entrustIT Insights | Cyber Security

What is technical security debt?

In short: Technical security debt is the security risk a business builds up when IT fixes, upgrades and clean-ups get put off. Unpatched software, unsupported kit, old accounts and quick workarounds all add to it. Like financial debt, it gathers interest: the longer it's left, the more it costs to fix and the easier it is for attackers to exploit.

AI is finding security flaws faster: do you know what you run?

AI tools helped find the critical PHP vulnerabilities, and the NCSC says AI is making it easier to find and exploit software flaws at scale. For UK businesses, that points to one thing: less time to react to security updates. The best preparation is a clear picture of what you run and who looks after it, before the next alert lands.

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

Last updated 29th October 2026 Latest, 29 October: the US cyber security agency CISA has confirmed PHP2Shell is being exploited and added both flaws to its list of known exploited vulnerabilities. The first successful attacks have also been reported. If you haven't updated PHP yet, do it now. Two linked PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could let an attacker run commands on a web server without logging in. The security industry is calling them PHP2Shell. Both are rated critical, and they are now being actively exploited. PHP released fixed versions on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your PHP is older than these, it's vulnerable. PHP 8.1 and earlier won't get an official fix. Our advice is simple. Find out where PHP runs in your business, starting with anything that faces the internet, and update it to a fixed version as soon as you can.

What is social engineering, and what stops it working on your staff?

Social engineering is when an attacker persuades a member of staff to hand over access or money by exploiting trust, fear or urgency, instead of breaking into a system. Phishing, spear phishing and AI voice cloning are all forms of it.

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

Cyber Essentials Plus covers the same five controls as Cyber Essentials. The difference is that an independent assessor tests your live systems to verify the controls actually work. This gives stronger assurance to clients, insurers and partners.

What is Cyber Essentials, and does your business need it?

Cyber Essentials is a UK government-backed certification that shows your business has the basic controls in place to defend against the most common cyber attacks.

What is a passkey, and should your business ditch passwords?

A passkey is a passwordless login that replaces your password with your device's fingerprint, face or PIN, making sign-in both simpler and far harder to hack. Instead of typing something you can forget, reuse or have stolen, you prove who you are with the device already in your hand. For businesses tired of password resets and phishing scares, that's a genuinely different way of working, and it's arriving faster than most people realise.

Cyber security isn't something you buy. It's something you run.

Most businesses are asking the wrong question about their cyber security.

EDR vs XDR vs MDR: what they actually do?

Good security isn't just about the tools you own. It's about whether anyone is actually watching them. Once you accept that, the next question is what to do about it, and that's where it gets confusing, because the answer arrives wrapped in acronyms. EDR. XDR. MDR. Three letters that sound almost identical and seem to promise the same thing.

5 questions to ask your IT provider about security monitoring

Most businesses have spent real money on security. Firewalls, antivirus, email filtering, multi-factor logins: the defences are there, doing the job of keeping threats out. But one layer rarely shows up on the invoice and matters more than any of them: the layer that watches for threats already inside, and the person who acts when the alarm sounds. That layer is security monitoring, and it's the part most often missing.

What is technical security debt?

In short: Technical security debt is the security risk a business builds up when IT fixes, upgrades..

AI is finding security flaws faster: do you know what you run?

AI tools helped find the critical PHP vulnerabilities, and the NCSC says AI is making it easier to..

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

Last updated 29th October 2026 Latest, 29 October: the US cyber security agency CISA has confirmed..

What is social engineering, and what stops it working on your staff?

Social engineering is when an attacker persuades a member of staff to hand over access or money by..

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

Cyber Essentials Plus covers the same five controls as Cyber Essentials. The difference is that an..

What is Cyber Essentials, and does your business need it?

Cyber Essentials is a UK government-backed certification that shows your business has the basic..

What is a passkey, and should your business ditch passwords?

A passkey is a passwordless login that replaces your password with your device's fingerprint, face..

Cyber security isn't something you buy. It's something you run.

Most businesses are asking the wrong question about their cyber security.

EDR vs XDR vs MDR: what they actually do?

Good security isn't just about the tools you own. It's about whether anyone is actually watching..

5 questions to ask your IT provider about security monitoring

Most businesses have spent real money on security. Firewalls, antivirus, email filtering,..

What is technical security debt?

AI is finding security flaws faster: do you know what you run?

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

What is social engineering, and what stops it working on your staff?

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

What is Cyber Essentials, and does your business need it?

What is a passkey, and should your business ditch passwords?

Cyber security isn't something you buy. It's something you run.

EDR vs XDR vs MDR: what they actually do?

5 questions to ask your IT provider about security monitoring

Recent Posts

Posts by tag

What is technical security debt?

AI is finding security flaws faster: do you know what you run?

Critical PHP vulnerability (PHP2Shell): what UK businesses need to do now

What is social engineering, and what stops it working on your staff?

What is Cyber Essentials Plus, and do you need to upgrade from Cyber Essentials?

What is Cyber Essentials, and does your business need it?

What is a passkey, and should your business ditch passwords?

Cyber security isn't something you buy. It's something you run.

EDR vs XDR vs MDR: what they actually do?

5 questions to ask your IT provider about security monitoring

Subscribe here!

Recent Posts

Posts by tag