26 October Newsletter

Business News Wales

Welcome to our round-up of the latest business news for our clients. Please contact us if you want to talk about how these updates affect your business. We are here to support you!

Tackling the PHP gremlin

Last week saw 32 government services unavailable due to the PHP global cyber-security issue and the National Cyber Security Centre (NCSC) recommended that businesses tackle the problem immediately.

Websites around the world were taken offline until the security issue was fixed. Organisations using any version of PHP are affected and all organisations are warned to update to the latest fixed version.

OpenAI detected flaws in the ubiquitous PHP (PHP Hypertext Preprocessor), a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser.

While the non-profit organisation called the PHP Foundation, which maintains and develops the language, was preparing a security patch, an online leak made the problem common knowledge before it had been released.

The security issue could allow an attacker to trigger an Out-Of-Memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution.

What organisations should do

If a business has not already taken the recommended actions outlined by the NCSC, these are the steps that should be followed.

The PHP Foundation has released two patches for the software elements and companies can identify the flawed code in PHP as:

• The CVE-2026-109618 process handles out-of-memory issues and can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• The CVE-2026-109619 process flaw means a request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the two critical vulnerabilities that can allow unauthenticated remote code execution. 

If companies haven’t already done so, they should contact both their website manager and the company providing server hosting.

It is also a lesson as to why software should be continually updated and why to avoid unsupported legacy systems.

The NCSC highly encourages organisations to follow these priority actions:

1. Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619.
2. Update to the latest version of PHP and continue to monitor for future updates.
3. If you are unable to update to a version with the security update applied, the PHP Foundation have provided temporary mitigations.
4. If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.
5. If you are unable to update or disable the system immediately, you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker. If you are not confident in your ability to do this internally, then you can get assistance from an NCSC-assured Cyber Incident Response provider.
6. Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. Apply relevant updates as they become available.

PHP was developed in the early 1990s to help serve dynamic web pages and applications. It is used by website content management systems like Joomla, Drupal and WordPress.

Get an NCSC-assured Cyber Incident Response company: https://www.ncsc.gov.uk/schemes/cyber-incident-response/find-a-provider

PHP Foundation page: https://www.php.net/index.php

Your business might benefit from these state funding options

The government-established Office of the Small Business Commissioner (OSBC) has been publicising its Small Business Plan that offers tailored funding to smaller businesses.

Businesses change over their lifespan, and nearly all will need external funding to help them grow. In certain circumstances, external finance is critical for survival. The OSBC is highlighting funding options suitable for small businesses and sole traders.

For start-up businesses

The OSBC says there is more funding for Start Up Loans. These should support up to 69,000 firms over the next four years. The updated scheme has also extended the age of companies defined as 'start-up' from three to five years. As well as money, successful applicants will get a mentor to work with for a year.

The scheme provides £500 to £25,000 to start or grow a business. Unlike a business loan, this is an unsecured personal loan, and individuals will need to pass a credit check.

For more information, go here: https://www.gov.uk/apply-start-up-loan

For growing businesses

On 12 July 2026, the Chancellor announced an increase in capacity for the Growth Guarantee Scheme (GGS), which is administered by the British Business Bank. Under this scheme, the government guarantees up to 70% of the loan to the participating lenders. There are restrictions on what can be requested in the form of personal guarantees i.e. people are not asked to put their home on the line.

The updated scheme has an extra £6.5bn of market lending over the next four years to help an estimated 33,000 businesses. The terms include an increase in small company turnover level eligibility and will underwrite loans of up to £2 million.

There are a wide range of products supported by different lenders, including term loans, overdrafts, asset finance, invoice finance and asset-based lending.

For more information, go here: https://www.british-business-bank.co.uk/finance-options/debt-finance/growth-guarantee-scheme

For businesses raising from Community Development Finance Institutions (CDFIs)

The OSBC is reminding groups of the £150 million of Community ENABLE funding. This allows CDFIs to on-lend to small businesses. CDFIs are not-for-profit lenders who lend locally.

