A Next-Level AI Cyber War Has Started: What UK Businesses Must Do Right Now
PHP2Shell, WordPress exploits and hacked supermarket fridges show UK businesses are on the cyber front line. Here’s how to lock down your network, PCs and data.
On 21 October 2026, websites belonging to UK councils, the Metropolitan Police and dozens of government services went dark within hours of each other. They hadn't been hacked. Their own operators had switched them off, on the advice of the National Cyber Security Centre (NCSC), because details of two critical flaws in PHP, the software behind most of the web, had leaked before the fix was out.
A month earlier, attackers were breaking into WordPress sites within hours of a security patch being released, and last week they were attacking another new core flaw within hours of its fix. Barely a week before PHP2Shell, hackers pushed the fridges and freezers in hundreds of French supermarkets up to 50°C overnight. On 2 November, a second wave hit supermarkets in seven European countries. The next morning, the head of the NCSC confirmed that UK organisations had been caught up, and warned that the UK faces a real risk of a sharp rise in cyber incidents in the months ahead.
We have worked in IT and cyber security for more than 20 years, and we don't use the word lightly: this is a cyber war. It is being fought at machine speed, AI is making it cheaper to wage, and every connected business and household in the UK is inside the blast radius. Here is what has changed, and what you need to do about it now.
NCSC warns the UK faces an unprecedented rise in cyber incidents
On 3 November 2026, the NCSC, part of GCHQ, published its annual review, State of the Cyber Nation. Its chief executive, Dr Richard Horne, warned of "a real prospect of an unprecedented rise in the number of cyber incidents" in the months ahead. His point was not that AI has invented new kinds of attack. It is that weaknesses organisations have tolerated for years can now be discovered and exploited at a scale that used to be impossible.
The same morning, Dr Horne confirmed that the latest wave of supermarket fridge attacks had reached the UK. The NCSC had spent the night alerting UK organisations running exposed, vulnerable technology, and knew of a couple of incidents where that technology had been exploited. He said it was too early to tell whether states or criminals were responsible, and warned that too many organisations have kept systems running past their end of life without upgrading them, leaving weaknesses that AI now helps attackers find with ease.
The review judges it highly likely that AI-powered malware will be used in a ransomware attack on the UK's critical national infrastructure by 2028, and that hostile states will by then be using AI-enabled cyber operations as a matter of routine. UK businesses are being breached right now: the government's Cyber Security Breaches Survey, published in April, found that 43% of UK businesses, around 612,000 firms, identified a breach or attack in the previous 12 months, rising to 69% of large businesses. In October alone, ASOS and TFG London, the owner of Phase Eight, Hobbs and Whistles, both confirmed attacks in which customers' personal data was accessed. The NCSC review cites government research putting the cost of malicious cyber activity to UK organisations at an estimated £14.7 billion a year.
The infrastructure itself is now a military target, too. In March, Iranian drone strikes damaged Amazon Web Services data centres in the UAE and Bahrain, and data centres have been hit on both sides of the war between Russia and Ukraine. When we call this a cyber war, we mean it literally.
PHP2Shell: the flaw that took UK council and police websites offline
PHP2Shell is the nickname for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and each rated 9.2 out of 10. PHP is the server-side language behind roughly 70% of websites, including every site built on WordPress, Drupal, Joomla and Magento. Both flaws can let an attacker run their own code on a web server without logging in.
The flaws were found in August with the help of AI-assisted code analysis. When details leaked online ahead of the planned disclosure, PHP brought its fix forward and released patched versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35) on 21 October. Amazon's threat intelligence team had already recorded an exploitation attempt four days earlier. It is exactly the kind of long-tolerated weakness the NCSC is warning about: a flaw affecting PHP versions going back more than a decade, found with AI help and under attack within days.
The NCSC told UK organisations to patch immediately or consider taking affected systems offline, and many did. Ministers reported 32 government services unavailable and four more partly disrupted. The Office for Budget Responsibility went offline with the Budget a week away, and council websites in Edinburgh, Oxford, Bristol, Lambeth and Barnet were among those affected. Government sites in Germany, France, Belgium, Finland and the Netherlands were pulled as a precaution too. Two days later, PHP disclosed a third, configuration-dependent flaw (CVE-2026-115560).
