Digital marketer & Cyber security guy helping your business grow with PPC, SEO, automation and landing pages for companies large or small.
Birmingham, England
Joined March 2009
- Tweets3K
- Following733
- Followers228
- Likes8.2K
Paul Foster | PPC + SEO retweeted
In the wake of the global Microsoft outage, the NCSC is recommending that everyone exercises caution around unexpected calls and messages, especially those containing links.
For advice on how to recognise & report suspicious messages, websites & calls⬇️
ncsc.gov.uk/collection/phish…
ALT Microsoft outage: We recommend vigilance against scam calls and approaches impersonating IT help desks or Microsoft. Scammers often exploit current news stories, try to quickly gain your trust, and aim to pressure you into acting without thinking. Visit the NCSC's website for more guidance on spotting and reporting suspicious communications.
Paul Foster | PPC + SEO retweeted
“who should we lay off first”
CEOs:
BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg.
Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible.
This reflects ~27% of Microsoft's total workforce.
Paul Foster | PPC + SEO retweeted
🚨 UPDATE: PHP2Shell exploitation confirmed in the wild.
Perplexity researcher Adel Karimi observed successful exploitation on honeypot servers, with attackers executing shell commands to fetch additional payloads.
No second-stage payloads have been recovered so far.
Details: thehackernews.com/2026/10/ph…
Paul Foster | PPC + SEO retweeted
The critical PHP security issue highlights the importance of understanding your organisation’s attack surface.
The NCSC’s guidance can support your organisation to navigate a vulnerability patch wave and respond with greater confidence.
Learn more:
ncsc.gov.uk/blogs/prepare-fo…
ALT Is your organisation ready for a vulnerability patch wave? Organisations must act now to prepare for a wave of patches that will address decades of technical debt.
Paul Foster | PPC + SEO retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Paul Foster | PPC + SEO retweeted
Websites taken down across Europe ahead of critical cyber-security update bbc.in/4BgqGlW
Paul Foster | PPC + SEO retweeted
Cloudflare Detects Early Exploitation Attempts Targeting Two Leaked PHP Vulnerabilities
Details: cybersecuritynews.com/php-ea…
Cloudflare says it is seeing early attempts to exploit two critical PHP vulnerabilities whose details surfaced before the PHP security team’s planned release.
The company has deployed an initial set of Web Application Firewall (WAF) rules to block known exploit patterns. Cloudflare says the rules are available to all customers, including those on free plans, and that it is updating them as new patterns appear.
The warning raises the urgency for teams running PHP websites, but the firewall rules are only a temporary layer of protection.
#cybersecuritynews
Paul Foster | PPC + SEO retweeted
Google Cloud Outage Knocks UK Banks, Websites and Court Systems Offline
Details: cybersecuritynews.com/google…
A Google Cloud outage disrupted UK banks, business websites and court video links on Tuesday, October 20, after a power event hit its London infrastructure. Google later said most affected services had recovered, although a small number of customers still faced problems.
The incident began around 07:08 BST in europe-west2, Google’s London cloud region. Google identified a power event in the europe-west2-b zone and reported higher error rates and network failures across multiple services. Its public dashboard listed the incident as active during the afternoon.
#technews #outage
Paul Foster | PPC + SEO retweeted
‼️ BREAKING: Revolut's app and cards have stopped working across Europe.
Google Cloud's London region is affected by network failures. Revolut, and many other services, runs on Google Cloud.
Revolut says money and data are safe but has not named a cause.
Paul Foster | PPC + SEO retweeted
🚨 Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins
Details: cybersecuritynews.com/teams-…
A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a phishing attempt targeting workplace users. Security researcher Steven Lim reported that teams-cloud[.]live was just five days old when he flagged it on October 18, 2026.
He urged organizations to block the address before employees encounter the fake site. A copied Teams screen could persuade employees to trust a sign-in request. However, the available report does not establish how many people visited the site, whether passwords were captured, or who operates the domain.
#cybersecuritynews
Paul Foster | PPC + SEO retweeted
BREAKING: Israeli spyware is confirmed on our phones. This should be headline news but none of our mainstream media is covering it, of course. So we will.
An Israeli ad company called Discover-Tech used ordinary online ads to plant spyware on people’s devices, and nobody had to click anything. The ad just had to load on a website or inside an app for you to be infected.
Citizen Lab and the ad security firm Confiant published the findings yesterday. Researchers went through roughly 4 billion ad-bidding records and found Discover-Tech ads running on more than 120,000 websites and 70,000 apps between March and June of this year. Confiant says the company was serving at least 10 million ads a day.
The platform was called Controlium. According to Citizen Lab, it let spyware companies use ad auctions to profile and unmask users, then send an infected ad to the one person they wanted to hack. The ads were also pulling cookies and login tokens from the sites they ran on. Israeli corporate records list Dekel Boni as the company’s founding director and sole shareholder.
The main spyware customer was Candiru, the Israeli firm the U.S. government blacklisted in 2021, which now goes by Integrity Labs. Five years after that blacklisting, it was still reaching devices through ad inventory on Google, Comcast-owned Beeswax and Russia’s Yandex. Google had Discover-Tech on its approved vendor list from 2020 until this week.
At least 45 Al Jazeera devices were targeted in 2024 and 2025. Candiru’s 2021 shareholder filings reportedly listed a minority investor described as a proxy for Qatar’s sovereign wealth fund, and Qatar also funds Al Jazeera. If that holds up, Qatari state money was sitting inside the company whose spyware was later aimed at Qatar’s own news network.
