# Expert views: is Black October a turning point for cyber risk? A critical PHP flaw made this a loud week, so it helps to separate the noise from the longer trend. The Assurance Desk, news. Published 23 October 2026. On 21 October 2026 the NCSC asked UK organisations to take immediate action on a critical PHP flaw. Ciaran Martin and Joe Tidy reacted on Bluesky. Martin said the media and politicians are paying attention, and Tidy said the warnings themselves were unusual ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), [Ciaran Martin on Bluesky](https://bsky.app/profile/ciaranm.bsky.social/post/3myi3nqqrtk24) and [Joe Tidy on Bluesky](https://bsky.app/profile/joetidy.bsky.social/post/3myfc5hqsb22y), checked 23 October 2026). ## Ciaran Martin: more attention, a normal tempo Ciaran Martin compares this PHP flaw with an earlier one, and says the difference is that the media and politicians are paying attention. That is Martin's view of the coverage, not a measure of the harm ([Ciaran Martin on Bluesky](https://bsky.app/profile/ciaranm.bsky.social/post/3myi3nqqrtk24), checked 23 October 2026). A few days before the PHP alert, Ciaran Martin wrote on LinkedIn about the attacks then in the news. Martin called their number a normal figure, and wrote that the tempo of high profile cyber attacks is nothing out of the ordinary. Martin credits the points to Marcus Hutchins ([Ciaran Martin on LinkedIn](https://www.linkedin.com/posts/cyberciaran_really-important-set-of-points-here-from-activity-7517499629450469376-QwYr), checked 23 October 2026). Martin agrees that things are changing. But Martin writes that the idea of a major turning point, based on a handful of incidents, is not the case ([Ciaran Martin on LinkedIn](https://www.linkedin.com/posts/cyberciaran_really-important-set-of-points-here-from-activity-7517499629450469376-QwYr), checked 23 October 2026). > "PHP2Shell summary: it’s log4shell again but the media and politicians are paying attention" > Ciaran Martin, Bluesky post excerpt > Ciaran Martin on Bluesky, @ciaranm.bsky.social on Bluesky, https://bsky.app/profile/ciaranm.bsky.social/post/3myi3nqqrtk24 (checked 23 October 2026) > ![Ciaran Martin, Bluesky profile photo](https://theassurancedesk.com/images/editorial/ciaran-martin-bluesky.jpg) > Portrait source: https://bsky.app/profile/ciaranm.bsky.social ## Joe Tidy: the warnings themselves were unusual Joe Tidy wrote on Bluesky that the PHP issue could be an internet melter or a nothing burger. Tidy shared the warnings just in case ([Joe Tidy on Bluesky](https://bsky.app/profile/joetidy.bsky.social/post/3myfc5hqsb22y), checked 23 October 2026). Joe Tidy said it was unusual to see all the cyber authorities saying patch or take offline. Tidy asked whether that was a first ([Joe Tidy on Bluesky](https://bsky.app/profile/joetidy.bsky.social/post/3myfc5hqsb22y), checked 23 October 2026). > "Pretty crazy and unusual to see all the cyber authorities saying 'patch or take offline'. Is that a first?" > Joe Tidy, Bluesky post excerpt > Joe Tidy on Bluesky, @joetidy.bsky.social on Bluesky, https://bsky.app/profile/joetidy.bsky.social/post/3myfc5hqsb22y (checked 23 October 2026) ## The NCSC's figures show a longer rise in serious attacks One loud week is not a trend, but the NCSC's yearly figures are. It handled 204 nationally significant cyber attacks against the UK in the 12 months to August 2025, up from 89 the year before. That is an average of four every week ([NCSC, UK experiencing four 'nationally significant' cyber attacks every week](https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly), checked 23 October 2026). The total number of incidents it handled stayed similar, at 429. What rose was the share that was serious. The NCSC links part of the rise to a small number of attackers exploiting software flaws ([NCSC, NCSC Annual Review 2025, Chapter 01: Countering the cyber threat, Incident management](https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management), checked 23 October 2026). The NCSC also says its data does not show every UK incident, because many businesses choose not to report ([NCSC, NCSC Annual Review 2025, Chapter 01: Countering the cyber threat, Incident management](https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management), checked 23 October 2026). **Nationally significant incidents handled by the NCSC** Unit: incidents - 2022 to 2023: 62 - 2023 to 2024: 89 - 2024 to 2025: 204 The incidents the NCSC rates nationally significant, September to August each year. The NCSC says its figures do not show every UK incident. Source: NCSC, NCSC Annual Review 2025, Chapter 01: Countering the cyber threat, Incident management, https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management (checked 23 October 2026) ## What firms and people can do this week For a firm, the NCSC's PHP advice is the starting point. Find every system that runs PHP, starting with those that face the internet. Where the temporary fixes cannot go on quickly, consider taking the system offline until it is fixed ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 23 October 2026). Many firms rely on suppliers for their websites and software. The NCSC asks organisations to watch for updates from those suppliers too. A firm that cannot check a system for signs of attack can get help from an NCSC-assured Cyber Incident Response provider ([NCSC, Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), checked 23 