News

If you’re an MSP or private cloud provider managing 3CX phone systems — or similar nginx-based platforms — there’s a good chance your certificate renewal process has changed in the last year or two. Certificate Authorities have been tightening up their issuance practices, and what used to be a simple “drop the new PEM in and restart” job now usually involves dealing with a full chain back to the root CA. The exact details vary by product, but the underlying patterns are similar wherever nginx is doing the TLS termination.

We recently went through this on a customer’s 3CX system and hit a few of the common pitfalls. Sharing them here in case it saves someone else half an hour of head scratching.

What Changed

In the past, many CAs would issue a single PEM file containing just the server certificate. Modern browsers and clients had the intermediate certificates cached or could fetch them via AIA (Authority Information Access), so an incomplete chain often worked anyway.

These days, when you renew you’ll typically end up with:

• Your private key — generated locally on your server as part of the CSR (Certificate Signing Request) process. The CA never sees this; it only receives the public key embedded in the CSR.
• A server certificate (.pem or .crt) — issued by the CA in response to your CSR.
• A bundle file (.bundle, .ca-bundle, or similar) — supplied by the CA alongside the certificate, containing the intermediate certificates and sometimes the root.

In a typical nginx deployment, the ssl_certificate file should contain the server certificate followed by the intermediate certificate(s) — and that’s what nginx (or anything sitting on top of nginx, like 3CX) wants to see.

The Right Order Matters

When you concatenate the server certificate with the bundle, the order is critical:

1. Server certificate first
2. Intermediate certificate(s) next
3. Root certificate — usually omitted. Clients already trust the root, so including it just adds bytes to the handshake. Only include it if a specific vendor or product requires it.

Get this wrong and nginx will either refuse to start or will serve a chain that fails validation on stricter clients. The TLS handshake expects the leaf certificate first. Continue reading →

This week, as the PHP2Shell vulnerabilities made the news, one widely shared headline read: “Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet”. Other coverage repeated versions of the same line: PHP (which today stands for “PHP: Hypertext Preprocessor”, and originally for “Personal Home Page”) “runs” or “powers” 70% of the Internet.

The flaws were serious. They are tracked as CVE-2026-109618 and CVE-2026-109619 (CVE stands for Common Vulnerabilities and Exposures, the public catalogue of security flaws), and they are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or any later release in those branches. If you run a PHP website, read our earlier article on PHP2Shell and get the server patched. But the headline is wrong, and not in a nit-picking way. It is a category error, a bit like saying that 70% of the road network is made of Ford Fiestas.

The same goes for that other favourite, “the Internet has spoken”, used whenever a few thousand people agree about something on social media. The Internet hasn’t spoken. It can’t. It moves packets.

I have been working in electronic engineering, IT support and cloud for more than 30 years. When I started installing Cisco routers, the machines on the LAN (local area network) side had real, public, globally routable IP (Internet Protocol) addresses, because address translation was not yet part of everyday networking. That background makes these phrases grate. This is not a rant, though. It is an explanation, written for younger engineers, students, apprentices and developers who want to understand what actually sits underneath a web page, and why the difference between “the Internet”, “the Web” and “a website” matters.

It is a long one. Put the kettle on.

The short version

• The Internet is a global network of independently run IP networks that agree to exchange traffic. Its job is to carry packets from one address to another. That is all.
• The Web is one application that runs over the Internet, using HTTP (Hypertext Transfer Protocol). Email, DNS (the Domain Name System), voice calls, online games, VPNs (virtual private networks), SSH (Secure Shell) sessions and software updates are other traffic that uses the Internet without being “the Web”.
• PHP is a programming language. On a web server, it is one of several ways to generate the pages the Web delivers. It is not a network protocol, and the routers that carry Internet traffic do not need to know it exists.
• The “70%” figure comes from W3Techs, which reports that PHP is used by 69.3% of websites whose server-side programming language it can identify (figure as at 24 October 2026). That is a statement about a sample of websites, not about the Internet.

