October brought one of the more technical challenges the team has faced this year, a newly disclosed web vulnerability capable of turning an ordinary form submission into a foothold on the server behind it. The days that followed saw the team working through client environments to establish who was exposed, how quickly patches needed to go out, and what the incident meant for the wider supply chain sitting behind Periculo’s own clients.
Elsewhere, the NHS Data Security and Protection Toolkit’s 2026-27 cycle landed this month, with NHS England publishing a fresh set of mandatory audit assertions for IT suppliers, while the Ministry of Defence’s 31 December deadline for Defence Cyber Certification Level 0 is no longer a distant line in the diary.
The team grew this month too, with two new faces joining Periculo, and this month’s security tip covers a threat the team has been fielding more often in client conversations.
Read on for the DCC Level 0 countdown, this year’s DSPT update, two warm welcomes to the team, an update from the field, this month’s security tip.
There are now just 62 days left before the Ministry of Defence's 31 December deadline for Defence Cyber Certification (DCC) Level 0.
For MoD suppliers who haven't yet started, the clock is ticking. Level 0 requires a valid Cyber Essentials certificate as a prerequisite, and typically takes two to three weeks to complete once that's in place, assessed against Defence Standard 05-138 (Issue 4). Organisations leaving it until December risk running out of road to get Cyber Essentials sorted first.
We will continue to credit the cost of a client's Level 0 assessment toward a higher Defence Cyber Certification level if they choose to pursue Level 1, 2 or 3 afterwards, worth knowing for anyone planning to go beyond the minimum.
Contact us now to check where you stand.
On 1 October, NHS England published the mandatory audit scope for this year’s DSPT cycle: IT suppliers (Category 2) are now checked by an independent auditor against 12 fixed assertions, covering everything from staff training to firewall management to supplier due diligence.
With those assertions updated, Periculo has spent October revisiting its DSPT library to make sure the detail still matches what assessors are asking for.
The guide to DSPT 4.5.6 on multi-factor authentication and identity federation has been refreshed, alongside the explainer on using Cyber Essentials Plus and ISO 27001 evidence to shortcut DSPT submissions, and the walkthrough of DSPT 9.5.11’s software security code of practice requirements. Anyone midway through this year’s submission is encouraged to revisit these for the latest steer.
Our team continues to grow. This month, we’re pleased to welcome Alex Hems and Oliver Mason to Periculo...
Periculo is pleased to welcome Alex Hems, who joins as a Consultant in the Sentinel Team.
Alex spent almost four years at Hargreaves Lansdown, starting in Operations before moving into the Vulnerability Management function as a Vulnerability Analyst, triaging and prioritising vulnerabilities using CVSS, carrying out OSINT and threat intelligence reviews, working with IT teams on remediation and Remedial Action Plans, and reporting to stakeholders against agreed SLAs.
Alex also holds a First Class LL.B. in Law, with prior experience as a paralegal handling sensitive client data under SRA and FCA regulations, and holds CompTIA Security+ and Network+, currently working towards ISO 27001 Foundations. A native Polish speaker, Alex brings a blend of technical skill, regulatory awareness, and strong leadership and communication to the team.
I’m delighted to share that I’ve joined Periculo. From my first conversations with the team, the breadth of what we offer and the energy everyone brings to the work stood out, and it has me really excited about what’s ahead.
My background is in client-facing roles within cybersecurity, so I’ve seen how much value the right expertise and advice can bring to an organisation. I’m keen to get stuck in, learn from the experts around me and keep building my knowledge across the wider security space.
My first priority is spending as much time as I can with our customers. I want to understand the challenges they’re facing and help them map out their security landscape, so they have a clear picture of where they stand and what to focus on next.
If we already work together, expect to hear from me very soon. And if you’d like to talk about your organisation’s security, my inbox is always open. I’d love to connect!
Sure, an organisation can patch its vulnerabilities, but what about its supply chain? Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, became public this month under the name PHP2Shell, both allowing an attacker to run code on a web server without logging in, with active exploitation beginning before a patch was available.
