The Weekly
Brief

On 22 October the National Cyber Security Centre issued an alert about two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language behind a large share of the web, including WordPress. The flaws could let an attacker run their own code on a web server without logging in, and the NCSC says it is aware of reports that they are already being exploited. The alert covers every PHP installation that serves web pages, whichever way it is set up, and lists the fixed versions as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. An update the same morning added that some firewalls, edge devices and other embedded equipment use PHP too, and need checking against their own maker’s advice.

The next day the NCSC put out a second notice aimed squarely at small businesses. You are likely to be affected if your website runs on a content management system such as WordPress, if a third party hosts your website or online services on PHP, or if you run web applications that depend on it. Its advice is to contact your web developer, IT provider or hosting company and ask four things: does our site or service use PHP; has the latest security update been applied; were checks for compromise done before patching; and is anything else needed? If the update cannot go on straight away, ask what is being done in the meantime. People simply browsing websites do not need to do anything; the flaw is in the servers, not in visitors’ phones and computers.

Microsoft’s October updates, released on 13 October (the 14th here), were the largest on record. BleepingComputer counted 1,411 flaws fixed, 70 of them rated Critical; other trackers’ totals differ slightly depending on what they include. Three were zero-days, meaning they were public or in use before a fix existed. The one that matters most is CVE-2026-96951, a Windows flaw that attackers were already exploiting to get around Mark of the Web. That is the label Windows puts on files that come from the internet or arrive as email attachments, and it is what triggers the “are you sure?” warnings and opens Office documents in Protected View. Get around it, and a booby-trapped download can open without the warning your staff have learned to look for.

The other two zero-days were publicly disclosed but not known to be exploited: a .NET Framework flaw that could let unapproved programs get past Windows Defender Application Control, and a lower-rated denial-of-service bug in a software library. October was also the end of the road for two things we have covered before. It was the last security update for Windows 11 version 24H2 Home and Pro (Issue 015), and the final update for Office 2021 (Issue 019). Any machine still on either got its last fix this month.

Two weeks ago (Issue 020) we reported that Copilot’s new pay-per-use features would stay off until an administrator set a spending policy, and noted that Microsoft’s notice talked about Enterprise tenants and was silent on the Business plans most small firms use. Microsoft’s announcements to its partners now answer part of that, and the answer is different. From 1 December 2026, new Microsoft 365 Copilot Business licences bought through a Microsoft partner (the CSP programme, which is how most New Zealand small businesses buy Microsoft 365) will come with usage-based billing switched on by default. The default spending limit is 4,000 Copilot Credits per user per month, which an administrator can change. Microsoft’s own example: a business with 100 Copilot Business users could use up to 400,000 credits a month under the default, charged on actual use.

The features this pays for include Copilot Cowork and other usage-based experiences. Microsoft says the change will initially not be available in a list of countries that includes Australia; New Zealand is not on that list. A second change lands the same day: from 1 December, Copilot and Copilot Business can be bought without a Microsoft 365 subscription underneath, at the same price as today. The current versions are being renamed “(add-on)” and existing subscriptions carry on as they are. Microsoft’s partner notices still give no price per credit.

Netsafe received 292 reports of online shopping scams in September, with reported losses of $58,300. That is down on August, when it took 337 reports and losses of $146,800. But Netsafe is not reading that as good news for long. With Black Friday and Christmas coming, it expects scam activity to climb as more people shop online, especially those buying gifts or stretching a tight budget after a winter of high power, fuel and grocery bills.

Netsafe’s advice to shoppers is the familiar list, and it holds up: check independent reviews, check the website address carefully, look at payment requests before completing a purchase, and be wary of pressure tactics such as stock “running out” or a deal that ends in minutes. For retailers, the advice is to make your official sales channels easy to find and verify, so customers can tell your real shop from a copy.