The heaviest targeting was in the Palestinian territories, where Discover-Tech served almost 2% of all digital ads and about 10% on April 7. Traffic also reached the Armenian prime minister’s office, courts, universities and defense organizations.
Google and the other ad platforms cut Discover-Tech off after the report came out. What nobody has answered yet is who paid for the ad buys, and how a company working with a U.S.-blacklisted spyware vendor passed vendor review for six years.
I am going to look into this today to see if we can figure out who was buying the ads. Interesting timing considering my article yesterday....
Here's what to do to protect yourself:
(1) Use an ad blocker. Citizen Lab calls ad-blocking a cybersecurity best practice and says there is no consistently safe way to be exposed to targeted ads. On iPhone, add a Safari content blocker. On Android, use Brave or Firefox with uBlock Origin. Ad blockers only work in your browser, not inside apps, so it also helps to delete free ad-supported apps you don’t need.
Kill your advertising ID.
(2) iPhone: Settings > Privacy & Security > Tracking, and turn off “Allow Apps to Request to Track.” Then Settings > Privacy & Security > Apple Advertising, and turn Personalized Ads off.
(2) Android 12 or later: Settings > Privacy > Ads > Delete Advertising ID. Then in Settings > Google > All Services > Privacy & security > Ads > Ads privacy, turn off Ad topics and Ad measurement.
(3) Windows 11: Settings > Privacy & Security > General, and turn off personalized ads using your advertising ID.
(4) Update your phone and restart it often. Many zero-click exploits don’t survive a reboot, so a daily restart forces attackers to reinfect you.
Stay tuned!
Paul Foster | PPC + SEO retweeted
Today is Wear Red Day ❤️ In the year when Show Racism the Red Card marks its 30th anniversary as the UK’s leading anti-racism educational charity. Wear red and show your support. #WRD26
Paul Foster | PPC + SEO retweeted
World Mental Health day today.
Still too many people struggling, still too many people who won't tell a friend, family member or reach out to one of the great charities who are all on this app.
Too many people taking their own life when reaching out and talking in many cases leads to better days. Trust me, I've been there, literally at the end of a rope, stopped, went to see my late Mum, cried a river and started a conversation.
Men between 40 and 65 are the group that notoriously don't talk. Too much bravado, too much pride, still too many saying "pull your socks up and get in with it". Often you just can't. So right now, if you're struggling, drop your pal a message. "I'm struggling pal, got 5 mins for a chat?". You'll be surprised what happens and may point to that message as a starting point.
There's millions of us who struggle regularly, with anxiety, depression, real stuff that destroys from the inside. Not feeling down for a day, anxiety that cripples, energy levels that crash and a suffocating malaise you feel you'll never get out of.
You will, and you can, and you must. For yourself, your pals, your Brother, Sister, Mum and Dad, but overwhelmingly for yourself.
1 in 3 struggle with mental health issues at some time in my life. I've had people who mocked mine only to say "I'm struggling" years down the line. Poor mental health can visit anyone, just like poor physical health can.
Drop a pal or a sibling or even a stranger like me a message, that one deed alone means you're half way there and you can start to talk. Anxiety and depression love being locked on your head with nowhere to go, and anyone who knows will nod on agreement.
Stand up, reach out and see where it takes you. You owe yourself that.
#mentalhealth
Paul Foster | PPC + SEO retweeted
⚠️ Unpatched SharePoint is still getting orgs ransomed.
Warlock hit a water utility, a telecom, a government body, and a university in the last 2 months. They killed security tools on 40 hosts in ~2 hours, then used SYSVOL to push ransomware to 33 machines.
Read: thehackernews.com/2026/10/wa…
Paul Foster | PPC + SEO retweeted
🛡️ Multiple Apache HTTP Server Vulnerabilities Could Enable Code Execution Attacks
Details: cybersecuritynews.com/apache…
The Apache Software Foundation released Apache HTTP Server 2.4.69 on October 1, 2026, addressing security flaws that could enable code execution, server crashes, data leaks, and authentication bypass under specific conditions.
Apache identifies the update as the best available release of its web server. The supplied advisory lists 20 vulnerabilities: five rated moderate and 15 rated low. Most affect versions 2.4.0 through 2.4.68, but exposure depends on enabled modules, server settings, and attacker access.
CVE-2026-63292 affects mod_vhost_alias. A remote client could crash the server or potentially execute code through a Host header exceeding 8,192 bytes.
#cybersecuritynews
Paul Foster | PPC + SEO retweeted
🔴 WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments
Source: cybersecuritynews.com/wordpr…
WordPress administrators are being urged to patch a high-severity core vulnerability that can turn an anonymous comment into server-side command execution. Tracked as CVE-2026-93485 and demonstrated by the Comment2Shell proof-of-concept, the flaw is an unauthenticated stored cross-site scripting issue in WordPress’s wpautop() formatting function.
WordPress fixed the vulnerability in version 7.1.1 and advised site owners to update immediately.
Comment2Shell shows how apparently harmless markup can become executable only when WordPress renders a stored comment.
#cybersecuritynews
Paul Foster | PPC + SEO retweeted
🚨 Five critical flaws in WordPress plugins and themes can lead to site takeover or RCE.
The bugs span auth bypass, admin password-reset exposure, privilege escalation, and server-side code execution across GiveWP, Avada, WPMU DEV, TranslatePress, and Pods.
Read: thehackernews.com/2026/08/fi…