The rest of this article explains why, layer by layer.

What the Internet actually is

The word gives the game away. “Internet” comes from internetworking: joining separate networks together. There is no single Internet company, no central computer and no master switch. There are tens of thousands of separately run networks. For routing purposes, the Internet sees them as Autonomous Systems (ASes): networks, or groups of networks, under one administration that present a single routing policy to the outside world, each identified by an AS number. Broadband providers, mobile networks, universities, cloud providers and content delivery networks each operate one or more. The global IPv4 (IP version 4) routing table currently shows roughly 80,000 autonomous systems announcing about 1.09 million IPv4 prefixes. The separate IPv6 (IP version 6) table holds around 260,000 IPv6 prefixes. The exact numbers vary depending on where you observe from. Continue reading →

On 21 October 2026, the PHP project issued emergency updates for two critical PHP vulnerabilities collectively nicknamed “PHP2Shell.” PHP powers a large portion of the web, including WordPress, Drupal, Joomla, many online shops, booking systems, and client portals. Even if no one in your office knows what PHP is, your website may depend on it.

What happened

Both flaws — CVE-2026-109618 and CVE-2026-109619 — are rated 9.2 out of 10 for severity. They can let an attacker with no username or password execute their own code on the web server and read fragments of server memory, which may contain passwords, login tokens, and keys belonging to other visitors. The weakness is in PHP’s engine, not in your website’s own code. That means a well-built, fully updated site can still be exposed if the PHP version underneath it has not been patched. Researchers found affected releases going back to PHP 5.4, with nearly every version before the fixes affected by at least one issue. How easily a site can be attacked depends on how its server is configured.

Why the timing matters

Details leaked online on 20 October, a day before the planned release. Security firms including Cloudflare and watchTowr have already reported attack attempts. In the Netherlands, several government and education websites were taken offline as a precaution while they were patched.

Updating WordPress is not enough

Many business owners correctly keep WordPress and its plugins up to date, but those updates do not fix these vulnerabilities. PHP is part of the server, not the website. It is updated by whoever runs the server: your hosting company, web developer, or IT provider. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The server’s PHP services must be restarted afterward for the fix to take effect. Continue reading →

Every piece of text you see on a screen is stored and processed as numbers. Character encoding is the set of rules that allows software to turn those numbers into readable text. When systems follow the same rules, nobody notices. When they disagree, the results are familiar: “£250” on an invoice, a question mark replacing an accented letter in a client’s surname, or a CSV export that Excel turns into nonsense. Understanding how we got here makes these problems much easier to diagnose.

Where It Started: ASCII

The American Standard Code for Information Interchange, ASCII, was first published in 1963. It used seven bits, allowing 128 possible codes. The familiar version of ASCII contains 95 printable characters, including the space, alongside 33 control codes. Some of those controls remain part of everyday computing: carriage return and line feed are used in the different line-ending conventions associated with Windows, Linux and macOS. ASCII was designed around American English and had no pound sign. The British variant, BS 4730, put £ in the position occupied by #, creating an early opportunity for confusion when text moved between systems.

The Code Page Era

As eight-bit bytes became standard, another 128 values became available. Different character sets used those values for different purposes. The original IBM PC’s code page 437 included accented letters and box-drawing characters. ISO 8859-1, also called Latin-1, covered many Western European languages and placed £ at decimal value 163. Windows-1252 closely followed Latin-1 but used part of its range for additional printable characters, including curly quotation marks and, later, the euro symbol. IBM mainframes used another family of encodings, EBCDIC. Reading a file correctly depended on knowing its encoding, but plain text files rarely identified it. Continue reading →

Paying for an AI subscription does not automatically keep your conversations out of model training. Personal plans such as ChatGPT Plus and Claude Pro still have training controls that users need to understand. For businesses using AI to draft emails, summarise documents or analyse information, the type of account and its privacy settings matter. Here is what to check across ChatGPT, Claude, Google Gemini and Microsoft Copilot.

