Accountants & Tax
Each week we review security news from the vendors businesses rely on, and pick out what matters. Here is the briefing for accountants & tax. Tax and financial records, tight deadlines and constant fraud attempts around filing season. We keep client data safe when it is busiest.
Security news worth knowing this week
- Critical PHP Core Security Flaws Affect Websites, Including WordPress (Search Engine Journal). Reported by Search Engine Journal: Critical PHP Core Security Flaws Affect Websites, Including WordPress. Read the source
- PHP2Shell Exploitation: Two Critical PHP Flaws Explained (Recorded Future). Reported by Recorded Future: PHP2Shell Exploitation: Two Critical PHP Flaws Explained. Read the source
- Australians facing spike in data breaches after 'critical' flaw uncovered (ABC News & Headlines – Australian Broadcasting Corporation). Reported by ABC News & Headlines – Australian Broadcasting Corporation: Australians facing spike in data breaches after 'critical' flaw uncovered. Read the source
- Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found (Blog – Wordfence). Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP. The post Why It’s Urgent to Update… Read the source
- Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) (AWS Security Blog). On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619… Read the source
See everything on our Security Insights page.
What this means for accountants & tax
- Protect client files and tax software
- Stop invoice and payment fraud emails
- Secure remote access during busy season
A simple checklist for this week
- Install updates for anything marked as actively exploited, starting with internet-facing systems.
- Check that multi-factor authentication is on for email, remote access and admin accounts.
- Confirm your backups ran and test restoring one file.
- Remind your team how to report a suspicious email, including payment change requests.
- Review who has admin access and remove anyone who no longer needs it.
How Synova can help
We help accountants & tax keep systems patched, protected and backed up, so a headline never turns into a bad day. Talk to us about a simple security review, or explore our services.
Frequently asked questions
How often should we review security updates?
Weekly for critical and actively exploited issues, and monthly for routine patching.
Where should a small team start?
Turn on multi-factor authentication, keep systems updated and test your backups. These three steps stop most common attacks.