Expert views: is Black October a turning point for cyber risk?

Ciaran Martin: more attention, a normal tempo

Ciaran Martin compares this PHP flaw with an earlier one, and says the difference is that the media and politicians are paying attention. That is Martin's view of the coverage, not a measure of the harm.

A few days before the PHP alert, Ciaran Martin wrote on LinkedIn about the attacks then in the news. Martin called their number a normal figure, and wrote that the tempo of high profile cyber attacks is nothing out of the ordinary. Martin credits the points to Marcus Hutchins.

Martin agrees that things are changing. But Martin writes that the idea of a major turning point, based on a handful of incidents, is not the case.

Joe Tidy: the warnings themselves were unusual

Joe Tidy wrote on Bluesky that the PHP issue could be an internet melter or a nothing burger. Tidy shared the warnings just in case.

Joe Tidy said it was unusual to see all the cyber authorities saying patch or take offline. Tidy asked whether that was a first.

The NCSC's figures show a longer rise in serious attacks

One loud week is not a trend, but the NCSC's yearly figures are. It handled 204 nationally significant cyber attacks against the UK in the 12 months to August 2025, up from 89 the year before. That is an average of four every week.

The total number of incidents it handled stayed similar, at 429. What rose was the share that was serious. The NCSC links part of the rise to a small number of attackers exploiting software flaws.

The NCSC also says its data does not show every UK incident, because many businesses choose not to report.

What firms and people can do this week

For a firm, the NCSC's PHP advice is the starting point. Find every system that runs PHP, starting with those that face the internet. Where the temporary fixes cannot go on quickly, consider taking the system offline until it is fixed.

Many firms rely on suppliers for their websites and software. The NCSC asks organisations to watch for updates from those suppliers too. A firm that cannot check a system for signs of attack can get help from an NCSC-assured Cyber Incident Response provider.

For each person, the NCSC's top tips for staying secure online still apply.

Deana Burke's list for non-developers matches most NCSC tips

On Instagram, Deana Burke posted a list of things people can do as non-developers. Deana Burke's list is a personal view, not official guidance.

Much of Deana Burke's list matches the NCSC's tips: 2-step verification, software updates and a password manager.

Deana Burke goes further than the NCSC's 2-step verification tip. Burke prefers an authenticator app or a passkey to text message codes where possible.

Deana Burke also adds a step the NCSC's top tips page does not list. Ask your phone carrier for a port-out PIN or number lock, to stop SIM swapping.

The NCSC's tips add one step that Burke's list leaves out: back up your most important data.

What to watch next

For most readers, the useful signal is the regulator's advice, not the volume of posts.

The NCSC's view is that the best defence is to make your organisation as hard a target as possible. For sole traders and small organisations, its Cyber Action Toolkit covers the basic measures.