PHP2Shell, Fortinet Updates and When Your Backup Service Goes Offline A critical PHP vulnerability prompted emergency fixes and a wave of opportunistic sales pitches. Meanwhile, Fortinet announced urgent security updates across multiple products, ConnectWise Cloud Backup users faced service interruption during an incident response, and the Ahsay backup story required revisiting after further patches. Noel Bradford and Lucy Harper examine what business owners should ask when headlines break, when unsolicited rescue offers arrive, and when the service they depend on for recovery becomes unavailable. The episode defends honest questions about unfamiliar technology, challenges vendors charging premium prices to demonstrate their security record, and separates patching status from incident investigation. Practical guidance covers checking PHP exposure without guessing from website appearance, understanding the difference between automated updates and engineer-led maintenance windows, reviewing application credentials alongside human accounts, and planning recovery scenarios when normal backup routes are closed. No marketing exaggeration, no sneering at gaps in knowledge, just the evidence-based conversation that helps small businesses make sound decisions under pressure. Chapters Cold Open A serious PHP vulnerability hits the news. Websites go offline. Business owners ask whether they are affected. Parts of the security industry respond by mocking someone for admitting what he did not know, while Noel’s inbox fills with offers to save websites from a threat many senders have not properly diagnosed. Welcome Noel Bradford and Lucy Harper introduce the episode and its sponsor, GRCBolt. The agenda covers PHP2Shell, Fortinet updates, the Ahsay backup story revisited, and ConnectWise Cloud Backup service interruption. The common thread: what can a provider actually show you when they say they are protecting your business? PHP Has Entered the Chat PHP is a programming language used to run websites and web applications. Two critical vulnerabilities prompted emergency fixes on 21 October. Lucy and Noel explain the difference between affected software, exploitation attempts and confirmed compromise, and what business owners should ask their providers about patching, verification and responsibility. The Crime of Saying I Did Not Know BBC cyber correspondent Joe Tidy attracted ridicule after saying he had not known about PHP before the story broke. Noel defends honest questions and criticises the sneering pile-on, arguing that mocking gaps in knowledge undermines the security culture we claim to want and discourages the early reporting businesses need. Emergency Expertise Next Day Delivery Noel describes his inbox filling with urgent PHP2Shell warnings and rescue offers, many diagnosing technology his websites do not use. He contrasts engineers doing the actual work with noise merchants creating confusion, and explains how to handle unsolicited warnings without turning a mailing list into a purchase order. Premium Prices Familiar Questions Fortinet announced urgent security updates across several products, including FortiOS, FortiManager and FortiAnalyzer, citing AI-assisted testing that found critical and high severity vulnerabilities. Noel argues that premium pricing creates expectations the engineering record has not consistently met, citing historical examples of hardcoded credentials and questioning what the vendor has learned. Who Pays for the Maintenance Window Lucy clarifies that a current standalone FortiGate can automate routine patch upgrades when the feature is available and enabled, while Noel emphasises that legitimate maintenance work belongs in the price comparison. The discussion covers upgrade workload variation, the difference between marketing diagrams and rehearsal, and the importance of verifying success after scheduled updates. GRCBolt Sponsor Message A done-for-you policy service for small businesses that need to get governance, risk and compliance organised without breaking the bank. GRCBolt creates a tailored policy pack from information about your business, providing a practical starting point for documenting how your company works and who takes responsibility. Ahsay The Promise We Need to Keep Huntress reported attackers exploiting two Ahsay CBS vulnerabilities together from 7 October, bypassing authentication and gaining code execution. The patch position changed, with version 10.3.4 remaining vulnerable despite earlier reporting. Ahsay released further hotfixes on 12 October. The discussion distinguishes patching from incident investigation and emphasises that recovery plans must consider the backup management system being unavailable or untrusted. ConnectWise The Service You Need to Recover ConnectWise Cloud Backup service interruption followed unauthorised access to application credentials. The 23 October update said existing archives remain encrypted, isolated and preserved, with no indication of compromise, but containment interrupted backups and restores. The discussion examines the business problem when stored copies exist but normal recovery routes are unavailable, and the need for contingency planning before interruption. The Application Already Has Access Application credentials enable services to authenticate without someone sitting at a keyboard approving every operation. Backup software must access the information it copies. Lucy and Noel explain that checking employee MFA does not tell you everything about application connections, and that disabling a compromised connection does not necessarily reverse changes already made through it. Tomorrow Morning Ask for Evidence Practical guidance for business owners. Book a short conversation with the people looking after your website, security equipment and backups. Ask whether you are affected, what supports that conclusion, and how you would recover one critical thing if the normal backup management service was unavailable. Record the basis, the date and any gaps. Closing A real security problem reached people who had never heard of the technology behind it. An industry sometimes more interested in demonstrating expertise than being useful. People asking honest questions deserve better. People paying for protection deserve evidence. The closing question: if I needed the protection I am paying for today, could you demonstrate that it works? Links https://ubuntu.com/security/notices/USN-7080-1 https://www.huntress.com/blog/threat-advisory-ahsay-backup-software-actively-exploited-cve-2024-8796-cve-2024-8800 https://www.connectwise.com/resources/connectwise-cloud-backup-security-update