Training is not the same as answering your question

An AI service has to process what you give it in order to answer. Using that information later to train or improve a model is a separate activity. Saving your chat history and remembering your preferences are separate again. A training opt-out therefore does not mean your information is never processed, stored or reviewed. Equally, asking an assistant to summarise a document does not in itself mean the provider is training on that document.

ChatGPT, including Plus and Pro

OpenAI enables training data sharing by default for personal Free, Plus and Pro accounts. You can switch it off without losing your chat history by going to Settings > Data controls > Improve the model for everyone. The setting follows your signed-in account across devices. Rating a response with a thumbs-up or thumbs-down can still make that conversation available for training. Temporary Chats are excluded from model improvement, although OpenAI may keep them for up to 30 days for safety purposes. ChatGPT Business and ChatGPT Enterprise are not used for training by default. A personal Plus subscription does not become a Business workspace just because you use it for work. Continue reading →

For most small businesses, email holds far more than correspondence: customer requests, quotations, approvals and supplier conversations that staff need to refer back to. When someone permanently deletes the wrong message, Exchange Online gives you a window to recover it. By default that window is 14 days, but administrators can extend it to 30.

Deleted doesn’t mean gone

Deleting a message normally just moves it to Deleted Items, where it stays until it is removed by the user or an automatic policy. The recovery countdown starts only when a message moves into a hidden area called Recoverable Items. That happens when a user empties Deleted Items, deletes a message from it, or uses Shift+Delete. Messages then stay in Recoverable Items for 14 days by default. Because the countdown starts at that point rather than when the message was received, years-old email removed yesterday is still recoverable today.

During that period, users can retrieve messages themselves using Recover Deleted Items in Outlook or Outlook on the web. If a user also purges a message from there, Single Item Recovery keeps a copy that an administrator can restore within the same window. Single Item Recovery is enabled by default for new Exchange Online mailboxes, but it can be switched off, so it is worth confirming it is on.

Extending the window to 30 days

Deletions are not always noticed straight away. Someone tidying their mailbox may remove something important and only realise weeks later, when a customer or supplier refers back to it. Extending the retention period from 14 to 30 days more than doubles the time available to spot the problem and recover the message, at no extra cost. Continue reading →

Microsoft 365 includes useful protection for business email and files. Deleted messages can often be recovered, and Microsoft’s infrastructure is built to keep services available. Recovery has limits, though. What you can get back depends on what happened, how quickly it is noticed, and what protection was configured beforehand.

What Microsoft already protects

Microsoft keeps multiple copies of Exchange Online mailbox databases across its data centres to protect against hardware and site failures. This resilience keeps the service running, but it is not a historical backup. The standard service offers no way to roll a mailbox back to a chosen date.

How long deleted email can be recovered

Emails in Deleted Items can be moved back until the folder is emptied, either by the user or by an automatic policy. Once emptied, or if messages were removed with Shift+Delete, they normally stay in Recoverable Items for 14 days, and an administrator can extend this to 30. Single Item Recovery is enabled by default for new mailboxes, so an administrator can usually still retrieve messages a user has purged, within the same window. That window starts when a message enters Recoverable Items, not when it was received. Five years of email deleted yesterday may therefore still be recoverable today, but not next month.

Deleting a user account normally leaves 30 days to restore the mailbox. Removing an Exchange Online licence usually allows a similar 30-day period to reassign it. After that, the data is deleted, and some explicit permanent-deletion actions can remove recovery options sooner. Continue reading →

A plain-English guide for UK business owners, managers and staff

Updated 16 September 2026

If your team has recently struggled to connect to its remote desktop, September’s Windows updates could be responsible. Microsoft has confirmed that its security updates released on 8 September can make Remote Desktop Services unstable in some environments. It released corrective updates on 14 September 2026. Microsoft’s issue notice

What has gone wrong?

