The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups

PHP2Shell, Fortinet Updates and When Your Backup Service Goes Offline A critical PHP vulnerability prompted emergency fixes and a wave of opportunistic sales pitches. Meanwhile, Fortinet announced urgent security updates across multiple products, ConnectWise Cloud Backup users faced service interruption during an incident response, and the Ahsay backup story required revisiting after further patches. Noel Bradford and Lucy Harper examine what business owners should ask when headlines break, when unsolicited rescue offers arrive, and when the service they depend on for recovery becomes unavailable. The episode defends honest questions about unfamiliar technology, challenges vendors charging premium prices to demonstrate their security record, and separates patching status from incident investigation. Practical guidance covers checking PHP exposure without guessing from website appearance, understanding the difference between automated updates and engineer-led maintenance windows, reviewing application credentials alongside human accounts, and planning recovery scenarios when normal backup routes are closed. No marketing exaggeration, no sneering at gaps in knowledge, just the evidence-based conversation that helps small businesses make sound decisions under pressure. Chapters Cold Open A serious PHP vulnerability hits the news. Websites go offline. Business owners ask whether they are affected. Parts of the security industry respond by mocking someone for admitting what he did not know, while Noel’s inbox fills with offers to save websites from a threat many senders have not properly diagnosed. Welcome Noel Bradford and Lucy Harper introduce the episode and its sponsor, GRCBolt. The agenda covers PHP2Shell, Fortinet updates, the Ahsay backup story revisited, and ConnectWise Cloud Backup service interruption. The common thread: what can a provider actually show you when they say they are protecting your business? PHP Has Entered the Chat PHP is a programming language used to run websites and web applications. Two critical vulnerabilities prompted emergency fixes on 21 October. Lucy and Noel explain the difference between affected software, exploitation attempts and confirmed compromise, and what business owners should ask their providers about patching, verification and responsibility. The Crime of Saying I Did Not Know BBC cyber correspondent Joe Tidy attracted ridicule after saying he had not known about PHP before the story broke. Noel defends honest questions and criticises the sneering pile-on, arguing that mocking gaps in knowledge undermines the security culture we claim to want and discourages the early reporting businesses need. Emergency Expertise Next Day Delivery Noel describes his inbox filling with urgent PHP2Shell warnings and rescue offers, many diagnosing technology his websites do not use. He contrasts engineers doing the actual work with noise merchants creating confusion, and explains how to handle unsolicited warnings without turning a mailing list into a purchase order. Premium Prices Familiar Questions Fortinet announced urgent security updates across several products, including FortiOS, FortiManager and FortiAnalyzer, citing AI-assisted testing that found critical and high severity vulnerabilities. Noel argues that premium pricing creates expectations the engineering record has not consistently met, citing historical examples of hardcoded credentials and questioning what the vendor has learned. Who Pays for the Maintenance Window Lucy clarifies that a current standalone FortiGate can automate routine patch upgrades when the feature is available and enabled, while Noel emphasises that legitimate maintenance work belongs in the price comparison. The discussion covers upgrade workload variation, the difference between marketing diagrams and rehearsal, and the importance of verifying success after scheduled updates. GRCBolt Sponsor Message A done-for-you policy service for small businesses that need to get governance, risk and compliance organised without breaking the bank. GRCBolt creates a tailored policy pack from information about your business, providing a practical starting point for documenting how your company works and who takes responsibility. Ahsay The Promise We Need to Keep Huntress reported attackers exploiting two Ahsay CBS vulnerabilities together from 7 October, bypassing authentication and gaining code execution. The patch position changed, with version 10.3.4 remaining vulnerable despite earlier reporting. Ahsay released further hotfixes on 12 October. The discussion distinguishes patching from incident investigation and emphasises that recovery plans must consider the backup management system being unavailable or untrusted. ConnectWise The Service You Need to Recover ConnectWise Cloud Backup service interruption followed unauthorised access to application credentials. The 23 October update said existing archives remain encrypted, isolated and preserved, with no indication of compromise, but containment interrupted backups and restores. The