How secure are small businesses in Cambridge?
An independent outside look at the websites of 89 local businesses, and the plain fixes that close most of the gap.
Most small businesses in Cambridge are not careless with security. They are busy, and most have never been told that an afternoon of free changes to their DNS and their hosting would close the majority of what an outsider can see. This report measures the gap for the whole local economy at once, using only what a stranger on the internet can already read, and points at what to do about it.
I spend most of my time securing infrastructure, from courthouses to municipal water utilities, and there are always holes: something does not work the way it was designed, something failed, or something was overlooked, on the physical side and the digital side alike. I see it all the time: a temporary fix becomes permanent, and that becomes the vulnerability. Small businesses are no different. We look after the physical side without thinking about it. A broken door, a lock that does not latch, a camera someone has covered: we see those and fix them the same day. The biggest change in the last thirty years is that a criminal no longer has to drive to your business. They can reach it from the other side of the globe without getting out of their chair, and the damage is just as real. We need to take the same steps on the digital side: at least put a lock on the front door, or at least close it. This is not name and shame. It is meant to draw attention to things we do not normally pay attention to.
The businesses here were found in public directories, the chamber of commerce, business improvement areas, and municipal listings, covering Cambridge, including Galt, Preston, Hespeler, and Ayr in North Dumfries. Chains, franchises, government, hospitals, and school boards were left out. Each one was checked using public DNS records and a single visit to its home page. Nothing was scanned, probed, or logged into, and no business is named.
The findings for Cambridge
| Finding | Count | What it means |
|---|---|---|
| Exposed to the PHP2Shell bug | 5+ | Advertising an unpatched or unsupported PHP version. A floor, since most sites hide the version. |
| Can be impersonated by email | 65 | 90% of mail-receiving domains, with no enforced DMARC to stop a forged invoice. |
| No SPF record at all | 8 | Anyone can send email as them, with nothing to flag it. |
| Behind on WordPress | 7 | Of the 20 WordPress sites that reveal a version. 37 run WordPress in total. |
| Still loading a 2016 code library | 5 | jQuery 1.x, retired in 2016 and no longer patched. |
| HTTPS set up properly | 86% | 1 serve a broken, expired, or missing certificate. |
| Dead or parked domains | 6 | 4 no longer work, 2 show a placeholder. An abandoned domain can be re-registered by anyone. |
The PHP bug that put this on the map
On October 21, 2026 the PHP project shipped an emergency fix for 2 critical flaws, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10, and both let an attacker take over the web server with no password, on the most common setup, before the site's own code runs. The United States cyber agency added them to its must-patch list on October 26. PHP runs most of the web, so this reaches ordinary small-business sites, not just big targets.
In Cambridge, at least 5 business sites are advertising a PHP version that is either behind the fix or on a release line PHP will never patch. Read that as a floor. The great majority of sites hide their version, so the true number is higher. If your site runs on WordPress or almost any other common platform, it runs on PHP, and the fix is to make sure your host has updated it.
The one most people have never heard of
Email impersonation is the quiet risk, and it is the most common gap here. 90% of the businesses in Cambridge that receive email have no enforced DMARC record. In plain terms, a scammer can send an invoice, a quote, or a password reset that looks like it came from the business, and the customer's mail provider has nothing configured to stop it. Invoice fraud against small businesses almost always starts exactly this way. The fix is 3 DNS records, SPF, DKIM, and DMARC, and it costs nothing but the time to set it up.
What a Cambridge business should do first
- Stop people sending email as you. Publish SPF, turn on DKIM, and set DMARC to quarantine or reject.
- Patch the platform, hide the version. Keep WordPress, its plugins, and PHP current, and turn off the version numbers.
- Force HTTPS and keep it on. Redirect to the encrypted site and add an HSTS header.
- Turn on multi-factor authentication. On the website admin, the email, and the hosting panel. Remove old accounts.
- Mind the domains you are not using. Keep them renewed with mail off, or let them go on purpose.
Common questions
How many small businesses in Cambridge can be impersonated by email?
About 90%. 65 of the 72 businesses that receive email have no enforced DMARC record, so a scammer can send mail that appears to come from them and the recipient's mail provider has nothing that stops it.
How many sites in Cambridge are exposed to the PHP2Shell bug?
At least 5 advertise a PHP version that is unpatched against PHP2Shell (CVE-2026-109618 and CVE-2026-109619) or on a release line that will not be fixed. Most sites hide their version, so the real number is higher. PHP2Shell is a critical, actively-exploited bug that lets an attacker take over a web server with no password, disclosed October 21, 2026.
Is this a hack or a scan of Cambridge businesses?
No. Every figure comes from public DNS records and a single ordinary visit to each home page. Nothing was scanned, probed, or logged into, and no business is named.
What should a Cambridge business do first?
Turn on an enforced DMARC record with SPF and DKIM, patch the website platform and PHP, force HTTPS with HSTS, enable multi-factor authentication on the admin and email accounts, and keep unused domains renewed with mail disabled.