Badger Watch
The attacks and scams that matter to small businesses right now, explained in plain English, with exactly what to do. No scaremongering, just the useful bit.
Current alerts
Two critical flaws in PHP let attackers take over unpatched web servers without logging in. Now confirmed in real attacks.
Who's affected: Any website running on PHP, including WordPress, Joomla, Drupal and Magento, whose server hasn't been updated since 21 October 2026.
What to do: Ask your web host to confirm PHP is patched (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later). If you can't patch, take the site offline until you can.
What to doAlways worth knowing
These catch out businesses every week. A minute reading each could save you thousands.
Fake or hijacked supplier emails asking you to pay a new account. Always phone a number you already know before paying new bank details.
How to stay safe“Shared document” and “password expiring” emails that lead to a copy of the Microsoft sign-in page, built to steal your login.
How to stay safeAttackers delete or encrypt connected backups first. Keep one copy offline or unchangeable, and test a restore.
How to stay safeYou might have missed
Big incidents, software deadlines and scams since spring 2025 that still matter to small businesses. Tap any one for who's affected and what to do.
Criminals set up Teams accounts with names like “IT Protection Department”, message staff, then call them and talk them into opening Quick Assist or another remote-control tool, so the criminal can take over the computer. One campaign reached more than 150 employees at over 10 companies in early 2026.
Who's affected: Any business using Microsoft Teams, especially if it accepts chats from outside the company.
What to do: Tell staff that real IT support won't cold-call them on Teams, and to check using a number they already know. Ask your IT provider to limit external Teams chats and restrict who can use Quick Assist.
Sources: Unit 42 (Palo Alto Networks) · Help Net Security
The NCSC warned that Fortinet firewalls and VPN gateways (the boxes that let staff connect to the office from home) were being targeted worldwide, with some impact in the UK. Criminals guessed or reused passwords to get in, then leaked a large list of the login details they collected.
Who's affected: Businesses with a Fortinet (FortiGate) firewall or VPN, which are common in small offices.
What to do: Ask your IT provider to check for signs of a break-in and update the device. Replace default or reused admin passwords, turn on two-step login for VPN and admin access, and keep the admin page off the internet.
Sources: NCSC · Australian Cyber Security Centre
The ICO fined South Staffordshire Water £963,900. Its attack started with a phishing email, went unnoticed for about 20 months, and exposed data on more than 600,000 people. The ICO pointed to weak monitoring and out-of-date software.
Who's affected: Any organisation holding customer or staff personal data. UK data protection law applies whatever your size.
What to do: Keep software up to date, make sure someone is watching for security warnings, and give staff simple phishing awareness training.
Sources: ICO enforcement notice · The Register
An email asks you to type a short code into a genuine Microsoft sign-in page. That code quietly gives the criminal access to your email and files, even if you use two-step login. Ready-made criminal kits spread the trick widely during 2026.
Who's affected: Any business using Microsoft 365 email.
What to do: Tell staff never to enter a sign-in code that someone else sent them. Ask your IT provider to block this sign-in method (called “device code flow”) unless you really need it.
Sources: Proofpoint · IT Brief UK
The national service for reporting fraud and cyber crime in England, Wales and Northern Ireland is now Report Fraud, run by the City of London Police. The phone number, 0300 123 2040, hasn't changed.
Who's affected: Every business and individual in England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.
What to do: Update incident plans, posters and staff guidance to reportfraud.police.uk. Be suspicious of anyone contacting you “from Action Fraud”.
Sources: City of London Police · techUK
Microsoft ended support for Windows 10 on 14 October 2025. Businesses can buy Extended Security Updates as a stopgap, a year at a time. The free extension Microsoft announced for home PCs doesn't cover business-managed devices.
Who's affected: Any business still running PCs on Windows 10.
What to do: Upgrade to Windows 11, or replace PCs that can't run it. If you rely on paid Extended Security Updates, check they've been renewed for this year.
Sources: Microsoft · BleepingComputer
Microsoft stopped security fixes for Office 2016 and 2019 (Outlook, Word, Excel) and for Exchange Server 2016 and 2019 (email servers kept in your own office). They still work, but new security holes won't be fixed. Office LTSC 2021 followed on 13 October 2026.
Who's affected: Businesses using boxed or one-off-purchase Office, or running their own email server.
