No chapters are available for this episode.
Two critical PHP vulnerabilities, CVE-2026-1096118 and CVE-2026-1096119, both scored 9.8 out of 10, were patched on 21 October 2026. Within hours, attackers began probing for unpatched servers. These flaws allow unauthenticated remote code execution on vulnerable PHP installations, affecting WordPress, WooCommerce, Magento and countless UK small business websites. The vulnerabilities involve memory corruption and stale global state handling. Emergency patches are available for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Cloudflare reported early exploit attempts the same day patches released. CrowdStrike and SentinelOne published guidance immediately. No confirmed breaches have been publicly reported, but absence of disclosure does not mean absence of compromise. UK small businesses must verify their PHP version today, contact hosting providers or MSPs for patch confirmation, and obtain written evidence of remediation. This episode provides specific, actionable steps for business owners to protect their web infrastructure and strengthen their Cyber Essentials certification posture.