CDFIs are represented at a national level by Responsible Finance, which has been asked to work on a roadmap to expand the capacity of the CDFI network to support even more small businesses. The lender network helps individuals, businesses and social enterprises access alternative finance with free loan-matching services.

For more information, go here: https://responsiblefinance.org.uk/

For businesses upgrading boilers

As part of the ongoing national decarbonisation project, the OSBC is highlighting the Boiler Upgrade Scheme. Businesses can access a £7,500 grant to cover part of the cost of replacing fossil fuel heating systems with a heat pump or biomass boiler.

For more information, go here: https://www.gov.uk/apply-boiler-upgrade-scheme

For businesses affected by security concerns

UK tech start-ups and other innovation businesses can now apply for government support to protect their intellectual property from powerful competitors, including threats from other states and hostile actors.

Only up to 500 Small to Medium-sized Enterprises (SMEs) will be eligible to receive £2,500 to strengthen their security. This includes expert advice on strengthening checks on prospective employees to reduce insider threats and ensure their suitability for handling sensitive information and key cyber security measures to guard against common cyber-attacks.

It will be delivered by Innovate UK.

For more information, go here: https://www.gov.uk/government/news/new-backing-for-small-businesses-to-protect-their-intellectual-property-from-security-threats

For high-growth SMEs

The Intellectual Property Office (IPO) IP Audit Scheme provides part-funding of £2,250 (including VAT) towards the cost of an IP audit conducted by a suitably qualified IP professional. The business must contribute £750 towards the overall cost of the audit. This is delivered by IPO partners in all regions of the UK.

For more information, go here: https://www.ipo.gov.uk/ip-support/welcome

For businesses taking on apprentices

Alongside full apprenticeships, the Growth and Skills Levy can now support foundation apprenticeships and approved apprenticeship units. This aims to give businesses greater flexibility in addressing specific skills gaps, upskill employees faster and access shorter, targeted training programmes without committing staff to a full apprenticeship.

For SMEs that do not pay the levy, government support remains. From August 2026, non-levy employers receive 100% funding for apprentices aged 16 to 24, up to the funding band maximum. For apprentices aged 25 or over, employers contribute just 5%, with the government paying the remaining 95%.

Eligible non-levy employers may also qualify for a hiring incentive of up to £2,000 when recruiting a new apprentice aged 16 to 24 from October 2026.

For more information, go here: https://www.gov.uk/government/publications/apprenticeship-funding/apprenticeship-funding

For businesses offering industry placements

Businesses will have to be quick to benefit from this funding opportunity as it ends in March 2026. The Employer Support Fund has £1.8 million to support employers of all sizes delivering industry placements in the Construction T Level route and £4.5 million to support employers of all sizes offering industry placements for the Health T Level, and SMEs offering industry placements for all other T Levels.

For more information, go here: https://www.gov.uk/government/publications/employer-support-fund-construction-and-t-level-industry-placements#

For small firms in the legal sector

An extra £1.5m was announced for the LawTech UK programmes that are designed to support founders applying tech ideas to law. They offer support from ideation to scale, as well as organisations interested in harnessing the benefits of innovation for their legal operations. All education programmes are free.

LawtechUK is a Ministry of Justice (MoJ) backed initiative dedicated to driving digital transformation in the legal sector. As of April 2023, LawtechUK is managed by CodeBase and Legal Geek, on behalf of the MoJ.

For more information, go here: https://lawtechuk.io/our-programmes/

For exporters

UK Export Finance helps UK companies access and benefit from export finance (the particular class of loans, insurance policies or bank guarantees that easily enable international trade as securely as possible). It complements, not competes with the private sector.

There have been several recent announcements of more funding for UK Export Finance to be directed to small firms, with a confirmed commitment to support 1,000 SMEs per year by 2029. The most recent aimed at boosting exports to the economies of Brazil, Morocco and Mexico.