discussion examines the business problem when stored copies exist but normal recovery routes are unavailable, and the need for contingency planning before interruption. The Application Already Has Access Application credentials enable services to authenticate without someone sitting at a keyboard approving every operation. Backup software must access the information it copies. Lucy and Noel explain that checking employee MFA does not tell you everything about application connections, and that disabling a compromised connection does not necessarily reverse changes already made through it. Tomorrow Morning Ask for Evidence Practical guidance for business owners. Book a short conversation with the people looking after your website, security equipment and backups. Ask whether you are affected, what supports that conclusion, and how you would recover one critical thing if the normal backup management service was unavailable. Record the basis, the date and any gaps. Closing A real security problem reached people who had never heard of the technology behind it. An industry sometimes more interested in demonstrating expertise than being useful. People asking honest questions deserve better. People paying for protection deserve evidence. The closing question: if I needed the protection I am paying for today, could you demonstrate that it works? Links https://ubuntu.com/security/notices/USN-7080-1 https://www.huntress.com/blog/threat-advisory-ahsay-backup-software-actively-exploited-cve-2024-8796-cve-2024-8800 https://www.connectwise.com/resources/connectwise-cloud-backup-security-update

Twenty-Eight Arrests and Four Million Scams: Why Your Callback Rule Matters On 13 October 2025, the UK’s National Crime Agency announced the results of Joint Disruption Week: 28 arrests across Ghana and Nigeria, 117 people rescued from suspected scam compounds, and 3.7 million fraudulent accounts removed by Meta. It sounds like a win—and for those rescued, it was. But for Gary, a 12-person building firm owner who opened an email from his plasterboard supplier asking him to pay a new bank account, none of those arrests stopped his Tuesday going wrong. This episode unpacks what actually happened during the NCA’s operation, who was in the room, and why invoice redirection and CEO fraud weren’t the scams being targeted. We walk through the new mandatory reimbursement rules (and why Gary probably isn’t covered), the per-head cost of recent retail data breaches, and why GDPR still matters even when ‘everyone’s data is already out there’. Plus: French supermarket freezers sabotaged via outdated refrigeration controllers, Microsoft’s largest-ever Patch Tuesday (over 1,400 fixes), and the OpenAI engineer allegedly caught planting a listening device wrapped in toilet roll. The solution isn’t waiting for more arrests. It’s a one-line rule, signed by the boss, that every bank detail change requires a phone call to a number you already hold. We cover what to report, where to report it, and why every scam you flag—even the ones you spotted—feeds the intelligence that takes down networks. Chapters Cold Open A police raid in Ghana and an email to a builder in the UK: two ends of the same industry, only one made the news. Welcome Introduction to the episode and a note on schedule changes. What Actually Happened The NCA’s Joint Disruption Week results: 28 arrests, 117 people rescued, 3.7 million accounts removed, and $11 million in potentially freezable funds. Who Was in the Room Fifteen law enforcement agencies and fifteen tech firms convened at the NCA’s London headquarters, funded by the Home Office Integrated Security Fund. Why Your Inbox Didn’t Get Any Quieter The operation targeted social media scams aimed at the public, not the invoice redirection emails hitting small business accounts. The Bill Invoice and mandate scams cost £41.3 million in 2025, with only 48 per cent of losses returned to victims. New reimbursement rules don’t cover most small firms. Gary’s Tuesday How a fake supplier email lands, why the callback rule works, and the two-sentence policy that protects payment approvers. Every Report Counts Why reporting scams you didn’t fall for feeds intelligence that takes down networks. Where to report and how the system changed. The Bigger Picture The new Online Crime Centre, Ofcom’s incoming scam advert rules, and why platforms need to carry more of the burden. The Retail Run TFG London (Hobbs, Whistles, Phase Eight) spotted a cyber incident; H&M investigates data breach claims. Both follow the ASOS breach covered last episode. Is GDPR Pointless? Per-head fines look small, but breaches supply the raw material for scams. Why GDPR reporting duties matter and how the Cyber Security and Resilience Bill might close gaps. The Fridge That Went Rogue Hundreds of French supermarkets had freezers switched to defrost overnight via outdated refrigeration controllers. Fixes existed; nobody installed them. The Patch Pile Microsoft’s largest-ever Patch Tuesday: over 1,400 fixes, including one already being exploited. Windows 11 version 24H2 Home and Pro reached end of support. The Bug in