PHP2SHELL and Two Microsoft CVSS 10.0 Vulnerabilities
On 22 October 2026, three critical security events converged: two maximum-severity PHP vulnerabilities allowing unauthenticated remote code execution, and two separate Microsoft Azure flaws each scoring CVSS 10.0. For UK small businesses running WordPress, WooCommerce, or using Microsoft 365 and Azure services, these are not theoretical risks. They are immediate patch obligations with Cyber Essentials compliance timelines already running. This episode walks through the technical detail of CVE-2026-1096118 and CVE-2026-1096119 (the PHP2SHELL vulnerabilities), explains what unauthenticated remote code execution actually means for your website, and identifies which hosting configurations are at highest risk. It then covers the two Azure vulnerabilities (CVE-2026-83938 in Kubernetes Configuration Service and CVE-2026-97785 in Azure AD Application Proxy), clarifies why they matter even for small teams, and sets out the verification steps you need to take with your hosting provider and MSP. The episode closes with a supply chain warning drawn from recent French supermarket losses tied to unpatched refrigeration firmware, illustrating why third-party-managed systems require scheduled written patch confirmation. No exaggeration, no speculation, just the facts you need to act on today.
Chapters
- Intro
Two maximum-severity PHP vulnerabilities and two CVSS 10.0 Microsoft Azure flaws all published on the same day. For businesses running websites or using Microsoft cloud services, this episode is a to-do list. - PHP2SHELL: Your Website Is the Attack Vector
CVE-2026-1096118 and CVE-2026-1096119 allow unauthenticated remote code execution across multiple PHP configurations. The vulnerabilities affect WordPress, WooCommerce, and most CMSs used by UK small businesses. Patched versions are available, but verification with your hosting provider is essential. PHP 8.1 and earlier receive no security patches at all. - CTA
A request to follow, rate, review, and share the show with other small business owners and managers who need this information. - Microsoft’s Double CVSS 10.0
CVE-2026-83938 in Azure Kubernetes Configuration Service and CVE-2026-97785 in Azure AD Application Proxy both scored maximum severity. The vulnerabilities allow privilege escalation without authentication and affect remote access to Microsoft 365 and internal systems. Cyber Essentials requires patching within fourteen days; the clock is already running. - The Unpatched Fridge: A Supply Chain Warning
French supermarkets lost millions after attackers exploited unpatched refrigeration firmware managed by third parties. The principle applies to EPOS, CCTV, building access, and other third-party-managed systems in UK small businesses. Written patch confirmation on a schedule is required, not trust-based assumptions. - Outro
Patching is the most direct line between disclosed vulnerabilities and attacker access. Action for today: email your hosting provider to confirm the PHP version running on your infrastructure, referencing CVE-2026-1096118 and CVE-2026-1096119 by name.
Links
