News

We’ve seen three successful attacks this year where users had MFA enabled and still got compromised. Here’s how it works and what you can do about it.

Multi-factor authentication is one of the most important security controls you can implement. Microsoft says it blocks over 99% of credential-based attacks. We enforce MFA for every user, on every account, with no exceptions.

But MFA isn’t bulletproof. This year alone, we’ve seen three successful attacks against Microsoft 365 accounts where the users had MFA enabled and working correctly. They entered their password, they completed the MFA challenge, and the attackers still got in.

This isn’t a theoretical vulnerability. It’s happening right now, and many IT professionals don’t fully understand how it works. This article explains the attack, why it succeeds, and what we’re doing to protect against it.

How Microsoft 365 Authentication Actually Works

To understand the attack, you need to understand what happens when you log into Microsoft 365. Continue reading →

For many SMEs across the UK, Remote Desktop remains a practical and cost-effective way to access private cloud desktops, line-of-business applications and hosted Windows environments.

Microsoft’s latest Windows 11 security update has now changed how that experience works when users open an .rdp file. From Microsoft’s 14 April 2026 cumulative update (KB5083769, builds 26100.8246 and 26200.8246), Remote Desktop shows the requested connection settings before connecting, with each setting turned off by default, and a one-time security warning appears the first time an .rdp file is opened on a device. The change is tied to CVE-2026-26151, a Remote Desktop spoofing vulnerability.

At first glance, that may sound like a minor interface change. In practice, it is a significant shift in how trust is handled for remote access. Microsoft has not removed digital signatures from signed .rdp files, and signatures still help verify who published the file and whether it has been altered. What has changed is the default behaviour at connection time: regardless of whether an .rdp file is signed or unsigned, every redirection it requests is now off by default, and the user must explicitly allow access to items such as clipboard, local drives, printers and other attached devices. The signature now determines which dialog banner the user sees, and whether a publisher name is shown, rather than granting automatic redirection trust. Continue reading →

If you’re an MSP or private cloud provider managing 3CX phone systems — or similar nginx-based platforms — there’s a good chance your certificate renewal process has changed in the last year or two. Certificate Authorities have been tightening up their issuance practices, and what used to be a simple “drop the new PEM in and restart” job now usually involves dealing with a full chain back to the root CA. The exact details vary by product, but the underlying patterns are similar wherever nginx is doing the TLS termination.

We recently went through this on a customer’s 3CX system and hit a few of the common pitfalls. Sharing them here in case it saves someone else half an hour of head scratching.

What Changed

In the past, many CAs would issue a single PEM file containing just the server certificate. Modern browsers and clients had the intermediate certificates cached or could fetch them via AIA (Authority Information Access), so an incomplete chain often worked anyway.

These days, when you renew you’ll typically end up with:

• Your private key — generated locally on your server as part of the CSR (Certificate Signing Request) process. The CA never sees this; it only receives the public key embedded in the CSR.
• A server certificate (.pem or .crt) — issued by the CA in response to your CSR.
• A bundle file (.bundle, .ca-bundle, or similar) — supplied by the CA alongside the certificate, containing the intermediate certificates and sometimes the root.

In a typical nginx deployment, the ssl_certificate file should contain the server certificate followed by the intermediate certificate(s) — and that’s what nginx (or anything sitting on top of nginx, like 3CX) wants to see.

The Right Order Matters

When you concatenate the server certificate with the bundle, the order is critical:

1. Server certificate first
2. Intermediate certificate(s) next
3. Root certificate — usually omitted. Clients already trust the root, so including it just adds bytes to the handshake. Only include it if a specific vendor or product requires it.

Get this wrong and nginx will either refuse to start or will serve a chain that fails validation on stricter clients. The TLS handshake expects the leaf certificate first. Continue reading →

When nothing is broken, it is easy to wonder what you are paying for. Here is what happens behind the scenes to keep it that way.

If your IT is working properly, you probably do not think about it very much. Email works. Files are where they should be. You can log in. The internet is fast enough. Everything just works.

And when that is the case, it is natural to wonder what your IT provider is actually doing. You are paying a monthly fee, but there are no engineers on site, no major incidents, and no obvious signs of activity.

That is the point.

The purpose of managed IT is to stop you having to think about IT at all. But “nothing happening” on your side usually means a great deal is happening on ours. Here is what a typical month really looks like behind the scenes.

Every morning

Our day starts by checking what happened overnight.

Backup reports. Most client backups run overnight, so every morning we check that they completed successfully. Did the job finish? Were there warnings or failures? A backup that fails silently is often worse than no backup at all, because you only discover the problem when you need to restore data, and by then it is too late. Continue reading →

Microsoft released KB5079473 on 10 March 2026 for Windows 11 versions 24H2 and 25H2 as part of its regular Patch Tuesday updates. As with any monthly cumulative update, it included important security fixes along with a handful of quality improvements.

When the update first rolled out, it quickly attracted attention online. Reports started appearing of crashes, freezes, broken apps, sign-in problems, and even boot issues. A few weeks later, the picture is much clearer. Some of the concerns were real, one key issue has now been fixed by Microsoft, and at least one widely reported problem turned out not to be caused by the Windows update at all.

Here’s what happened, what’s been confirmed, and what users should do now.

What KB5079473 actually affected

The main issue Microsoft has officially confirmed after installing KB5079473 involved Microsoft account sign-ins.