October 2026). For each person, the NCSC's top tips for staying secure online still apply ([NCSC, Top tips for staying secure online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online), checked 23 October 2026). **The NCSC's top tips for staying secure online** - Protect your email with a strong and separate password - Install the latest software and app updates - Turn on 2-step verification - Use a password manager to create and remember passwords - Back up your most important data - Use three random words to make a password hard to crack The NCSC's general advice for individuals and families. It is not advice for one system. Source: NCSC, Top tips for staying secure online, https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online (checked 23 October 2026) ## Deana Burke's list for non-developers matches most NCSC tips On Instagram, Deana Burke posted a list of things people can do as non-developers. Deana Burke's list is a personal view, not official guidance ([Deana Burke on Instagram](https://www.instagram.com/reel/De0BdJLBjvg/), checked 23 October 2026). Much of Deana Burke's list matches the NCSC's tips: 2-step verification, software updates and a password manager ([Deana Burke on Instagram](https://www.instagram.com/reel/De0BdJLBjvg/) and [NCSC, Top tips for staying secure online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online), checked 23 October 2026). Deana Burke goes further than the NCSC's 2-step verification tip. Burke prefers an authenticator app or a passkey to text message codes where possible ([Deana Burke on Instagram](https://www.instagram.com/reel/De0BdJLBjvg/) and [NCSC, Top tips for staying secure online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online), checked 23 October 2026). Deana Burke also adds a step the NCSC's top tips page does not list. Ask your phone carrier for a port-out PIN or number lock, to stop SIM swapping ([Deana Burke on Instagram](https://www.instagram.com/reel/De0BdJLBjvg/), checked 23 October 2026). The NCSC's tips add one step that Burke's list leaves out: back up your most important data ([NCSC, Top tips for staying secure online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online), checked 23 October 2026). **Deana Burke's list beside the NCSC's top tips** - **Deana Burke on Instagram** - Two-factor authentication for everything, by app or passkey - A port-out PIN or number lock from your phone carrier - Automatic updates for phone, laptop and browser - A password manager, and no reused passwords - **NCSC top tips** - Turn on 2-step verification - Install the latest software and app updates - Use a password manager - A strong and separate password for your email - Back up your most important data Burke's list is one person's view for non-developers. The NCSC's tips are its general advice for individuals and families. Source: Deana Burke on Instagram, https://www.instagram.com/reel/De0BdJLBjvg/ (checked 23 October 2026); NCSC, Top tips for staying secure online, https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online (checked 23 October 2026) > "Call your phone carrier and ask for a port-out PIN or number lock. It stops people from hijacking your number (SIM swapping my NIGHTMARE)." > Deana Burke, Instagram reel caption > Deana Burke on Instagram, https://www.instagram.com/reel/De0BdJLBjvg/ (checked 23 October 2026) ## What to watch next For most readers, the useful signal is the regulator's advice, not the volume of posts. The NCSC's view is that the best defence is to make your organisation as hard a target as possible. For sole traders and small organisations, its Cyber Action Toolkit covers the basic measures ([NCSC, UK experiencing four 'nationally significant' cyber attacks every week](https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly), checked 23 October 2026). ## Read next - [Cyber security: the section](https://theassurancedesk.com/cyber-security) - [Who patches your website: you, your web agency or your host?](https://theassurancedesk.com/guides/who-patches-your-website) - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check) - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour) - [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident) ## Sources - NCSC, Critical security issue affecting PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (checked 23 October 2026) - Ciaran Martin on Bluesky: https://bsky.app/profile/ciaranm.bsky.social/post/3myi3nqqrtk24 (checked 23 October 2026) - Joe Tidy on Bluesky: https://bsky.app/profile/joetidy.bsky.social/post/3myfc5hqsb22y (checked 23 October 2026) - Ciaran Martin on LinkedIn: https://www.linkedin.com/posts/cyberciaran_really-important-set-of-points-here-from-activity-7517499629450469376-QwYr (checked 23 October 2026) - NCSC, UK experiencing four 'nationally significant' cyber attacks every week: https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly (checked 23 October 2026) - NCSC, NCSC Annual Review 2025, Chapter 01: Countering the cyber threat, Incident management: https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management (checked 23 October 2026) - NCSC, Top tips for staying secure online: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online (checked 23 October 2026) - Deana Burke on Instagram: https://www.instagram.com/reel/De0BdJLBjvg/ (checked 23 October 2026) This is an independent editorial guide, not legal advice. --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.