the Boardroom A US Department of Justice complaint alleges an OpenAI engineer hid an audio recorder behind a conference room television, wrapped in toilet paper. This Week Six practical actions: write the callback rule, turn on MFA, update reporting contacts, ring your bank and IT supplier, audit networked devices, and check data protection complaint routes. Close Twenty-eight arrests won’t stop the next fake invoice. The callback rule will. Links https://www.nationalcrimeagency.gov.uk/news/nca-hosts-international-law-enforcement-and-tech-industry-crackdown-on-fraud-and-scams https://www.justice.gov/opa/pr/justice-department-announces-results-international-week-action-against-online-fraud https://about.fb.com/news/2025/10/combating-fraud-during-joint-disruption-week/ https://www.ukfinance.org.uk/policy-and-guidance/reports-and-publications/annual-fraud-report-2026 https://www.bbc.co.uk/news/articles/cy4g8359j7ro https://www.bbc.co.uk/news/articles/cz6jle2y2yyo https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingmarch2025 https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025 https://www.psr.org.uk/our-work/app-fraud/reimbursement-requirement/ https://www.reportfraud.police.uk/ https://www.ncsc.gov.uk/collection/phishing-scams https://www.bfmtv.com/economie/entreprises/distribution/ https://claroty.com/team82/research/ https://msrc.microsoft.com/update-guide/releaseNote/2025-Oct https://www.justice.gov/usao-ndca/pr/openai-engineer-charged-planting-listening-device-executive-conference-room https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-to-complain/ https://www.ncsc.gov.uk/collection/small-business-guide https://www.ncsc.gov.uk/cyberessentials/overview

ASOS Breach: When Attackers Use Your Voice to Message Customers When ASOS customers received a push notification announcing the company had been hacked, it came through ASOS’s own app. The attackers had gained access to third-party communication platforms via social engineering and used them to address customers directly. Whilst card details and passwords appear unaffected, names, contact information and search histories may have been compromised. The incident raises an uncomfortable question for every business with customer communication systems: if somebody steals one login, can they impersonate you to everyone on your list? Noel Bradford and Lucy Harper examine what small businesses can learn from this case, from limiting account permissions and implementing proper multi-factor authentication to rehearsing incident response when nobody knows who holds the off switch. The episode also addresses why ‘basic’ customer data isn’t harmless when stacked together, how to communicate during an ongoing investigation without promising certainty you don’t have, and the critical difference between changing a password and actually revoking access. Sponsored by GRCBolt, the episode closes with a preview of the Ahsay CBS backup console vulnerability being actively exploited since 7 October 2024. GRCBolt is a done-for-you AI policy pack for UK small businesses. It is not open yet, but the waitlist is: https://grcbolt.co.uk Chapters Cold Open An ASOS customer receives a ransomware notification through the company’s own app, addressed to ‘ASOS DPO and IT’. The attackers have used ASOS’s platform to message customers directly, raising questions about trust and control. Welcome Introduction to the episode and the central question: if somebody gets into the account that talks to your customers, who can actually stop them? What We Actually Know Timeline and verified facts from the ASOS incident. Push notification sent 6 October claiming Snowflake compromise. ASOS confirms unauthorised third-party platform access via impersonation attack. Names, contact details and account information accessed, but not passwords or card details. Snowflake denies platform vulnerability. They Borrowed Your Voice How compromised communication platforms undermine customer trust. When messages come from genuine accounts through familiar channels, traditional verification advice breaks down. The danger of inherited permissions and shared logins in marketing and booking systems. The MFA Question Why ‘they should have had MFA’ oversimplifies the problem. Different types of multi-factor authentication offer different protections. The NCSC now recommends passkeys where supported. Emphasis on checking actual account configurations, not policy documents. Basic Information Isn’t Harmless Why names and contact details become dangerous when combined with context like shopping behaviour and search history. How attackers use ‘basic’ data to craft convincing follow-up scams. The importance of telling customers how you will and won’t contact them. GRCBolt Sponsor message for GRCBolt, a done-for-you policy service helping small businesses create tailored governance, risk and compliance documentation. Friday Afternoon Incident response scenario: a customer reports receiving a suspicious message that looks legitimate. Who can stop more messages going out? The gap between IT support scope and marketing platform access. The need