For more information, go here: https://www.ukexportfinance.gov.uk/

For businesses in the film sector

The UK Global Screen Fund (UKGSF) International Business Development provides non-recoupable grants for international growth strategies for the film industry spanning three to five years. The funding will support UK companies to develop and expand their turnover and scale of Intellectual Property (IP) creation, exploitation or acquisition. £75m has been allocated to develop independent screen content and showcase the best of UK and international film.

For more information, go here: https://www.find-government-grants.service.gov.uk/grants/uk-global-screen-fund-business-development-1

For businesses in the music sector

The UK music industry can benefit from new powers and investment as the government unveiled a new long-term plan to back the sector. The Music Plan commits to backing thousands of grassroots projects, over 40,000 artists and businesses, and millions of children to secure a thriving music industry.

The Music Growth Package has £30 million to support projects over three years. It is delivered by the Arts Council.

For more information, go here: https://www.artscouncil.org.uk/music-growth-package

For performing artists

The International Showcase Fund offers grants of up to £8,250 for international export opportunities for UK-based artists, bands, songwriters and producers who have been invited to perform or create new music at international industry-facing showcasing festivals, songwriting camps or conferences.

For more information, go here: https://prsfoundation.com/funding-support/funding-music-creators/international/international-showcase-fund/

The Office of the Small Business Commissioner (OSBC) is an independent public body established by Government under the Enterprise Act 2016 to tackle overdue payments and unfavourable payment practices in the private sector.

If you need help accessing funding and producing supporting accounts, please get in contact.

Poor IR35 assessments cost Cabinet Office £38.5m

HMRC have concluded that the Cabinet Office failed to take reasonable care when applying the Off-Payroll Working (IR35) rules. The Cabinet Office has set aside £38.5 million for unpaid Income Tax, National Insurance and interest. A penalty of up to £8.9m could follow.

The Off-Payroll Working (IR35) rules apply when an individual worker provides services to a client through their own limited company. They are essentially anti-avoidance provisions aiming to ensure that where a worker performs the same kind of work as an employee of the end-client, any fees paid in respect of the worker's services via the worker's PSC or paid directly to the worker are subject to Income Tax and National Insurance.

In this case, it was the responsibility of the Cabinet Office to assess whether IR35 applied to workers.

HMRC began reviewing the Cabinet Office’s status determinations in 2019, covering every engagement since the rules were extended to the public sector in April 2017. In October 2025, HMRC concluded that the department’s historic processes were inadequate and that it had failed to take reasonable care.

The Cabinet Office paid £15 million on account in February 2026 and made provisions for the remaining £23.5 million as part of an expedited settlement approach to bring the matter to a conclusion.

The final settlement is reported to be still under negotiation and a penalty of up to £8.9m may be charged for the failure to take reasonable care.

HMRC’s finding that reasonable care was not taken can attract a penalty of 15% to 30% of the net tax liability before interest.

The accounts do not say how the Cabinet Office made its determinations or exactly where it went wrong.

Commentators have pointed to HMRC’s Check Employment Status for Tax (CEST) tool, which they say returns an outside IR35 result where a right of substitution is indicated, whatever the other answers.

HMRC have previously asked the Ministry of Justice to revisit every determination made using the CEST tool, where managers said a substitute could be sent. The penalties for carelessness were suspended on the condition that they checked every outside determination.

Practical points

Penalties for careless inaccuracies are charged where there has been a failure to take ‘reasonable care’. 'Reasonable care' is not defined in legislation, but case law has established that it is generally what a prudent and reasonable taxpayer in the same position would have done. 

Therefore, if you are making employment status decisions it is advisable to keep a record of how each determination was reached, based on the contract and the actual working practices that are taking place.

