October 2026: PHP2Shell, QR scams & breach basics

October 2026 has been a reminder that the web itself can become a liability overnight. The headline event is PHP2Shell — a pair of critical flaws in PHP (the engine behind most websites and nearly all WordPress sites) that let attackers take control of a web server without logging in. Sites that were secure one day were exposed the next. Patches are out; if you run any PHP or WordPress site it needs updating now — and ideally watched continuously.

Beyond that, the picture for SMEs is steady but serious: phishing remains the number-one way in, ransomware increasingly arrives through a trusted supplier rather than the front door, and AI is making scam emails — and even voice calls — far more convincing. The good news is that the fundamentals still stop the overwhelming majority of attacks. The bad news is that “set and forget” no longer works when new critical flaws land every few weeks.

• QR-code phishing (“quishing”) — a QR code in an email or printed notice that leads to a fake login page. Treat unexpected QR codes like unexpected links.
• Fake IT-support calls — someone phoning claiming to be your IT provider or Microsoft, asking you to install something or read out a code. We will never ask for your password.
• Invoice & bank-detail fraud — an email asking to change payment details. Always verify the change by phone, using a number you already hold.
• MFA fatigue — a flood of approval prompts hoping you’ll tap “approve.” Never approve a prompt you didn’t start.
• Unpatched websites — ask who is checking yours, and how often (see PHP2Shell above).
• AI-written phishing — fewer tell-tale typos, more convincing tone. Verify any unusual request, especially about money or credentials.

The cheapest, highest-return security investment is still your team. This month:

• Security awareness training & phishing simulations — we can run a programme that teaches staff to spot and report threats, with simulated phishing to measure progress.
• Microsoft Copilot session — a hands-on event on using AI safely and productively, so your team gets the benefits without the risks.
• Cyber Essentials — getting certified is itself a training exercise that tightens your basics.
• Free resources — the NCSC offers free tools for small businesses, including its Cyber Action Plan and “Exercise in a Box.” Worth 30 minutes of any leadership team’s time.

Tip for this month: book a 15-minute team refresher on spotting fake IT-support calls and QR-code scams.

Most breaches are prevented by a handful of basics done consistently. If you do nothing else this month, do these:

• Turn on multi-factor authentication (MFA) everywhere — especially email. It stops the majority of account takeovers.
• Patch fast — or better, scan continuously. New flaws like PHP2Shell are exploited within hours, not weeks.
• Back up (3-2-1) and test a restore. A backup you’ve never tested isn’t a backup.
• Train your people. The human layer catches what technology misses.
• Get Cyber Essentials certified. The government-backed baseline covering the five controls attackers exploit most.
• Limit admin rights. Give people the least access they need to do their job.
• Have an incident response plan. Know who does what before it happens, not during.

Not sure where you stand? Start with a free external risk scan — it shows what an attacker can see from the outside, at no cost.