When the Runtime and the VPN Are Open: A November 2026 UK SME Threat Briefing

The fortnight spanning late October and early November 2026 has a clear theme for UK SMEs: the software that serves your website and the appliance that terminates remote access are being treated as primary targets again. Three items belong on this month's list. Critical flaws in the PHP runtime (widely labelled php2shell) prompted an NCSC alert on 21 October and CISA KEV additions five days later, with the NCSC later citing more than 110,000 proactive Warning alerts to UK organisations. Ivanti Connect Secure needed a second emergency upgrade after attackers chained an authentication bypass with privilege escalation and a predictable file-upload path. A WordPress Core time-of-check time-of-use race during full-package upgrades shipped a fix on 28 October and was added to CISA's Known Exploited Vulnerabilities catalog on 3 November.

This is a briefing. Skip to the sections that apply to your stack.

1. PHP php2shell: NCSC alert, unauthenticated RCE, patch then restart

On 21 October 2026 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. The same day the NCSC published a UK alert urging immediate mitigation and CISA urged organisations to patch. On 26 October CISA added both CVEs to the Known Exploited Vulnerabilities catalog. Reporting before disclosure includes an exploitation attempt observed around 17 October. Treat any internet-facing PHP that was unpatched through late October as potentially reached.

What the flaws do

PHP rates the risk highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also in scope. CVSS v4.0 scores in partner advisories sit at 9.2. This is not a WordPress plugin bug or a Laravel misconfiguration. It is the language runtime underneath WordPress, Magento, Laravel, phpMyAdmin and a long list of appliances that quietly bundle PHP.

Patch to at least

Apply the OS or hosting-provider package, then restart PHP workers or Apache so the old binary is not left in memory. Confirm with 'php -v' (or your pool's reported version) after the restart. Managed WordPress or shared-hosting customers should still ask the host which PHP build is live and whether workers were recycled.

If you cannot upgrade in hours

Hunt before you declare clean

Look for PHP worker processes launching shells or downloading tools, unexpected new PHP files under web roots, unfamiliar scheduled tasks and outbound connections from web workers to unfamiliar hosts. If the site was internet-reachable while unpatched, patching closes the door. It does not prove nobody walked through it.

2. Ivanti Connect Secure: three chained CVEs, two patch rounds

On 13 October 2026 Ivanti disclosed CVE-2026-104935, an authentication-bypass-by-spoofing flaw in Ivanti Connect Secure (CVSS 8.6) that allows a remote unauthenticated attacker to execute arbitrary commands. CISA added it to KEV the same day. Ivanti stated exploitation in the wild had already affected a limited number of customers. Volexity reported activity beginning around 3 October against an appliance on 22.8R2.4, with post-exploitation including credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys. Attribution to the cluster labelled UTA0576 is a researcher claim. Treat the technical chain as confirmed and the actor label as a claim.

On 29 October Ivanti updated the same advisory with two further exploited flaws that complete the chain many teams only half-closed:

CISA added both to KEV on 30 October. Builds that only fixed CVE-2026-104935 (25.1.1.2 and 22.8R2.5) are not enough. You need the late-October releases.

Patch to at least

Hunt and recovery

CISA and Ivanti both warn that the Integrity Checker Tool may miss in-memory exploitation of CVE-2026-104935. A clean ICT run is not proof of cleanliness. Prefer network and memory forensics where compromise is plausible. If compromise is indicated: back up configuration, factory-reset or rebuild the virtual appliance, upgrade to the latest fixed build, restore configuration, then rotate domain, administrator and local passwords. Revoke and reissue certificates. Reset API keys and licence-server credentials. Assume anything that traversed the VPN in clear text during the exposure window may need rotation too.

3. WordPress CVE-2026-119977: lock down the upgrade path then patch

On 28 October 2026 WordPress shipped 7.1.4 as a security release. One of the fixes addresses a time-of-check time-of-use race in the Core upgrade process, later tracked as CVE-2026-119977 (CVSS 8.1). During a full-package core upgrade, older builds unpack a copy of WordPress into a predictable path under 'wp-content/upgrade/', including installer files the web server can often reach. An unauthenticated attacker who hits that path in the short staging window can execute code as the web server user. On 3 November CISA added the CVE to KEV based on evidence of active exploitation. Defender telemetry in the days after disclosure reported thousands of probing requests against staged installer paths.

Confirm you are at least on

Upgrade safely this month

The awkward detail for SMEs: the update that installs the fix can still unpack using the old updater code on some paths, so the staging folder name can remain predictable for one last race. Before you hit Update Now:

Managed WordPress hosts may have applied the Core fix for you. Confirm the version and whether the host already denies web access to the upgrade path. Self-managed SME sites that lean on automatic background updates should still verify the build landed and that the upgrade directory is not web-reachable.

The pattern behind November

On 3 November the NCSC's Annual Review 2026 (*State of the Cyber Nation*) framed the strategic point. AI is highly likely to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation within two years. The CEO's launch message was blunt: adversaries will not invent every new attack from scratch. They will discover and exploit weaknesses that organisations have tolerated for years, at a speed that "tech on the cheap" cannot absorb. PHP left unpatched, a VPN left one build behind and a CMS upgrade path left world-readable are exactly that class of weakness.

What UK SMEs should do this month

Pick the items relevant to your stack and put a date next to each:

How fractional teams help

We inventory where PHP actually runs (including the appliances nobody labelled as PHP), move runtimes onto the fixed builds and restart workers, take Connect Secure through the late-October releases with a real compromise check rather than a green Integrity Checker screenshot, lock down WordPress upgrade paths before the Core bump and put a KEV-triggered patch rhythm into monthly operations so a runtime flaw disclosed in the third week of one month is not still your incident in the second week of the next. If your MSP or host owns the stack, we help you ask the right questions and validate the answers.

Further reading