for pre-agreed emergency procedures and authority to act. Are They Actually Out? Why changing a password isn’t enough. How active sessions, connected apps and secondary accounts can persist. Microsoft’s guidance on session revocation limitations. The importance of audit logs and knowing what to check after a compromise. Can I Trust the Next Message? Communicating with customers during an ongoing investigation. How to provide updates without overpromising certainty. The need for a separate, secured channel customers can verify. Distinguishing between ‘no evidence found’ and ‘definitely didn’t happen’. Tomorrow Morning Three practical steps: find it (identify systems and access routes), limit it (test containment procedures), rehearse it (run a fifteen-minute tabletop scenario). Focus on one customer-facing system at a time. Identify named owners, backup contacts and emergency procedures. Closing and Ahsay Teaser Summary of key lessons and preview of next episode covering the Ahsay CBS backup console vulnerability actively exploited since 7 October 2024. Huntress reports web shells and cryptocurrency miners being deployed, with version 10.3.4 confirmed affected. Links https://www.bbc.co.uk/news/articles/cy4g8g8g8g8g https://www.theregister.com/2024/10/08/asos_breach/ https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-services https://learn.microsoft.com/en-us/entra/identity/authentication/ https://www.huntress.com/blog/ahsay-cbs-exploitation GRCBolt, the AI policy pack for UK small businesses. Join the waitlist A sample GRCBolt pack

Your Security Kit Is the Way In The things you bought to keep attackers out are how they’re getting in. Citrix, Fortinet, forgotten WordPress backups, fake ChatGPT adverts, and the AI in your business that nobody owns. Some time in early September, somebody found a way through a door that thousands of businesses use to let their staff in from home. The owners didn’t know. Then the emergency fix arrived, patched boxes started rebooting, and that turned out to be another hole attackers were already using. This week Noel Bradford, Lucy Harper, and Graham Falkner follow one thread through every story: something was trusted, and nobody was in charge of checking that trust. Citrix NetScaler zero-days exploited for weeks before disclosure. A FortiMail flaw with fixes still pending, and Noel’s long-running grievance with Fortinet’s track record. Forgotten WordPress backups handing over email and cloud passwords. Microsoft’s Digital Defense Report showing phishing back as the front door. And fake ChatGPT adverts on Google that walk staff straight into installing a remote access tool. Then the conversation turns to the AI in your business that nobody owns. Prompted by John Wernfeldt’s LinkedIn post on AI teams and governance teams talking past each other, the hosts translate the problem for Gary Mott’s twelve-person building firm and land on three conditions that take twenty minutes to agree. Noel also announces GRCBolt, his own AI policy pack for UK small businesses, now taking waitlist sign-ups. What to do this week Email your IT provider and anyone who holds your data. Ask whether they run Citrix NetScaler or Fortinet FortiMail, and whether they’ve patched and checked for signs of compromise. For Citrix, ask whether they’ve applied the second fix released on Sunday 4 October. Find out who looks after your website. Ask them to clear old backup files out of public folders, update WordPress, and change the email password stored in your contact form plugin. Turn on passkeys for the accounts that matter most: whoever runs Microsoft 365 or Google Workspace, and whoever approves payments. Both platforms include passkeys at no extra charge. Forcing everyone to use them needs an extra licence on some Microsoft plans. Tell everyone one rule. No genuine website will ever ask you to press the Windows key and R, then paste something in. Agree three things about AI: which tools are allowed, which data never goes in, and who checks the output before a client sees it. Put a name next to each. Chapters 00:00 Cold open 00:56 Welcome 01:33 The doors you don’t own: Citrix NetScaler and Fortinet FortiMail 10:15 The back door you forgot: WordPress backups leaking passwords 13:36 Borrowed trust: Microsoft’s report and fake ChatGPT adverts 19:13 The AI nobody owns 23:00 Introducing GRCBolt 25:03 Your Monday morning actions 26:57 Close Sources Citrix NetScaler NCSC: Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Gateway Citrix security bulletin for CVE-2026-88771 to CVE-2026-88778, including indicators of compromise Sophos: Citrix NetScaler vulnerabilities in active exploitation The Hacker News: Mandiant and Google Threat Intelligence on the NetScaler campaign Cyber Security News: NetScaler appliances rebooting after the zero-day patch BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks Fortinet FortiMail Help Net Security: Critical FortiMail zero-day exploited in the wild watchTowr: FortiMail CVE-2026-104286 FAQ Radical Notion: Fortinet CVE report card (third-party aggregator) MazeHQ: 2025 known exploited vulnerabilities by