The latest in cloud, cybersecurity, AI, and web technology — curated for UK businesses every week
Cyber SecurityMicrosoft has fixed a maximum-severity CVSS 10.0 flaw in Entra ID, its cloud identity service used by businesses worldwide to control access to Microsoft 365 and other cloud apps, after confirming attackers were already exploiting it. No customer action is required, but Microsoft has not said who was behind the attacks or how long they had access.
Microsoft 365Microsoft is merging its consumer Copilot app with Microsoft 365 Copilot into a single unified entity, with the rollout beginning now and Podcasts, Group Chat and Deep Research features being retired from 18 August 2026. UK businesses using Copilot should check their licensing tier and back up any content before the cut-off.
Cyber SecurityUK Government Investments, the Treasury body that manages taxpayer stakes in RBS/NatWest, Lloyds, Channel 4 and the Post Office, has admitted a staff member's mistake left an internal file with the names and work emails of 51 government officials publicly accessible for around 40 hours. The incident, disclosed in UKGI's 2026 annual report and escalated to the ICO, is a stark reminder that most breaches start with a simple misconfigured share or permission — exactly what Cyber Essentials controls and proper Microsoft 365 governance are designed to catch.
Cloud InfrastructureBetween 14:44 and 19:41 UTC on 23 July 2026, a bug in Microsoft's request conversion system removed IP routes from more network devices than intended during routine maintenance in the Azure West US region — taking down AKS, PostgreSQL, Databricks, ExpressRoute, VPN Gateway and Microsoft Sentinel for nearly five hours, with the cascade reaching Teams, Outlook and SharePoint globally. For UK businesses running Azure workloads, this is a case study in why cloud resilience architecture — multi-region failover, availability zones, and a managed Azure partner — is not optional.
Cyber SecurityMicrosoft's July 2026 Patch Tuesday — released 14 July — is the largest in the company's history at 622 CVEs, including three zero-days actively exploited in the wild targeting on-premises SharePoint Server and Active Directory Federation Services, with CISA issuing an emergency alert the same day urging immediate patching. The SharePoint RCE flaw CVE-2026-58644 (CVSS 9.8) allows unauthenticated remote code execution via deserialization, while CVE-2026-56164 (SharePoint EoP) and CVE-2026-56155 (AD FS privilege escalation) were both confirmed exploited before Microsoft published patches — making this the most operationally significant Patch Tuesday for UK Microsoft 365 users since Hafnium targeted Exchange Server in 2021.
Cyber SecurityAI-accelerated vulnerability discovery has triggered a Patch Apocalypse that makes traditional CVE tracking impractical for UK SMEs: June 2026's Patch Tuesday brought 206 Microsoft CVEs, Chrome 150 shipped 433 security fixes, Adobe has switched to twice-monthly patches, and CVE-2026-50656 (RoguePlanet) received an emergency out-of-band fix on 9 July 2026 after a researcher published live exploit code. The volume is now so high that security professionals are abandoning CVE-by-CVE tracking in favour of continuous patch-as-you-go programmes — and UK SMEs without a managed Network Admin function are the most exposed.
Cloud InfrastructureOn 10 July 2026, HM Treasury designated Microsoft Ireland Operations Ltd, Google Cloud EMEA Ltd, Amazon Web Services EMEA SARL, and Oracle Corporation UK Ltd as Critical Third Parties to the UK financial sector under the Financial Services and Markets Act 2023 — effective 13 July 2026. The Bank of England, PRA, and FCA will jointly oversee these providers for the first time, marking a structural shift in how cloud dependency risk is governed across UK banking and financial services.
AzureOn 1 July 2026 security firm SharkStriker’s analysis of the Verizon Data Breach Investigations Report 2026 confirmed cloud misconfiguration as the single largest technical breach vector of the year — responsible for 14% of all global breaches in Q1 2026, up from 9% in 2024. The threat is no longer someone breaking in; it is a door left open by the organisation itself. Here is the full UK SME decode for businesses running Azure workloads.
