Key takeaways
A critical flaw in PHP, the software many business websites run on, is now being exploited. Ask your web host or developer today whether your site is patched.
Scammers are using real charity names to run fake prize schemes. Nonprofits should warn donors before giving season.
Fake “FTC” callers and misleading health plan ads are making the rounds. Share both warnings with your staff.
Welcome to the first edition of This Week in Cyber, our weekly briefing for Northern Virginia businesses and nonprofits. Each week we pick the few stories that matter most to a small office, explain them in plain language, and give you one thing to do. If you only have time for one item this week, make it the first one.
1. A critical flaw in the software behind many websites is now under attack
What happened: On October 21, the team that maintains PHP released urgent fixes for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 (PHP security advisory). PHP is the programming language that powers a large share of the web, including popular website platforms such as WordPress. The flaws can let an attacker run their own code on a web server without logging in. The same day, CISA, the federal cybersecurity agency, told organizations to patch immediately (CISA alert). On October 23 the FBI added that updates “should be applied immediately” (FBI alert). On October 26, CISA added both flaws to its list of vulnerabilities that attackers are actively exploiting (CISA catalog update).
Why it matters to you: If your business or nonprofit has a website, there is a good chance it runs on PHP, often without you knowing. A hacked website can be used to steal visitor information, spread malware to your customers or donors, or get your site flagged by Google as unsafe. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get regular updates from the PHP project.
Do this: Email your web host or website developer today and ask: “Is our website on a patched version of PHP, and when was it updated?” Ask for the answer in writing. If they cannot confirm a fix, the FBI and CISA both advise taking the site offline until it is patched. Also note that PHP 8.2 reaches end of life on December 31, 2026, so if your site runs on it, plan an upgrade now.
Not sure who manages your website or other systems? Our managed IT and cybersecurity teams can find out and handle it.
2. Scammers are borrowing real charity names for fake prize schemes
What happened: On October 26, the Federal Trade Commission warned that scammers are impersonating well-known charities and sweepstakes. They may tell people they won a charity-sponsored prize because they donated, then ask for a fee or a Social Security number to “claim” it. Some use a real charity’s name or one that sounds close, and advertise in search results and on social media (FTC alert).
Why it matters to you: For nonprofits, every fake message sent in your name costs donor trust right before the busiest giving weeks of the year. For businesses, it is one more prize message your staff might believe.
Do this: Nonprofits, add one line to your next donor email or social post: “We will never ask you to pay to claim a prize.” Then search your organization’s name with words like “sweepstakes” or “prize” to spot imposters. Everyone else, remember the FTC’s rule: real prizes are free. Our nonprofit IT page has more on protecting donor trust.
3. Callers are pretending to be the FTC and threatening to cut off your phone
What happened: The FTC also warned about callers who claim to be FTC officials and say a phone registered in your name is being used for scams. They threaten to deactivate your number, transfer you to a fake police officer, ask for your ID, tell you to keep the call secret, and eventually demand money (FTC alert).
Why it matters to you: These calls go to work phones as well as personal ones, and they are designed to scare people into acting fast. The FTC is clear: a real FTC employee will never ask you to send money, threaten to disconnect your phone, or tell you to keep the call secret.
Do this: Forward this item to your team. Remind everyone that any call demanding secrecy and money is a scam, no matter what caller ID shows. Regular security awareness training makes these calls much easier to spot.
4. Health insurance open enrollment brings misleading ads
What happened: Marketplace open enrollment runs from November 1 to January 15. On October 29 the FTC warned that some ads promise “comprehensive” coverage but offer limited benefits, some sell medical discount cards as if they were insurance, and some pretend to be from the government or a well-known insurer (FTC alert).
Why it matters to you: Many small business owners, part-time staff and contractors buy their own coverage. A bad plan picked from an ad can be an expensive surprise later.
Do this: Start at the official source, HealthCare.gov, or call the Marketplace Call Center at 1-800-318-2596. The FTC notes that prerecorded robocalls selling health insurance are illegal, so hang up on them.
Your one-minute checklist for this week
Ask your web host or developer to confirm, in writing, that your website’s PHP is patched.
Nonprofits: tell donors you never charge for prizes.
Share the fake FTC call warning with your staff.
Use HealthCare.gov, not ads, to compare health plans.
Want to see where your office stands overall? Try our free Cyber Safety Checklist. It takes about five minutes.
Sources
PHP Group, Security advisory: Critical remote code execution vulnerabilities, update now (October 21, 2026).
CISA, Critical Vulnerabilities in PHP Require Immediate Patching (October 21, 2026).
FBI Internet Crime Complaint Center, Critical Vulnerability Alert: PHP Core (October 23, 2026).
CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 26, 2026).
Federal Trade Commission, Spot scammers impersonating well-known charities and sweepstakes (October 26, 2026).
Federal Trade Commission, The FTC is not calling to deactivate your phone number (October 22, 2026, updated October 27).
Federal Trade Commission, Seeing lots of ads for health insurance plans during open enrollment? Read this (October 29, 2026).
Researched, fact-checked and approved by Umair Akhtar, Founder & President, JPert INC. Every fact above links to its official source. Spot an error? See our editorial policy and corrections page.
JPert supports organizations across Tysons, Vienna, McLean, Reston, Herndon, Fairfax, Falls Church, Ashburn, Sterling, and Leesburg.
Want This Week in Cyber in your Google results? Add JPert as a preferred source.