Four stories from this week, each with one plain-English line for accountants, solicitors and IFAs.
1. Critical PHP flaw: check your website today
PHP, the software behind WordPress and many client portals and booking forms, has two critical flaws (known as “PHP2Shell”) that can let an attacker run commands on a web server without logging in. The NCSC has urged UK organisations to act immediately. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon’s threat intelligence team reports that the flaw is now being widely exploited.
What this means for your firm: if your website or client portal runs on WordPress, ask your web host today to confirm that it’s on a fixed PHP version (or their patched build) and that they’ve checked it for signs of compromise.
Sources: NCSC, 21 Oct 2026 · PHP security advisory, 21 Oct 2026 · CISA alert, 21 Oct 2026 · Amazon Threat Intelligence, 21 Oct 2026
2. “Password1 is not an appropriate password”: ICO reprimands two Welsh organisations
The ICO has reprimanded Data Cymru and its IT supplier, Ogi Networks, after a ransomware attack in November 2024 exposed the personal information of 3,300 people, most of them children. The attackers used a test account called “Test2” that had existed for more than 12 years with the password “Password1”. The ICO said that neither organisation had clear measures for finding and removing old accounts, and that responsibility was shared between them.
What this means for your firm: ask your IT provider for a list of every account on your systems, close any that are no longer needed, make sure remote access uses multi-factor authentication, and agree in writing who removes accounts when someone leaves.
Source: ICO, 20 Oct 2026
3. Ransomware warning: SafePay targets remote access and backups
US agencies, with the UK’s National Crime Agency and the North West Regional Organised Crime Unit, have published a joint advisory on the SafePay ransomware group. They say it has hit around 600 victims across the Americas, Europe and Australia. The group typically gets in through stolen or guessed passwords and unpatched VPN and other internet-facing devices, then deletes or disables backups before stealing and encrypting data.
What this means for your firm: check that your remote-access or VPN device is fully updated and protected by multi-factor authentication, and that at least one backup is kept offline and has been test-restored recently.
Sources: Joint advisory AA26-293A, 20 Oct 2026 · CISA press release, 21 Oct 2026
4. Cyber Security and Resilience Bill: House of Lords Report stage on Monday 26 October
The Bill updates the UK’s Network and Information Systems rules. Among other changes, it brings medium and large managed IT service providers into regulation for the first time. They will have to put proportionate security measures in place and report significant incidents, with the Information Commission (the ICO) as their regulator. The Lords Report stage, where peers vote on amendments, is scheduled for 26 October.
What this means for your firm: the Bill is aimed at essential services and their suppliers rather than small professional firms, but if you use a larger managed IT provider, expect its contracts and incident-reporting terms to change. Now is a good time to ask how and how quickly they would tell you about an incident.
Sources: UK Parliament, Bill stages · GOV.UK factsheet: relevant managed service providers, 30 Jun 2026
Contains public sector information licensed under the Open Government Licence v3.0 (NCSC, ICO and GOV.UK). Summaries are AllMyTech’s own wording. This is general information, not legal advice.