The latest in cloud, cybersecurity, AI, and web technology - curated for UK businesses every week
Cyber SecurityThe exact PHP versions that fix PHP2Shell (8.5.12, 8.4.27, 8.3.36, 8.2.35), what to do if you're stuck on end-of-life PHP 8.1, 8.0, 7.4 or 5.x with no official release, why updating WordPress and plugins doesn't touch the bug, the limits of the partial mitigations, and how two AI-assisted research efforts at Calif and Wiz independently found the flaw.
Cyber SecurityThe NCSC, alongside US and EU cyber agencies, is urging every organisation running PHP - the scripting language behind most of the world's websites - to patch two critical vulnerabilities that allow unauthenticated attackers to execute code on affected servers. The flaws were reportedly uncovered using AI and described as among the most significant ever found this way, and Amazon says it had already seen attacks exploiting them before the public warning was issued.
Cyber SecuritySecurity researchers have found that two obscure characters - a Cyrillic barred letter and a hooked Latin letter - can trick Chromium-based browsers like Chrome and Edge into displaying fraudulent lookalike domains as if they were genuine. The flaw lets attackers register convincing imitations of trusted websites, including banks and major brands, that bypass the built-in checks browsers rely on to flag suspicious URLs - a fresh reminder that domain-based trust has limits.
ComplianceTikTok has dropped its appeal and agreed to pay a £12.7m ICO fine after up to 1.75 million UK children under 13 used the platform in 2020, but two of the regulator's three findings had nothing to do with age gates - they were about inadequate information on data use and a failure to obtain parental consent. With the UK's under-16 social media limit approaching, it's a timely reminder for any UK business running a website or app that children could plausibly access.
Cyber SecuritySecurity researchers at Wiz and watchTowr have confirmed active, in-the-wild exploitation of three JFrog Artifactory vulnerabilities, with attackers moving in as little as four days after patches were published to install backdoors and mint long-lived admin credentials. Weeks after fixes were released, well over half of internet-exposed instances remain unpatched - a reminder that developer infrastructure often falls outside routine IT patching cycles.
ComplianceA Swansea University study found that 86% of 624 licensed British gambling websites appear to breach GDPR through their cookie consent banners, using dark patterns that nudge visitors towards accepting tracking and, in two-thirds of cases, harvesting data before consent is even given. With the ICO already pursuing enforcement across the wider web, it's a clear warning for any UK business whose website cookie banner hasn't been properly reviewed.
AI & SecuritySecurity researcher Johann Rehberger has shown that Anthropic's Claude Code, running in Auto Mode, can be tricked into downloading and executing attacker-controlled code up to 80% of the time - simply by asking it to summarise an ordinary-looking website. Anthropic says the behaviour is "working as designed," leaving UK businesses adopting AI coding assistants to rely on sandboxing and network egress controls rather than the model's own safety guardrails.
Cyber SecurityA stealthy new npm supply-chain worm called ChainDrop has poisoned 444 packages collectively downloaded around 2 billion times a month, hiding its tracks by propagating through tarballs rather than source commits. UK development teams using npm in CI/CD pipelines should check for tampered .claude and .vscode configuration files across every branch, not just main.
Web DevelopmentGitHub's automation platform Actions and its Pages hosting service failed again on 6 August 2026, the latest in a run of outages that has seen the Microsoft-owned platform log 26 incidents in July alone. For UK businesses whose websites and deployment pipelines depend entirely on one third-party platform, it is a clear signal to build in redundancy before an outage becomes a lost sales day.
Google AdsOn 1 July 2026, Google's revised Advertising Terms of Service took effect for every advertiser worldwide - introducing a "continued obligation" clause that makes each business directly and permanently liable for every AI-generated asset Google creates on its behalf. With 70 million AI-generated ad assets produced in Q4 2025 alone, and a $728 billion mass arbitration filed on 11 May 2026 over undisclosed AI substitutions, UK SMEs running Google Ads now face a material compliance and financial accountability shift. Here is the complete decode and 10-step action plan.
Google AdsOn 25 June 2026, Google completed a week-long cluster of AI advertising changes - Gemini-powered Demand Gen creative, Web to App Measurement and Ads API v24.2 - capping Google Marketing Live 2026's announcement of Conversational Discovery ads and Business Agent for Leads. With AI Overviews recommending a competitor 69% of the time on a platform that handles 93% of UK searches, UK SMEs must audit conversion tracking, rebuild creative for conversational intent and export 37 months of historical data before the retention window closes.
Web DevelopmentTwo critical WordPress plugin vulnerabilities disclosed on 4 May 2026 - CVE-2026-5722 in MoreConvert Pro and CVE-2025-13618 in Mentoring - both score the maximum CVSS 9.8 and both hand unauthenticated attackers full administrator control of any affected UK SME website. Mass-scanning is already in progress. Here is the full UK SME decode: the seven-day web stack audit plan, the Cyber Essentials v3.3 auto-fail risk, the GDPR exposure, the realistic cost-of-compromise envelope, and the 10-step rollout for a managed WordPress posture that does not crumble at the next plugin advisory.
Web & SEOThe March 2026 core update has completed, AI Overviews now appear on 48% of searches, and organic CTR has crashed 61%. With 60% of searches ending in zero clicks, here's how UK businesses must adapt their digital strategy.
CloudflareCloudflare's March 2026 updates include Dynamic Workers for sandboxed AI agents, AI Security GA, and a threat report revealing 230 billion daily blocked threats.
SEO & WebGoogle's first core update of 2026 prioritises Core Web Vitals, E-E-A-T signals, and AI visibility. Here is what UK businesses need to do right now to protect their rankings.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
22 Oct, 2026
Fixed wireless access delivers business internet over radio rather than a cable into the building, and for many UK businesses it is a genuine primary...
21 Oct, 2026
Row-level security reporting means building dashboards that show each person only the rows of data they are entitled to see their own region, their own team,...
20 Oct, 2026
Good LLM integration architecture is what separates an AI feature that keeps working for years from one that becomes a maintenance burden within months. The...