Updates and technology notes

On October 21, the PHP project fixed two critical security flaws, nicknamed "PHP2Shell," that could let an attacker take over a web server without a password. PHP runs a large share of the web, including WordPress. If your business has a website, a customer portal or any web software on its own server, make sure it gets patched now.

Microsoft confirmed that its October Windows Server updates can stop people from signing in to web email and leave messages stuck in the Outbox on Exchange servers run in your own office. Microsoft 365 email is not affected. With Exchange 2016 and 2019 security updates also ending this month, it is a good time to ask whether running your own email server is still worth it.

Starting February 1, 2027, Microsoft stops sending text and phone-call sign-in codes for Microsoft 365. Staff who rely only on those codes will have to set up a passkey before they can sign in. A little planning now beats a Monday-morning lockout.

Our website has a new look, a clearer list of what we do, and a faster way to start a remote support session.