If you use HMRC’s CEST tool, check that the answer given is what you expect. Where there could be doubt about a situation, it may be worth seeking and documenting professional advice.

If you need help with Off-Payroll Working or have any PAYE or National Insurance questions, please contact us. We would be happy to help you.

SME opportunities for British Army tactical power systems

UK Defence Innovation (UKDI) has launched a new Tactical Power Challenge on behalf of the British Army. The Innovative Tactical Power Solutions competition has a tight deadline, with submissions due by 10 November 2026.

Open to small businesses as well as large ones, the £2.45 million competition is looking for new technologies to help meet rapidly growing battlefield power demands. The challenge seeks solutions to improve the generation, storage, distribution and management of electrical power for deployed forces. 

Innovative Tactical Power is a two-stage funded competition seeking technologies currently at Technology Readiness Levels (TRL) four to six that can be developed into future tactical power capabilities. The amount of funding available is £2.45 million (ex-VAT). 

Successful innovators will progress through a staged assessment process and may receive funding to mature and demonstrate their technologies, with project activity expected to conclude by March 2028. 

The competition is specifically interested in technologies including: 

• Safer alternatives to lithium-ion battery chemistries with equal or greater energy density. 
• High-speed charging technologies.
• Innovative electrical power generation systems. 
• Power storage, management and distribution solutions. 
• Technologies that support silent operation and reduced logistical burden. 
• Soldier-carried and localised power generation capabilities. 
• Integrated tactical power systems and enabling components.

Both complete systems and individual components are welcome to apply.

Non-funded potential contracts

A second part of the new call to companies is the ‘Immediate Power’ project. This is a non-funded market engagement activity seeking technologies that are already at TRL Six or above and have the potential to address current operational requirements.

Innovators with solutions of particular interest may be invited to participate in future Army trials and experimentation activities within the UK.

For more information, start here: https://www.gov.uk/government/news/tactical-power-challenge-powering-the-future-force

HSE warns on noise and vibration risks

The Health & Safety Executive (HSE) has launched a campaign to help employers prevent permanent hearing loss, tinnitus and hand-arm vibration syndrome.

The HSE estimates that 15,000 workers develop hearing problems caused or made worse by work every year, while an estimated one in five workers is exposed to harmful levels of noise. 

At the same time, it also launched a new campaign to reduce Hand-Arm Vibration Syndrome (HAVS), including the Prevention Programme’s HAVS Risk Reduction Pledge. The campaign highlights the importance of taking action before workers’ health is affected.

Noise and vibration are common workplace hazards across sectors including construction, manufacturing, agriculture, utilities, waste management, engineering, maintenance and entertainment and events. Exposure often comes from tools, machinery and equipment used every day.

Hearing

Prolonged or excessive exposure to noise can cause permanent hearing loss and tinnitus. The effects can be permanent, with workers often unaware they are being harmed until symptoms begin to appear, by which time some damage may already be irreversible. 

Employers should assess workplace noise, reduce exposure and protect workers from preventable ill health.

Not only can hearing loss make conversations difficult to follow, but it can also hinder a worker from doing their job. Being unable to clearly hear instructions or warning alerts may reduce efficiency.

Tinnitus can cause persistent ringing or buzzing in the ears, affecting concentration and sleep.

Vibration

Likewise, hand-arm vibration can lead to HAVS and carpal tunnel syndrome, causing numbness, tingling, pain and reduced grip strength. These conditions can affect workers’ ability to do their jobs and carry out everyday activities, sometimes for the rest of their lives. 

For those living with HAVS, everyday tasks such as fastening buttons, holding a cup or using tools can become difficult. 

Employers’ responsibility

For employers, combating these threats should be a high priority as they have legal duties to assess and control workplace noise and vibration risks under the Control of Noise at Work Regulations 2005 and the Control of Vibration at Work Regulations 2005.
 
HSE’s recommendations

HSE’s campaign offers three steps to reduce risks.