Jack White, Senior Consultant, led the response for one Periculo customer running PHP on its public website: the team took the site offline immediately uptime came second to containment then checked the host for signs of compromise before patching to a fixed release (8.5.12, 8.4.27, 8.3.36 and 8.2.35). The site went back up only once the team was satisfied it was clean; a patch closes the hole but removes nothing an attacker may already have left behind, so the review mattered as much as the update.
The site itself was the quick part. The bigger job was the supply chain. PHP sits underneath a huge range of products, so the team needed to know which of the customer’s suppliers ran it and what each one could reach, working through almost a thousand suppliers in total. Around 100 were IT-managed services, bought and administered by the customer’s IT team; these were already on a register with named owners and could be contacted quickly, making for straightforward work. The remaining 700 or so were non-IT-managed services tools bought and run directly by other departments, such as marketing agencies, event and booking platforms, training portals and small hosted tools. The assumption was often that these had little online presence and so wouldn’t be affected, but that assumption couldn’t be taken at face value, and this group took the most time to chase due to incomplete records in places.
For every supplier, the team asked the same questions: did they run PHP, which version, had they patched, what customer data did they hold, and did they connect to the customer’s systems? Suppliers were then ranked by exposure so the highest risks were chased first. Three things stood out. Suppliers outside IT’s view were the hardest to find and the slowest to answer, yet occasionally held some access to customer data, however small. Several could not say whether they used PHP at all, which told the team as much as a yes or no, and meant treating them as affected regardless. And a supplier register is only useful if it covers the whole business, not just what IT manages.
Vulnerabilities like this arrive with little warning. The suppliers an organisation can list, contact and rank on day one are the ones it can deal with fastest and with a tidal wave of vulnerabilities currently hitting the world, this work needs to be in place and ready for use yesterday, not tomorrow. A managed service with Periculo focuses on exactly this: third-party supply chain risk, vulnerability management and business continuity as a priority, not an afterthought.
This month's tip is from cybersecurity consultant Samuel Martin.
Vishing, or “voice phishing”, is when criminals phone you posing as someone you trust to trick you into giving away sensitive information. At home, that might be your bank or HMRC; at work, it’s often “IT support” asking for a password or MFA code, a “supplier” updating their bank details, or a senior colleague with an urgent request. Attackers increasingly research their targets on LinkedIn and social media so they can drop names and sound convincing, and caller ID can easily be spoofed, so a familiar number proves nothing.
Look out for the common warning signs: an unexpected call, a caller claiming authority who becomes vague when questioned, pressure to act immediately, and requests that start with harmless details before moving on to credentials, account numbers or payments.
The best defence is simple: never share information or approve requests on a call you didn’t initiate; take your time, and verify independently by hanging up and calling back on a number you already know to be genuine. A legitimate caller will never object to you checking, and if something feels off, report it to your IT or security team straight away!
October brought some great work worth highlighting. The standout came from a client who completed their Cyber Essentials certification:
“Periculo provided us with a swift assessment and clear guidance on achieving our Cyber Essentials certification. The whole process was quick and really smooth. We had outstanding help from Samuel Martin, who gave knowledgeable and prompt support throughout.
His assistance was key to us completing the process and achieving our certification. Highly recommended!” It’s feedback like this that keeps the team focused on getting the detail right for every client.
CVE (Common Vulnerabilities and Exposures) is the public reference system used to catalogue known software vulnerabilities, giving each one a unique identifier such as CVE-2026-109618, one of the two flaws behind this month's "PHP2Shell" vulnerability, so that vendors, researchers and security teams can all refer to the same issue without confusion. A CVE number doesn't rate how serious a vulnerability is on its own; that's usually done via a separate scoring system, but it's what lets a security team check in minutes whether a specific flaw affects their own systems or supply chain.
If any of the areas covered are relevant to your organisation, we are always happy to have a conversation. Please contact us.