What to do: Move to Microsoft 365 or Office LTSC 2024, and move email to Exchange Online (or Exchange Server Subscription Edition if it must stay in-house).
Sources: Microsoft · Help Net Security
Criminals said they stole records of around 8,000 children from the Kido nursery chain, posted samples online and phoned parents to push the nursery into paying. Small, trusted businesses are targets too, and criminals may contact your customers directly.
Who's affected: Any business holding personal data about customers, children or patients, especially in online software.
What to do: Use two-step login on your online systems, keep only the personal data you really need, and have a plan for telling customers and the ICO if something goes wrong.
Sources: Malwarebytes · Silicon UK
Criminals broke into SonicWall's online backup service and stole saved firewall settings, including encrypted passwords. SonicWall later confirmed every customer who had used the cloud backup was affected.
Who's affected: Businesses with a SonicWall firewall whose settings were ever backed up to SonicWall's cloud.
What to do: Ask your IT provider to follow SonicWall's guidance: change firewall and VPN passwords and shared keys, and check the MySonicWall account for affected devices.
Sources: CISA · The Register
Some websites show a fake “I'm not a robot” check that tells you to press a few keys and paste something into Windows. Doing so runs the criminal's command and installs software that steals passwords. Microsoft calls it “ClickFix”.
Who's affected: Anyone using a Windows PC or a Mac.
What to do: Tell staff a real website will never ask them to paste anything into Windows' Run box, Command Prompt or Terminal. If anyone has, disconnect that computer and call your IT support.
Sources: Microsoft Threat Intelligence · The Register
Names, addresses and contact details of all Co-op members were taken in the April 2025 attack (no financial data, Co-op said). Stolen details like these make scam emails, texts and calls more convincing.
Who's affected: Co-op members, which may include you and your staff.
What to do: Be wary of messages that use your name and address to seem genuine, especially ones asking for payment or bank details. Contact Co-op through its official website rather than replying.
Sources: BleepingComputer · The Register
A serious flaw in Citrix NetScaler, a gateway that lets staff connect from outside the office, let attackers steal login sessions without a password. It was actively exploited, and more NetScaler flaws followed in March 2026.
Who's affected: Businesses using Citrix NetScaler ADC or Gateway, or whose IT provider runs one for them.
What to do: Ask your IT provider to confirm any NetScaler is on the latest version, and to sign everyone out after updating so stolen sessions stop working.
Sources: BleepingComputer · NCSC
Scammers stick their own QR codes on parking machines and signs. The codes open fake payment websites that steal card details. Councils across the UK, including in Wales, have issued warnings.
Who's affected: Anyone who pays for parking, including staff claiming parking as an expense.
What to do: Pay with the official parking app you already have, by phone, or at the machine. Don't scan a QR code stuck onto a sign, and report suspicious stickers to the council.
Sources: Hartlepool Borough Council · Which?
Attackers posed as staff and phoned IT help desks to get passwords and two-step login codes reset, which got them into Marks & Spencer's and the Co-op's systems and caused weeks of disruption. The NCSC told every organisation to check how it confirms who's asking before a reset.
Who's affected: Any business where staff, or an outside IT provider, can reset passwords by phone, email or chat.
What to do: Agree a firm identity check before any password or login reset, such as calling back on a number you already hold, and turn on two-step login for every account, especially admin accounts.
Think something's already happened? Read what to do in the first hour after a cyber attack.
Our everyday IT support includes security updates, monitoring and a person to call when something looks wrong. Book a free 30-minute chat.
Badger HQ
Turn on two-step verification for your email today. It stops most stolen passwords being any use to criminals.
Quick answers
From £45 per user per month, and less for bigger teams: 1–9 users £45, 10–49 users £40, 50–149 users £35. No VAT to add. More →
A fixed-price review of your licences, contracts, tools and security, with an itemised list of savings. If we don't find £500+ a year of savings, you get your money back (for organisations with 10+ staff). More →
Yes. New businesses can start with a starter site: £50 setup, then £30 a month. Bigger sites get a fixed quote after a free chat. More →
Senior IT leadership a few days a month: strategy, budgets, suppliers and board reporting, without a full-time salary. £650 a day. More →
We're based in Monmouth and work across Monmouthshire, South Wales, the South West and the Midlands, on site or remotely, and remotely UK-wide. More →