Assess

Identify employees who may be exposed to noise and vibration, understand the risks and carry out suitable and sufficient risk assessments. Employers should be aware that even the most unexpected environment may produce excessive noise. 

Past research in Hong Kong found that most Cantonese restaurants frequently exceeded safe decibel levels.

Control

Reduce exposure at source by choosing quieter or lower-vibration equipment, maintaining tools and machinery, introducing engineering controls and adopting safer ways of working. This may include limiting the amount of time individual workers spend on specific machines.

Protect

Where risks remain, provide suitable hearing protection, arrange health surveillance where required, and give workers the information, instruction and training they need to protect themselves. It is also important that employers be aware that they need to enforce policies. Should ear protection be assessed as required, employees must wear it.

The campaign provides practical tools, guidance and resources to help employers assess workplace risks, put effective controls in place and prevent life-changing occupational ill health.

Campaign resources are available through HSE’s Work Right campaign: https://workright.campaign.gov.uk/noise-and-vibration/  

Entrepreneurs should have their say on barriers for start-ups 

The Parliamentary Business, Innovation, Science, and Trade Committee has launched a consultation into the difficulties facing new entrepreneurs and how they are supported.

The new inquiry follows the Committee's inquiries into Small Business Strategy and Investing in the UK Economy, which examined how businesses grow and access to scale-up finance. This previous enquiry found that small firms faced pressures comparable to those during the pandemic and risked business viability. The Committee later lamented the government’s response to their recommendations as ‘inadequate’.

Although it found that one in five adults were either starting or running a new business, it warned that opportunities and outcomes vary significantly between regions, sectors and demographic groups.

The new inquiry specifically focuses on new businesses and start-ups. It will consider:

• How do people start businesses?
• What are the conditions that support entrepreneurship?
• How effective are government policies at encouraging enterprise creation?
• How will the new department combine its new innovation policy to help?

It wants to examine the UK's entrepreneurial ecosystem, look at international comparators and explore the roles of education, finance, innovation and government policy in supporting business creation. It will also examine entrepreneurship in the skilled trades, including the journey from sole trader to employer, and the factors that help or hinder tradespeople in building viable businesses and taking on apprentices.

The inquiry will run until 12 November 2026 and seeks submissions from all sorts of entrepreneurs. All submissions will be read, but participants must read the Call for Evidence outline and respond to specific questions.

The Call for Evidence can be found here: https://committees.parliament.uk/submission/4001/#/evidence/4001/call-for-evidence

Businesses should evaluate their parking rules

Now is the time for small companies with customer car parks to review their policies, enforcement and signage as new parking rules are rolled out by the government. They will also apply to their employees who drive between jobs, as being knowledgeable may reduce costly fines.

Drivers will get new rights to challenge unfair private parking charges under the new Private Parking Code of Practice. This includes a guaranteed five minutes to decide whether to park and 10 minutes to leave once their session ends. They also have the right to have charges cancelled on appeal for issues they can’t control.

For many drivers, falling foul of a parking enforcement company and the subsequent process of appealing fines has proved a nightmare. The regulatory industry associations have long been criticised for ignoring voluntary procedures or being unable to enforce adequate penalties on firms that persist in being aggressive.

For the first time, the Code brings in a fully independent Scrutiny and Oversight Board and requires operators to share more information with government.

The new rules will see charges scrapped on appeal for honest mistakes, like stopping briefly to check directions and for situations like a medical emergency, breakdown or broken ticket machine.

For smaller slip-ups, like forgetting a parking permit, entering the wrong vehicle’s registration or forgetting to confirm it in the machine when parking, drivers will face a maximum charge of £20 on appeal.

The Code also freezes the maximum parking charge at £100. Operators that don’t comply risk losing access to DVLA data, meaning that even if they issue a charge, it will be far more difficult to identify the registered owner to pursue payment. 

Data show just under 17 million private parking charges were issued in the UK last year.