Microsoft 365On 4 July 2026, any UK business still running on-premises Microsoft Exchange faces a decision that has quietly changed shape. CVE-2026-42897 — a cross-site scripting zero-day in Exchange Server’s Outlook Web Access — has been actively exploited since mid-May 2026, was added to CISA’s Known Exploited Vulnerabilities catalogue, and carries a Microsoft-assigned CVSS score of 8.1. It requires no attacker privileges: a single crafted email is enough. Here is the full patch plan every UK SME must run this week.
Cyber SecurityMicrosoft SharePoint Server — used by thousands of UK businesses to share documents and collaborate — contains a CVSS 8.8 remote code execution flaw (CVE-2026-45659) that CISA confirmed is being actively exploited on 1 July 2026. Patched on 21 May 2026 but accidentally omitted from Microsoft’s May Security Updates bulletin, the fix has been silently available for six weeks — meaning any UK SME running on-premises SharePoint without managed patching is already structurally exposed.
Network AdminOn 9 June 2026 Microsoft released its largest-ever Patch Tuesday, addressing 206 vulnerabilities — including 37 critical flaws, 3 publicly disclosed zero-days and two CVSS 9.8 remote code execution vulnerabilities in the Windows Kernel and HTTP.sys — making it the biggest single security release in the programme’s 23-year history. With Cyber Essentials v3.3 now mandating a strict 14-day patch window for critical fixes, every UK SME still running unpatched Windows systems as of 1 July 2026 is already outside compliance and structurally exposed.
AzureOn 25 June 2026 the European Commission issued its preliminary finding that AWS and Azure should be designated as Digital Markets Act gatekeepers — the first time the EU's Big Tech rulebook has reached into cloud infrastructure. With fines up to 10% of worldwide turnover and six months to comply once finalised, here is what UK SMEs locked into either platform must assess now.
Microsoft 365On 4 May 2026 Microsoft's notice MC1269241 took effect and Anthropic Claude became the default Copilot model in Excel and PowerPoint — with Word following in summer 2026. But there is a twist for UK businesses: your tenant is set to OFF by default, the data processing happens outside the EU Data Boundary, and a Global Administrator has to opt in explicitly. Here is the full decode — what changed, what the EU Data Boundary exit means for GDPR and Cyber Essentials v3.3, the realistic cost of getting the governance wrong, and the 10-step opt-in decision framework for UK SMEs running Microsoft 365 Copilot today.
IT SupportMicrosoft’s 2011 Secure Boot certificate chain starts to expire on 19 June 2026 — 42 days from today. Devices keep booting, but a 2011-only Windows estate is locked out of every future Boot Manager update, every new DBX revocation, and every 2023-signed third-party bootloader once the post-June DBX revocation lands. Patch Tuesday on 12 May is the last comfortable rollout window. The full UK SME action plan: the four supported deployment paths, the 0x5944 registry value, the PowerShell verification kit, the Cyber Essentials v3.3 A2.4 angle, and a 42-day rollout sequence.
IT SupportOn 14 October 2026 Microsoft retires the Consumer Extended Security Updates programme — the final lifeline for the 38% of UK business endpoints still running Windows 10. From today, that is exactly 173 days. Here is the full UK SME migration plan: estate audit, Windows 11 eligibility, hardware refresh, Windows 365, Commercial ESU, the Cyber Essentials v3.3 auto-fail risk, the cyber insurance penalty, and the 10-step 173-day rollout you can start this week.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
23 Aug, 2026
AI code review has moved from novelty to default in UK development teams inside about eighteen months. Pull requests now arrive pre-annotated by a model,...
22 Aug, 2026
Google Ads wasted spend is the single most recoverable line item in most UK SME marketing budgets. It is not a strategy problem and it is rarely a creative...
21 Aug, 2026
Cyber Essentials certification has quietly become a commercial requirement rather than a security badge. It is mandatory for most central government contracts...