Remote Desktop Services, often called RDS or Terminal Server, lets staff use desktops and applications running on a shared server in the office or a data centre. Many people simply know it as “logging into the server”. Because everyone shares the same system, a fault can cut off several people at once.

Microsoft describes connection and sign-in failures, servers hanging at “Please wait for the Remote Desktop Configuration”, and related management tools freezing. Citrix also reports new connections stuck at “Connecting…” and users unable to log off, often several hours after a restart. Citrix’s advisory The fault can affect Windows Server 2012 (with ESU) through 2025 and some Windows desktop versions, but not every system running these versions will experience it.

Has Microsoft fixed it?

Yes. Microsoft issued out-of-band updates on 14 September, outside its normal monthly schedule. They resolve the RDS issue and keep the protections from earlier security updates. Some of these updates, including the Server 2025 fix, are published through the Microsoft Update Catalog. Businesses therefore shouldn’t assume their usual automatic updates have already installed them. IT teams that applied Microsoft’s temporary Group Policy mitigation don’t need to remove it first.

Uninstalling the September update is not a sensible routine fix. It restores remote desktop access, but it also removes security fixes, including fixes for critical Remote Desktop vulnerabilities.

What should businesses do?

Staff should report the exact message they see and when it happened. They should save work regularly and follow IT’s instructions about reconnecting. They should also resist moving files to personal email or cloud storage to work around the problem. Continue reading →

For many UK SMEs, artificial intelligence still feels like a future project—something that requires budget approval, planning, or a new licence. But Microsoft 365 customers may already have AI capabilities available within familiar applications, without purchasing a separate Copilot subscription. This means AI may already be interacting with company information before leadership has formally approved an AI rollout.

Copilot Chat in Outlook can use a user’s emails and calendar to answer questions and help organise their work. Availability depends on licensing, application version, and administrative settings, but businesses should no longer assume that declining to purchase Copilot prevents its use.

What Is Included, and What Requires a Paid Licence?

Microsoft’s naming is changing. Microsoft 365 Copilot is now described in its documentation as Microsoft Copilot, and Microsoft 365 Copilot Chat as Microsoft Copilot Chat. Customers may still encounter the previous names in applications and licensing screens during the transition. Microsoft’s naming notice

A common misconception is that included Copilot Chat cannot access company data, while paid Copilot can. The actual boundary depends on the application, licence, configuration, and how information is supplied. Continue reading →

Artificial intelligence is usually demonstrated by asking it to write an email, summarise a document or generate an image. Those uses are real enough, but they say very little about what AI can do in the hands of someone who already understands the problem in front of them.

We had a more practical example recently. Two Windows Server 2016 Remote Desktop Services (RDS) hosts failed to boot following a routine update cycle. One displayed a BAD_SYSTEM_CONFIG_INFO stop error; both ultimately halted at Windows Boot Manager reporting 0xc0000225 – A required device isn't connected or can't be accessed. These were production systems, so reinstalling Windows was a last resort rather than a first move. Both were eventually recovered without a rebuild, and the update that appeared to have caused the problem turned out not to be the whole story.

Before You Copy Any of This

Windows servicing is stateful, and two machines showing the same stop code can have entirely different underlying faults. Nothing below should be treated as a set of commands to paste into a broken server.

Take a backup or confirm you have a working recovery route before touching a production system. In a virtual environment a checkpoint is a useful short-term safety net while troubleshooting, but a Hyper-V checkpoint is not a backup and should never be relied on as one. Most importantly, do not remove an update package because a package identity appears in an article — always identify what is actually present on your own system.

First, Establish What Windows Is Actually Doing

Error 0xc0000225 normally sends administrators straight towards the BCD, the EFI System Partition or missing boot files, and that would have been a reasonable first instinct. The more useful clue was that both servers had just been through an update cycle, which raised a different possibility: that Windows servicing had been interrupted part-way through committing an update during startup. Continue reading →