IT and cyber security news

Two critical PHP flaws, known as PHP2Shell, affect websites all over the world. Here's what they are, what we did on 20 and 21 October, and what it means for your website.

A major security issue has recently shaken the web development world. Serious vulnerabilities have been uncovered in the core code of PHP—the server-side programming language that runs a massive portion of the modern internet. Because PHP serves as the foundational engine for major platforms like WordPress, Drupal, and custom web applications, a loophole in its…

The online retailer says attackers impersonated a trusted contact to obtain an employee's work credentials, then used them to reach customer details held on third-party platforms. Payment details and passwords were not affected.

Security firm Arctic Wolf says callers posing as internal IT are walking staff through fake passkey and MFA set-ups, then using the session to copy data from SharePoint, OneDrive and Exchange.

The fintech says requests sent from a genuine government email domain led to customers' personal information being handed over. It has since said 680 customers were affected and that it will pay for replacement ID documents.

Researchers say a financially motivated attacker appears to have used an open-source AI hacking tool and AI coding sessions to breach several lenders in a short space of time.

The UK's National Cyber Security Centre says "shadow AI" is creating blind spots, and that the goal should be to reduce the risk rather than assume it can be eliminated. Its advice: understand why staff look elsewhere, and give them approved tools.

Microsoft has quietly added a year to its consumer update scheme, which was due to end this month. Devices managed by a business aren't covered, and commercial updates come at a rising cost.

Openreach says the copper phone network will close on 31 January 2027, with no further delay. A temporary safety net exists, but it is limited and costs more than a digital line.

The Surface Laptop Ultra is aimed at developers and creators, with UK prices from £2,599. For most businesses, the bigger announcement is a Windows 11 feature that limits what AI agents can do.