WordPress core and plugin attacks now begin within hours of a patch
PHP2Shell is not an isolated case. WordPress core security releases are now arriving every few weeks: 7.1.1 on 17 September with 11 security fixes, 7.1.2 on 22 September, 7.1.3 on 6 October and 7.1.4 on 28 October. The 7.1.2 release fixed CVE-2026-87902, a critical flaw rated 9.2 that can lead to remote code execution without a login. Security firm Patchstack saw the first exploitation attempts within hours of disclosure and confirmed sites being compromised by the following day, and on 25 September the US cyber agency CISA added it to its catalogue of vulnerabilities known to be exploited in the wild.
WordPress 7.1.4 fixed 22 vulnerabilities, including CVE-2026-119977, a race condition in the core updater that can let an attacker with no account run code on the server while an update is installing. Wordfence rates it 8.1 out of 10. Its firewall rule caught the first attack attempt nine minutes after going live, and it blocked almost 63,000 attacks aimed at the flaw in a single day. No successful break-ins had been reported at the time of writing, but attackers clearly aren't waiting.
Plugins are just as exposed, and the critical flaws keep coming. In August, a flaw in Elementor Pro (CVE-2026-32475), a page builder with more than six million active installations, let attackers with no account upload malicious PHP files; Wordfence blocked more than 190,000 exploit attempts in the four days after the patch. Since 7 October, attackers have been exploiting a maximum-severity 10.0 flaw in the Bricksforge plugin (CVE-2026-85097) to upload and run PHP code without logging in. And on 3 November alone, new critical plugin flaws were published, including a 9.8-rated bug in Advanced Custom Fields: Extended PRO (CVE-2026-120534) that lets unauthenticated attackers call WordPress functions, and a 9.1-rated file deletion flaw in BuddyPress XProfile Image Field (CVE-2026-120518).
The lesson is simple. The gap between a fix being published and criminals using it has shrunk from weeks to hours. WordPress installs minor core updates automatically by default, but plugin auto-updates stay off unless someone switches them on, and background updates don't always complete, so someone needs to check. A website that gets updated whenever someone remembers is a website waiting to be taken, and your reputation, your customer data and your search rankings go with it.
Supermarket freezers hacked twice in a month, and the UK is in the firing line
In October, attackers got into the internet-connected refrigeration controllers at hundreds of supermarkets across France, including Carrefour, Monoprix, Intermarché and Coopérative U stores. Overnight, while the shops were shut, they pushed fridge and freezer temperatures as high as 50°C. Tonnes of food had to be thrown away and several stores reported fires. France's national cyber security agency, ANSSI, said the systems were made by Danish manufacturer Danfoss, and retailers in Spain, Portugal, Poland, Germany and Belgium were also affected.
Then, overnight on 1 to 2 November, it happened again. Supermarkets in seven countries (Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden) found their freezers had been remotely switched into defrost and driven as high as 50°C. Delhaize and Colruyt in Belgium, ICA and Coop in Sweden and SuperValu in Ireland were among those hit. Sources in several countries again pointed to Danfoss control systems, and Sweden's national cyber security chief said that after the French attack it had emerged that several units had very simple passwords and no multi-factor authentication.
The UK is not a bystander. Analysis by UK Cyber Defence for The Grocer found the login pages of more than 800 UK retail fridge control systems reachable from the open internet. And as the NCSC confirmed on 3 November, a couple of UK organisations have already had vulnerable technology exploited in this campaign.
None of this needed a nation-state budget. Researchers had published details of login-bypass flaws in the same family of controllers in August, exposed units could be found with simple internet scans, and weak passwords did the rest. Every connected device in your building is part of your attack surface: the heating controls, the door entry system, the smart TV in reception and the printer in the corner. If it is online, unpatched or protected by a weak password, someone will eventually find it.
