From
The Patch Wave
Plain security news for UK small business owners: what was found, whether it affects you and what to do. Every story says who found the flaw, people or Ai, and a section for developers sits under each one.
The name comes from the NCSC's blog of 01/05/2026, Preparing for a ‘vulnerability patch wave’.
Follow by RSSAction
Found by
Showing 4 of 4 stories
- 29 October 2026This weekFound by: not stated123 Reg customers: contact and account details exposed, watch for fake 123 Reg messages123 Reg is emailing customers about a cyberattack on 18/09/2026 that exposed contact and account details. Turn on two-step verification and treat any 123 Reg call or email with care.
- 27 October 2026This weekFound by: peopleiPhones and iPads: older models now get the fix for a flaw already used in attacksApple has sent the fix for a CoreGraphics flaw already used in targeted attacks to iPhones and iPads still on iOS 18, including older models (XS, XS Max, XR, iPad 7th generation). Update them to 18.7.11 or later, and check newer devices are on the latest version.
- 26 October 2026Act todayFound by: people using AiPHP websites: the PHP2Shell flaws are now being used in working attacksWorking PHP2Shell attacks have now been recorded on unpatched PHP servers, and CISA has added both flaws to its known-exploited list. If your website runs on WordPress or PHP, ask your host today which PHP version you are on.
- 26 October 2026This weekFound by: peopleNext.js websites: two serious flaws fixed on 14/10, separate from PHP2ShellNext.js fixed two serious flaws on 14/10/2026 that could let an attacker run code on the server behind a website. Not linked to PHP2Shell. Ask your developer whether your site is on Next.js 16.4.1 or later, or 15.5.28 or later if it is still on version 15.