AI Is Now Running the Cyberattack: What This Week's PHP2Shell Breach Means for UK Small Business
Two pieces of intelligence from the past 48 hours deserve careful attention. Not because they are dramatic, but because one of them signals a structural shift in how attacks are conducted, and the other is a straightforward critical vulnerability with a clean, actionable fix. Both matter to UK small businesses. The first requires a change in how you think about risk. The second requires a patch.
Let’s go through them in order of consequence.
PHP2Shell and the Arrival of AI-Assisted Post-Exploitation
On the 25th of October 2026, The Hacker News reported on an incident involving the exploitation of PHP2Shell vulnerabilities, tracked as CVE-2026-109618, at a European government entity. The technical details of the initial compromise are significant, but they are not the most important part of the story.
The most important part is what happened after the attackers got in.
According to the reporting, threat actors used agentic AI platforms to conduct post-exploitation activity. To translate that into plain language: once they were inside the network, they did not rely on a human operator to manually navigate systems, identify valuable data, and carry out exfiltration. They deployed AI agents to do that work autonomously.
The result, as reported, was that MFA secrets and password hashes were accessed and exfiltrated from the compromised government entity.
Take a moment with that. The attackers got past the perimeter, then handed control to an automated AI system that could explore the network, identify credentials and authentication material, and extract it, without needing a human to be actively directing operations at every step.
Why This Changes the Threat Calculation for Small Business
The conventional assumption in small business security has been that size offers a degree of protection. The thinking goes: attackers go after large targets because large targets have more valuable data and justify the effort. A 15-person firm is not worth a sophisticated, manually-operated intrusion campaign.
That assumption was already eroding. Automated scanning and commodity ransomware-as-a-service tools have been targeting small businesses indiscriminately for years. But agentic AI post-exploitation changes the equation further.
If the labour cost of operating inside a compromised network drops to near zero, because an AI agent is doing the navigation and extraction work, then the economics that previously made small businesses less attractive targets no longer apply in the same way. The effort of manually operating a breach was a limiting factor. That limiting factor is being removed.
This does not mean every small business is now under imminent threat from nation-state-grade AI tooling. The intelligence here relates to a government entity, and the capability demonstrated is at the sophisticated end of the threat landscape. But the trajectory is clear, and it has direct implications for how UK small businesses should prioritise their defences.
Specifically: if an AI agent is doing post-exploitation work autonomously, the things it will do first are the things most valuable and most accessible. Credential stores. MFA seed material. Password hashes. Active session tokens. The speed at which a breach escalates from “attacker has a foothold” to “attacker has your credentials and your MFA” is compressing.
The practical implication is that your window to detect and respond to an intrusion before significant damage occurs is getting shorter. Detection and response capability, not just perimeter defence, becomes more important.
CVE-2026-116207: The YesWiki SQL Injection You Need to Know About
The second item is more straightforward. On the 25th of October 2026, NIST’s National Vulnerability Database published CVE-2026-116207, a critical vulnerability in YesWiki with a CVSS score of 9.1.
YesWiki is an open-source wiki platform. It is used by charities, community organisations, small businesses, and local government bodies, often because it is free, flexible, and relatively easy to deploy. If your organisation runs a YesWiki instance, or if your website was built by someone who used YesWiki as a backend, this vulnerability is directly relevant.
The flaw exists in versions 4.6.0 before 4.7.0, and in 5.0.0-alpha1 before 5.0.0-alpha4. It is an unauthenticated SQL injection vulnerability in the SearchManager::prepareSearchRequest() function. The field names from query and searchfields parameters in the public Bazar entries search API are placed in a backtick-quoted alias and escaped only with mysqli_real_escape_string. An attacker can supply a backtick character to inject subqueries.
In practical terms: an attacker does not need to log in to your YesWiki instance. They do not need an account. They can query your database directly through the public search API, reading data such as user password hashes, or they can exhaust your database threads using SLEEP() commands, effectively taking your site offline.
This is a CVSS 9.1. No authentication required. Public-facing attack surface. If you are running an affected version, this is not a “patch it when convenient” situation.
The fix is straightforward: update to YesWiki 4.7.0 or 5.0.0-alpha4 or later. If you are not sure whether your organisation runs YesWiki, ask whoever manages your website. If that is an external agency or an MSP, ask them today and request written confirmation of the version in use.
The Collabora Online and Arista VeloCloud Context
One further item from the intelligence picture this week is worth noting for completeness. On the 24th of October 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalogue: one affecting Collabora Online’s Built-in CODE Server, and one affecting Arista VeloCloud Orchestrator. These are being actively exploited in the wild.