How to lock down your business against today's cyber threats
None of what follows is exotic. The NCSC's own review found that most successful attacks still exploit familiar weaknesses: known vulnerabilities, poorly secured systems and stolen credentials. Fix those properly and professionally, and you take your business out of the easy-target pile.
Replace ISP routers and over-complex firewalls with a professional gateway
The router your broadband provider sent you was built to get you online cheaply, not to defend a business. It is rarely set up with business security in mind, and you usually have little control over what it runs or when it gets updated. Get rid of it and put a proper firewall in front of your network.
Expensive doesn't automatically mean safe, though. In January, attackers exploited a critical FortiCloud single sign-on flaw (CVE-2026-24858, rated 9.4) to create administrator accounts on fully patched Fortinet firewalls. In June, a campaign dubbed FortiBleed exposed working administrator logins for between roughly 74,000 and 87,000 internet-facing FortiGate firewalls worldwide, and around 63% of the compromised accounts were default or generic admin accounts that had never been renamed. Juniper has patched critical flaws this year too, including a 9.8-rated bug in its PTX routers in February and a batch of critical Junos OS flaws in October.
That FortiBleed detail is the real story. Enterprise firewalls are powerful but complex, and complexity is where the holes creep in. In our experience, many are installed by IT teams without the time or specialist knowledge to harden them, which leaves them weaker than the price tag suggests. For most small and mid-sized businesses, a professionally installed UniFi gateway gives you a modern firewall that is far simpler to configure correctly, segment into separate networks and keep updated from a single console. No vendor is immune, and Ubiquiti ships security updates like everyone else; the difference is how easy the kit is to keep right. As specialist UniFi installers, our network installation team does exactly this.
Turn on DNS protection
Most phishing links, malware downloads and ransomware call-backs start with a DNS lookup: your device asking where a website lives. DNS filtering checks those lookups and blocks known malicious and suspicious sites before they load, wherever your staff are working. ThreatDown DNS Filtering runs from the same console as its endpoint protection and encrypts DNS queries using DNS over HTTPS, so they are much harder to intercept or redirect. It is one of the cheapest, highest-impact controls you can add.
Keep cloud data with a major provider, and keep your own versioned backup
Keep your business data with a major provider such as Microsoft 365 or Google Workspace. They invest far more in security and resilience than any small business could. If you are still running on an ageing local server or a patchwork of consumer accounts, we can migrate you to Microsoft 365. But keeping the service running is the provider's job. Keeping a recoverable history of your data is yours.
This year showed why that matters. After the March drone strikes, AWS confirmed in September that some customer data held only in the damaged UAE and Bahrain facilities could not be recovered. Customers with backups elsewhere got back up and running; customers without them lost that data for good. Ransomware, a compromised admin account or an accidental mass deletion can do the same damage to your cloud data without a single drone being launched.
The answer is a true local backup with versioning. A UniFi UNAS on your own network can pull a versioned copy of your Microsoft 365 data out of the cloud and keep scheduled snapshots, so if files are encrypted or deleted you can roll back to a clean point in time. Add a second copy off-site, test your restores regularly, and you have a backup you can genuinely rely on. If the worst has already happened, our data recovery team can help.
Run professional-grade anti-malware on every device
Free and consumer antivirus is not enough for a business. Professional-grade protection such as ThreatDown gives you centrally managed malware, ransomware and exploit protection across every device, with alerts that reach someone who can act on them.
Fight AI with AI: add PCArmour Pro to every PC
Attackers are already using AI to find weaknesses faster than any human team can patch them. The NCSC's latest review expects a widening divide between organisations that use AI in their defences and those that can't adapt, and describes defenders as being in a race to cut the time it takes to patch. The government is investing in AI for its own cyber defence too, including a national Cyber Shield. You can't win that race with a technician checking PCs one at a time.
Around that AI analysis, PCArmour Pro automates the defences that now have to run at machine speed:
- Nightly vulnerability checks. Every PC's Windows build and installed programs are compared each night with Microsoft's security updates, the US National Vulnerability Database and CISA's list of actively exploited flaws, with the ones attackers are using shown first.
- Patching on your schedule. Windows and program updates install in the hours you choose, so known holes close quickly instead of sitting open for weeks.