vendor WordPress backups Cyber Security News: Exposed WordPress backups leaking cloud and email credentials Microsoft Digital Defense Report 2026 Microsoft Digital Defense Report 2026 Microsoft’s figures come from its own customer and incident response data, so treat them as vendor telemetry. Fake ChatGPT adverts and ClickFix Huntress: Attackers abuse ChatGPT Custom GPTs to deliver a RAT via ClickFix Island: How attackers use sponsored search and Custom GPTs in malware delivery Passkeys CoreView: Enabling and enforcing passkeys in Microsoft Entra ID Google Workspace Updates: Passkeys for Workspace users AI and governance The governance discussion was prompted by a LinkedIn post from John Wernfeldt on why AI teams and governance teams need to be in the same room. John writes about data governance, analytics, and AI in his newsletter, Data Governance Field Library. GRCBolt GRCBolt is Noel’s own product, and this episode has no sponsor. It’s an AI policy pack for UK small businesses: four documents written around your business, a one-off price under £100, no subscription, and editable Word files. It’s guidance only, and it doesn’t replace legal advice or certify you against any standard. Join the waitlist and see the partial sample pack at grcbolt.co.uk. Related episodes Mentioned in this episode: The Firewall Fallacy: Fortinet, KEVs and the Cost of Complacency When AI Finds the Switch You Forgot: Attacks for Pocket Change When Laws Lag and Attacks Sprint: The 10-Hour Cyber Reckoning Why a 0% Phishing Click Rate Might Be Lying to You When AI Could Make You Speak: Trust, Consent, and Synthetic Voices We Found the Admin Password in the Dark Web: A GRC Wake-Up Call Passkeys Aren’t Dead: What a Week of Panic Taught Us About Risk Further listening: Shadow AI Is Just Shadow IT Wearing a Cape If Your MSP Says ‘All Good’, Can They Prove It? Listen, subscribe, and join in All episodes Join our Skool community Questions or stories: [email protected] If this episode was useful, share it with someone who needs to hear it. Especially whoever looks after your website.

Imagine waking on a Tuesday to discover an invisible army has been testing your doors for six days. It doesn’t need fancy zero-days or cinematic cleverness — just agents that can scan, read, adapt and move on. In this episode, we follow a financially motivated attacker using open-source AI tools to run 105 probing projects in under a week, harvesting card data and compromising organisations while the cost of each reconnaissance run averages just a few dollars. From Gambit Security’s reconstruction of a scaled campaign to New Zealand’s National Cyber Security Centre warning that frontier models accelerate reconnaissance, the story threads together into one uncomfortable observation: the problem isn’t a lack of security technology, it’s the gap between owning features and operating them. A critical TeamCity flaw with a published patch and known exploitation shows how a fixed vulnerability becomes a real ransomware entry when change processes stall and nobody can say for sure what is exposed. We even wind up in the optical spine of fiber broadband, where Quark’s Lab’s deep dive into passive optical networks exposes a familiar theme — standards and features can support strong protections, but optional choices and careless deployments turn capability into illusion. Whether it’s MFA, backups, EDR or encryption, a green tick on a dashboard is not the same as a control that will actually stop an attacker in the middle of the night. AI doesn’t need to be a brilliant mastermind. It just needs to cheaply and persistently test the weak signals you left lying around. That changes the economics: the marginal cost of trying the next company collapses, and opportunistic compromise scales. Small businesses aren’t suddenly interesting; they’re suddenly cheap to probe, and automation can take an exploit much further than old scanners ever could. But this isn’t fatalism — it’s a practical wake-up call. The defence that works is less about buying another product and more about operational discipline: know what your external world can reach, test whether MFA actually prompts for a second factor, restore a backup for real, and rehearse the decision pathways for critical patches. Ask: if someone could attack us cheaply tomorrow, what would make them stop? We tell the story through people and processes — the helpdesk pressured to reset accounts, the admin on leave, the server thought to be internal but quietly facing the internet — and pull tools into the background. The episode walks you through real moments where security features exist but controls don’t, then hands you a simple, evidence-first checklist to start closing those gaps today. By the end you’ll see the same pattern in different disguises: AI makes probing trivial, technology contains the answers, and operations decide whether those answers are actually used. It’s bleak, fixable, and urgent — because the next probe might be the one that finds the switch you forgot to turn on. Find our Skool community here - https://www.skool.com/small-biz-cyber-guy-2008