Collabora Online is an open-source office suite used by organisations as an alternative to Microsoft 365 or Google Workspace. If your business or your MSP has deployed a self-hosted Collabora Online environment, check with your provider that patching is in hand. Arista VeloCloud Orchestrator is an enterprise SD-WAN product; it is less likely to be in direct use at a small business, but it is commonly deployed by managed service providers and network infrastructure companies that serve SMBs. If your network connectivity or branch office infrastructure is managed by a third party, this is a reasonable question to raise.
The CISA KEV is not a theoretical list. Entries on it represent vulnerabilities that are confirmed to be under active exploitation. That is the standard of evidence.
How This Gives You an Edge
Being informed about the actual threat picture, not vendor marketing, not generic fear, gives you a concrete advantage in how you allocate your limited time and budget.
The PHP2Shell and AI post-exploitation story tells you that credential and authentication material are high-value targets, and that the speed of post-breach exploitation is increasing. That is an argument for investing in detection capability, not just prevention. Endpoint detection and response (EDR) tools, even at the SMB tier, are designed to identify post-exploitation behaviour. A managed security service that includes monitoring is more valuable in an environment where AI agents can operate faster than a human incident response team can react.
The YesWiki vulnerability tells you that open-source tools carry real risk when unpatched. Many small businesses and charities deploy open-source platforms precisely because they are cost-effective. That is a legitimate choice. The discipline that makes it a safe choice is keeping an inventory of what software is deployed and ensuring it is updated. An organisation that knows what it is running can act on a 9.1 CVSS advisory the same day it drops. An organisation that does not know what its website is built on cannot.
Being able to tell a client, a regulator, or a procurement team that you maintain a software inventory and patch on a defined schedule is a differentiator. It is also, under UK GDPR, part of what demonstrating appropriate technical measures actually looks like.
Making the Business Case
If you need to make the case internally for investment in detection capability or patch management process, here are three arguments grounded in this week’s intelligence.
The threat is automated and does not observe business hours. AI-assisted post-exploitation operates continuously once a foothold is established. A breach that begins at 11pm on a Friday can result in credential exfiltration before anyone arrives at the office on Monday morning. This is an argument for monitoring that operates outside business hours, whether through an MDR (managed detection and response) service or equivalent.
MFA is necessary but not sufficient. The PHP2Shell incident involved the exfiltration of MFA secrets alongside password hashes. This is consistent with a broader pattern of attackers targeting authentication infrastructure rather than trying to bypass it at the point of use. MFA remains a critical control; the NCSC continues to recommend it, and Cyber Essentials requires it for cloud services. But it must be combined with controls that protect the credential stores and authentication seed material underlying it.
Unpatched software is a quantified, auditable liability. CVE-2026-116207 has a published CVSS score of 9.1 and a public proof-of-concept pathway. If your organisation is running an affected version of YesWiki and suffers a breach through this vulnerability after today’s date, the question from the ICO will be whether you were aware of the advisory and what action you took. “We didn’t know what software we were running” is not a defensible answer.
What to Do This Week
1. Establish your software inventory. If you do not have a current list of every software platform your organisation runs, including website backends, internal tools, and anything managed on your behalf by a third party, start that list today. It does not need to be sophisticated. A spreadsheet with product name, version, and who is responsible for updates is sufficient to begin.
2. Check YesWiki versions immediately. If your organisation runs YesWiki, confirm the version in use. If it falls within the affected range (4.6.0 before 4.7.0, or 5.0.0-alpha1 before 5.0.0-alpha4), update to a patched version or contact whoever manages the platform and request written confirmation that the update has been applied. Reference CVE-2026-116207 in that request.
3. Ask your MSP about Collabora Online patching status. If your organisation uses a self-hosted Collabora Online deployment, or if your MSP manages one on your behalf, ask them to confirm the patch status in writing. CISA’s KEV listing means this is under active exploitation.
4. Review your MFA implementation. MFA seed material and backup codes should be treated as sensitive credentials, not administrative trivia. Know where they are stored. Ensure access to MFA administration is itself protected. Consider whether your MFA provider offers phishing-resistant options such as hardware keys or passkeys for your highest-privilege accounts.
5. Ask your IT provider what detection capability you have. The shift toward AI-assisted post-exploitation means the question is not only “can attackers get in” but “how quickly will we know if they do?” Ask your provider or MSP what monitoring is in place, what it detects, and what the escalation process is when an alert fires at 2am.
The data this week is not ambiguous. The attack surface is real, the tooling available to attackers is advancing, and the practical defences are known and implementable. None of this requires a large budget. It requires consistent attention and a willingness to ask the right questions of whoever manages your technology.
Before you go: if this episode was useful, follow the show wherever you listen and leave a rating or review. It genuinely helps other small business owners and managers find the programme. Drop a comment with your thoughts, particularly if there are specific topics you want covered in more depth. And if you know someone who would benefit from a clearer picture of what the actual threat landscape looks like, share it with them.