Critical PHP Vulnerabilities and Device Code Phishing Target UK SMBs

Two urgent threats sit at opposite ends of the visibility spectrum today. First, the NCSC has issued a critical alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both scoring 9.4 CVSS with public exploit code already circulating. With most UK small business websites running PHP through WordPress, WooCommerce, Magento or custom applications, this is not a comfortable two-week patching window. Remote code execution risks extend well beyond website defacement to encompass customer databases, GDPR exposure and credential compromise. Second, the Wazza phishing kit is actively targeting Microsoft 365 accounts through a sophisticated device code authentication attack that bypasses MFA. By routing through legitimate infrastructure including Google Sites and Cloudflare Workers, the campaign exploits trusted platforms to make malicious traffic indistinguishable from normal business operations. The attack leverages social engineering to trick victims into completing an MFA flow that authenticates the attacker’s session rather than their own. Cisco Talos and Wiz research confirms this is part of a broader pattern of abusing legitimate platforms across more than 25 services. UK small businesses need to verify PHP patching status today, restrict device code authentication in Microsoft 365 tenants through Conditional Access policies, and ensure finance teams understand what device code phishing looks like. Also covered: a reminder on the AOMEI Backupper supply chain compromise affecting updates between April and July 2026.

Chapters

• Introduction Overview of today’s two threats: a loud, technical PHP vulnerability with available patches, and a quiet, sophisticated phishing campaign engineered to appear legitimate. Both affect UK small businesses directly with actionable steps available today.
• Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 NCSC urgent alert on two critical PHP vulnerabilities scoring 9.4 CVSS with proof-of-concept exploits already circulating. Affects most UK business websites running WordPress, WooCommerce, Magento, Laravel, Symfony and Drupal. Remote code execution risks extend to databases, customer records and GDPR exposure. Four immediate actions: verify PHP version with hosting provider in writing, prioritise internal PHP systems, check WAF rule deployment, and review hosting contracts for update control.
• Call to Action Encouragement to follow the show and share with colleagues who need threat intelligence.
• The Wazza Phishing Kit and Microsoft 365 Sophisticated phishing campaign active since July 2026 targeting Microsoft 365 through device code authentication. Originates from compromised legitimate accounts, routes through trusted platforms like Google Sites and Cloudflare Workers to bypass security filters. Exploits legitimate Microsoft device code flow to obtain authentication tokens after victim completes MFA, effectively bypassing multi-factor authentication through social engineering. Cisco Talos documents abuse of 25+ legitimate platforms. Wiz research shows similar patterns in Google Cloud environments. Requires restricting device code authentication through Conditional Access policies and targeted staff awareness about unexpected authentication prompts.
• AOMEI Backupper Supply Chain Reminder Brief reminder of yesterday’s coverage on AOMEI Backupper supply chain compromise between April and July 2026. Three separate windows where attackers modified download instructions to deliver malware, with the longest window lasting ten minutes. Affects backup software used by over 100 million users worldwide, commonly deployed by UK small businesses. Requires verification of whether the software was updated during the compromise window and endpoint review if so.
• Conclusion and Action Items Three immediate actions: contact hosting provider to verify