- Ransomware watch. Hidden decoy files catch encryption as it starts. The process is frozen and the PC is cut off the network before the damage spreads.
- Same-day threat hunts. When a new attack is published, paste its indicators and every PC searches for them, so you know the same day whether you're affected.
- Scam blocking. The remote-access tools phone scammers persuade victims to install are blocked, with a warning on screen.
PCArmour Pro runs alongside ThreatDown, not instead of it. ThreatDown handles malware protection, while PCArmour Pro finds and closes the gaps that attackers' AI is hunting for, every night, on every PC.
Patch everything, and strip out what you don't need
Every PC should be fully updated on a schedule, with no exceptions for the machine in the back office that "just works". Then remove anything that isn't business-critical: old utilities, trial software, toolbars, duplicate PDF readers and manufacturer bloat. Every program you remove is one less thing that can carry a CVE, one less update to miss, and a faster machine for your staff.
Keep old and untrusted devices off your business network
Old kit is one of the easiest ways in. Be strict about what is allowed to connect:
- Old IoT gadgets and smart devices that no longer receive firmware updates.
- Android phones and tablets past their manufacturer's security update period, and iPhones or iPads stuck on old iOS and iPadOS versions.
- Smart TVs and, above all, cheap off-brand Android TV boxes. Google has said the BadBox 2.0 botnet infected more than 10 million uncertified Android devices, mostly TV boxes, tablets and projectors, and in July 2026 it disrupted a proxy network spread across at least two million home devices, including smart TVs.
- Printers that have reached end of support and no longer get security fixes.
Watch out for old stock too. A device you bought new a year ago may have sat in a warehouse for a long time beforehand, already on outdated firmware and with its support period ticking down. Since April 2024, UK law has required makers of consumer connectable products to state how long they will provide security updates, so check that date before you buy. Anything that must stay connected should live on its own segregated network, never alongside your PCs and servers.
Treat CCTV and connected alarm systems as high-risk
CCTV systems and older connected alarms sit on your network, often with internet access, and are rarely updated by their owners. That makes them an extreme risk, particularly kit from suppliers you can't fully trust. Hikvision fixed a critical camera flaw (CVE-2021-36260) in September 2021, yet almost a year later researchers found around 80,000 internet-facing Hikvision devices still unpatched, including in the UK, while a Mirai-based botnet was using the flaw to take over cameras.
Trust in the supplier matters as well. In November 2022, the UK government stopped departments installing Chinese-made surveillance cameras on sensitive sites, over concerns that companies subject to China's National Intelligence Law could be required to share data. Hikvision denies that its products pose a security threat, but for a business the safer course is clear: choose cameras and alarms from trusted manufacturers with a long, published security update commitment, keep them off the open internet, and isolate them on their own network. Our CCTV installation team can replace or ring-fence older systems.
Fix passwords, two-factor and Wi-Fi today
Stolen and guessed passwords remain one of the most common ways in, for businesses and individuals alike. In April 2026 the NCSC changed its advice: passkeys should now be your first choice wherever a service supports them, with a password manager and two-step verification everywhere else.
Stop treating cyber security and backups as optional
This is the part people still aren't getting. Attackers don't pick their targets by name. They scan the whole internet for anything vulnerable, and AI is making that faster and cheaper every month. Your defences need to be just as fast, which is why we built AI into PCArmour Pro. If you are connected, you are a target, whether you are a large company, a family business in Kent or a household with a smart TV.
The NCSC's message to business leaders matches ours: stop under-investing in technology, stop connecting things that don't need to be online, and treat Cyber Essentials as the starting point rather than the finish line. Doing cyber security and backups badly, or not at all, is no longer a cost saving. It is a gamble with your data, your money and your reputation.
Stop messing around with cyber defence and get a professional team to lock down your business and cloud operation. At IT Pro Expert, our cyber security engineers have been doing exactly that for more than 20 years, and contract customers deal directly with a senior engineer, not a call centre.
Is your business properly locked down?
Tell us what you run, and we'll show you where the gaps are and how to close them.