Some users found that apps relying on a Microsoft account suddenly stopped signing in properly and displayed a false message claiming the PC was not connected to the internet. This affected apps and services such as Microsoft Teams Free, OneDrive, Microsoft Edge, Word, Excel, and Microsoft 365 Copilot when a Microsoft account login was required.

Importantly, this problem affected consumer Microsoft accounts, not organisations using Microsoft Entra ID.

So while early reports described a broad range of failures, the sign-in bug is the main issue Microsoft formally acknowledged as a known problem linked to KB5079473.

Microsoft has already issued a fix

Continue reading →

HMRC has awarded AWS a contract to migrate services from three Fujitsu datacentres running everything from Unix variants to Windows and VMware. The technical challenges are significant—and the procurement process raises its own questions.

On 23 March 2026, HMRC awarded Amazon Web Services a contract worth £472.8 million to migrate services from three Fujitsu-run datacentres to the cloud. The initial term is seven years, with extension options that could take it to ten. The migration is due to be completed by June 2028.

That’s just over two years to exit datacentres running a remarkably diverse mix of systems—a legacy estate that has been accumulating for decades. The way the contract was awarded raises questions about competition in government IT procurement.

What’s Actually Being Migrated

The procurement documents describe a mixed legacy estate spanning about a dozen platforms and operating environments. These include Unix variants like HP-UX, IBM AIX, and Solaris, but also Red Hat Linux, SUSE Linux, Windows, VMware ESXi, Oracle Linux, and NetApp ONTAP storage systems. Continue reading →

We use AI to help write our news articles and technical guides. We also don’t trust it. Here’s how we combine multiple AI tools with human expertise to create content that’s actually accurate.

You might have noticed we publish quite a lot of articles on technical topics—Windows updates, security threats, regulatory changes, industry news. What you might not know is that we use AI tools to help create them.

We’re not hiding this. We think it’s worth explaining, because the way we use AI is probably different from what you might assume. We don’t just ask an AI to write an article and publish whatever it produces. That would be a disaster. Instead, we’ve developed a workflow that treats AI as a powerful tool that requires constant supervision—like a very fast, very knowledgeable assistant who occasionally makes things up with complete confidence.

Here’s how it actually works, including the mistakes we’ve caught along the way.

The Basic Workflow

Our content creation process typically involves three parties: a human with domain expertise (that’s us), a primary AI for drafting (usually Claude), and a second AI for fact-checking (usually ChatGPT). The human stays involved throughout.

It works like this: Continue reading →

New US laws require operating systems to verify users’ ages. The problem? The people who wrote them appear to think ‘operating system’ means ‘iPhone’. Here’s what UK businesses need to know.

Something rather strange is happening in American technology legislation, and while it might seem like a distant problem, the ripple effects could reach UK businesses sooner than you’d think.

Several US states have passed or are passing laws that require operating system providers to collect age information from users when they set up an account. The intention is to protect children online by making age verification happen at the operating system level, rather than leaving it to individual apps and websites.

The intention is reasonable. The execution is a masterclass in what happens when laws are written by people who don’t understand the technology they’re trying to regulate.

What These Laws Actually Require

California’s Digital Age Assurance Act (AB 1043), signed into law on 13 October 2025 and taking effect on 1 January 2027, is the flagship example. It requires every “operating system provider” in California to collect age information from users during account setup—specifically, their birth date, age, or both—and make that information available to app developers via a real-time API. Continue reading →

Certificate validity periods have shrunk from five years to one year—and they’re about to get even shorter. Here’s why it’s happening, who benefits, and why small IT teams are paying the price.

This week I renewed a TLS certificate for a client’s booking website. The old certificate was due to expire on 26th March. The new one, freshly issued, expires on 9th October. Not 26th March next year—9th October this year. A one-year certificate that doesn’t actually last a year from when you install it.

This is an Organisation Validated (OV) certificate for a site that takes payments. It required email verification, phone callbacks, and identity checks against official company records. And I’ll be doing it all again in about six months.

It wasn’t always like this. Not long ago, I was renewing these certificates every three years. Before that, every five years. Now it’s effectively twice a year, and if the browser vendors get their way, it could soon be four times a year.

This isn’t a technical improvement. It’s a burden being imposed on the entire industry by a handful of enormous companies who have the infrastructure to automate their way around it—and apparently no understanding of how the rest of us work.

How We Got Here

TLS certificate validity periods are set by the CA/Browser Forum, a consortium that includes certificate authorities (the companies that issue certificates) and browser vendors (the companies that decide which certificates to trust). In practice, the browser vendors hold all the power—if Google or Apple decide not to trust certificates longer than a certain validity, certificate authorities have no choice but to comply. Continue reading →

Six decades of connection speeds, from acoustic couplers to fibre optics—and why your grandchildren won’t believe how we used to live.

If you’re old enough to remember the sound of a dial-up modem negotiating a connection, you’ll know that getting online used to require patience. Lots of patience. But even if your first experience of the internet was over broadband, the journey from the earliest data connections to today’s gigabit fibre is a remarkable story of engineering progress.

Let’s take a trip through the decades and see just how far we’ve come.

The Beginning: Acoustic Couplers and 300 Baud (1960s–1970s)

Before the internet existed, there were modems. The word itself is a contraction of “modulator-demodulator”—a device that converts digital signals into analogue sounds that can travel over telephone lines, and vice versa. Continue reading →