. AI Is Now Running the Cyberattack: What This Week's PHP2Shell Breach Means for UK Small Business: https://go.sbcsg.uk/au5me?p=skool PHP Under Active Attack and 953 Online Shops Compromised: What UK Small Businesses Need to Know Now: https://go.sbcsg.uk/jcgtu?p=skool WordPress Under Active Attack and a Linux Kernel Flaw That Lets Attackers Plant Webshells: What UK Small Businesses Need to Know Today: https://go.sbcsg.uk/bm49j?p=skool Firewall Down, CI/CD Cracked: The Two Vulnerabilities UK Small Businesses Need to Patch Right Now: https://go.sbcsg.uk/cp5bd?p=skool Threat Analysis: GitLab RCE and Drupal Commerce Under Active Exploit, Plus the Supply Chain Risks Your Dev Team Is Missing: https://go.sbcsg.uk/tnw85?p=skool What this means for your online shop or website Two stories stand out for any business with a customer-facing website. 953 Magento stores were found harvesting card data, in a campaign running since July 2025. The skimming code hides in CMS content blocks and is designed to disappear when a security scanner visits, returning only for real customers. A clean scan report does not mean your site is clean. Two PHP vulnerabilities confirmed in the same attack chain allow an unauthenticated attacker to run code on your server without a password or account.

What the PHP headlines mean for your website Two critical PHP vulnerabilities prompted emergency fixes in October. If your website or web application runs PHP, the question to ask your provider is not whether there is a vulnerability in the news, but whether your specific software has been patched, how that has been verified, and who carries responsibility for doing it. There is a meaningful difference between a vulnerability existing, someone attempting to exploit it, and a confirmed compromise. Your provider should be able to distinguish between all three when you ask. PHP2Shell, Fortinet Updates and When Your Backup Service Goes Offline: https://go.sbcsg.uk/2e36x?p=skool Your backup plan needs a backup plan Two stories this week illustrate the same problem from different angles. Attackers exploited vulnerabilities in Ahsay backup software, with version 10.3.4 remaining vulnerable despite earlier reporting until further hotfixes were released on 12 October. Separately, ConnectWise Cloud Backup suffered a service interruption after unauthorised access to application credentials. ConnectWise confirmed that existing archives remain encrypted and preserved, but containment meant backups and restores were interrupted while the incident was investigated. The practical problem in both cases: your stored copies may exist, but if the system you normally use to reach them is unavailable or untrusted, how do you recover? It is worth asking your provider, before anything goes wrong, how you would restore one critical thing if the backup management service itself was the problem. PHP2Shell, Fortinet Updates and When Your Backup Service Goes Offline: https://go.sbcsg.uk/2e36x?p=skool Application credentials are not the same as staff accounts Checking that your employees have MFA enabled does not tell you everything about who or what has access to your systems. Backup software, integrations and automated services all use application credentials to authenticate without a person approving every operation. If one of those connections is compromised, disabling it does not necessarily reverse changes already made through it. It is worth asking your provider to list what application-level access exists and when it was last reviewed, separately from your review of human accounts.

Why this week matters Five days of threat reporting have landed and there is a consistent thread running through all of it: attackers are not doing anything exotic. They are using weak passwords, unpatched software, default credentials, and trusted infrastructure like backup tools and VPN gateways. The businesses getting hit are not uniquely unlucky. They are operating without visibility into the basics. This week's briefing pulls out the patterns that matter most to small and medium businesses, with one thing you can do today and one question at the end we would genuinely like your answer to. Threat Analysis: UK Retail Under Attack, NetScaler Zero-Days, and the Password That Breached 8.8 Million Records: https://go.sbcsg.uk/56cux?p=skool Ransomware Is Getting Personal, PDFs Are Weaponised, and Microsoft Just Had Its Worst Patch Tuesday Ever: https://go.sbcsg.uk/593dp?p=skool Your MSP's Backup Software Is Being Actively Hacked Right Now: https://go.sbcsg.uk/xkwny?p=skool Your Router Is a Liability, Your WordPress Site Is a Target: UK Small Business Threat Brief, 13th October 2026: https://go.sbcsg.uk/7u54q?p=skool Hard-Coded Passwords, Broken HR Systems, and Why Your 'Off-the-Shelf' Software Might Be Handing Out Admin Access: https://go.sbcsg.uk/s5e58?p=skool Threat Analysis: CoGUI Phishing Takedown and Ivanti Zero-Day, What UK SMBs Need to Know Today: https://go.sbcsg.uk/84nuy?p=skool The password problem is still breaking organisations at scale A small Danish IT company with privileged access to a national civil register holding records on 8.8 million people was breached. Three accounts were protected by weak passwords, with '123456' specifically named. No sophisticated tooling. No zero-days. Just weak credentials on a privileged account.

A lot of you have asked what to do about staff using AI tools. So the team and I built an answer: GRCBolt. It's four ready-to-use documents that tell your staff what they can and can't do with AI at work, written around your business by name: an AI Use Policy, a Staff Acceptable Use Guide, an AI Risk Register, and a one-page briefing on which rules actually apply to you. Short questionnaire, under £100, one-off. It isn't open yet. The waitlist is, and it asks which other policies you'd want next (data protection, incident response, Cyber Essentials, remote working), so your vote shapes what we build. Sample pack: https://go.sbcsg.uk/grcbolt-sample?p=skool Waitlist: https://go.sbcsg.uk/grcbolt?p=skool Tell me what's missing from the sample. Straight criticism is welcome.

Quick one for everyone in here. As a member of this community, you get free early access to every episode of The Small Business Cyber Security Guy podcast, typically 24 hours before it goes public. That means you hear the breakdown first, you get first shot at the discussion, and you can bring your questions into the community before the wider audience has even pressed play. How it works: New episodes land here in the community a day ahead of release. Keep an eye on the feed (or turn on notifications) and you'll catch them as soon as they drop. Why we're doing it: This community is where the real conversations happen. If an episode raises something that applies to your business, your charity or your clients, this is the place to dig into it, and you should have the time to do that before everyone else catches up. No extra cost. No sign-up. Being here is enough. See you in the comments on the next one. 👇