Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs

Podcast: Threat Analysis : Cyber News for Small Business · The Small Business Cyber Security Guy

Opublikowano: 2026-10-21

Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs Two urgent threats sit at opposite ends of the visibility spectrum today. First, the NCSC has issued a critical alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both scoring 9.4 CVSS with public exploit code already circulating. With most UK small business websites running PHP through WordPress, WooCommerce, Magento or custom applications, this is not a comfortable two-week patching window. Remote code execution risks extend well beyond website defacement to encompass customer databases, GDPR exposure and credential compromise. Second, the Wazza phishing kit is actively targeting Microsoft 365...