TL;DR: Two critical PHP vulnerabilities could let attackers take control of systems that haven’t been updated, and they affect far more than websites. Make a list of everything your firm uses that runs PHP, then update it or take it offline until it can be fixed.

What are the critical PHP vulnerabilities?

If you’re reading this, you’ve probably seen the news about two critical PHP vulnerabilities, and attacks are already being reported. They’re known as CVE-2026-109618 and CVE-2026-109619.

PHP is the technology behind a huge number of websites and online systems. Security flaws are scored for severity out of 10, and both of these score 9.2. That is very high.

In simple terms, a criminal could use these flaws to take over a system that hasn’t been updated, with no password needed. So what do you need to do about it?

Where do you start with the PHP vulnerabilities?

You need to find every system your firm uses that runs PHP. Write a list, then check it again, because PHP turns up in places most people wouldn’t expect.

Your website

– Around 70% of websites are built with PHP. Ask your web developer if your site uses it, and get it updated today.

Third-party websites and hosting providers

– Any outside website that holds your firm’s information could be affected, such as a client portal. Your hosting provider should be able to tell you where they stand.

Firewalls and security equipment

– The equipment that protects your network can run PHP behind the scenes. Ask your IT team or supplier to check.

Phone systems

– Some VoIP phone systems, including those built on Asterisk, can be affected. Your phone system provider should be able to confirm this for you.

Network monitoring tools and load balancers

– These are systems your IT team uses to keep your network running smoothly. They’re easy to overlook, so make sure they’re on your list.

Routers and storage devices

– Small office routers and home routers can be affected. So can NAS devices, which are the storage boxes some firms use to hold shared files.

Building security systems and printers

– Door entry systems and similar building security can run PHP. Many office printers can too, so add them to the list.

What should you do next?

Suppliers are rushing out emergency updates to fix the problem. For any websites and equipment you manage yourself, update them as soon as possible.

The fixed versions of PHP are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions will not get an official fix. If you’re running one of these, move to a supported version or ask your supplier for a patch.

If you can’t update straight away, the UK National Cyber Security Centre advises that you consider taking the system offline until you can.

Think about the impact of the change too. This matters most if a system hasn’t been updated in a long time and is running a very old version. Your web developer and IT team should be able to assess that for you.

Can AI help you check your systems for PHP?

Yes, and it can save a lot of time. Make a list of your network equipment by make and model, then add the software and websites your firm uses.

Ask Copilot to review the list and point out anything likely to run PHP. Then check with each supplier to see if they have already fixed it, or have an update ready for you to install.

Only use AI your firm has approved

Only do this if your firm has approved sharing this kind of information with AI. Use a business AI platform, such as Microsoft 365 Copilot or a paid Claude Team or Enterprise account.

Don’t share more than you need to

The AI only needs the make and model of your equipment and the names of your software. Never include passwords or anything that shows how your network is set up, such as IP addresses or network diagrams.

Need help with the fixes?

If you’re not sure where to start, Labyrinth Technology can help you work through it. Get in touch.

TL;DR: Microsoft Copilot for Legal adds more than 20 legal skills to Microsoft 365 Copilot, though UK firms will still need their existing research subscriptions. Before switching it on, check your SharePoint permissions and get an AI policy and staff training in place.

What is Microsoft Copilot for Legal?

Microsoft Copilot for Legal is a set of more than 20 legal skills included in paid Microsoft 365 Copilot licences. It launched on 15 October, some time after legal AI specialists had already established themselves in the market.

Matt Dunn, CTO at Labyrinth Technology, doesn’t see that as a problem for Microsoft.

“Microsoft is late to legal AI, but that may not matter,” he says. “The firms I work with already trust Microsoft with their data, and that trust counts for a lot more than being first.”

The skills work inside Word and in Cowork, Microsoft’s workspace for tasks that run across several files. The legal plugin in Word desktop is switched on by default, while Cowork users need to add it themselves.

What can Copilot for Legal do for law firms?

Microsoft groups the skills into a handful of areas. These are the ones most firms will notice first.

Contract review and negotiation

Copilot can analyse an agreement and compare it against your firm’s playbooks. It proposes edits as tracked changes in Word and flags any provisions that need attention.

Legal analysis and research

It can break down a complicated legal problem and point out where requirements differ or where gaps might exist.

Drafting legal documents

It creates standardised legal documents using your firm’s approved, branded templates.

Managing matters

It builds chronologies for your cases and flags key issues alongside any open questions.

Which legal tools does Copilot integrate with?

The partner list is long, and Microsoft says more plugins will follow.

Legal research

Bloomberg Law, Trellis, Descrybe Legal Engine, Legal Data Hunter, Courtroom5 and Lawstronaut.

Document and matter management

iManage Work, NetDocuments, Box, Litera, Thomson Reuters’ HighQ, LegalZoom and Solve Intelligence.

Contracts and e-signature

Docusign, Juro, Adobe Acrobat Sign, LawVu, SignatureAPI, Dropbox Sign and PandaDoc.

Legal AI and e-discovery

Harvey, Legora, Relativity and Everlaw.

Thomson Reuters and LexisNexis are notably absent from legal research.

“I suspect they’re missing because they’re pushing their own AI products,” Matt says.

Thomson Reuters has connected CoCounsel to Claude, and LexisNexis has built Claude into Protégé.

Is Copilot for Legal useful for UK law firms?

Most of the research tools listed are US-based. UK firms won’t get much English case law out of Bloomberg Law or Trellis, and the same goes for Courtroom5. You’ll still need your existing research subscription.

The drafting and contract skills work from your own templates and playbooks, so the US slant matters less there.

What should law firms check before switching it on?

SharePoint permissions

Copilot can see whatever the user can see. If access across your SharePoint sites hasn’t been set up properly, it may show people documents they shouldn’t have, so this is the first thing to check before rollout.

An AI policy and staff training

Your team needs clear guidance on what Copilot can be used for before you roll it out. Some training will help people get useful results and understand where the tool’s limits are.

Reviewing every output

Everything Copilot produces still needs checking before it goes anywhere near a client. The skills can save time on drafting and review, but responsibility for the final work stays with your lawyers.

How can Labyrinth Technology help?

Labyrinth Technology has supported law firms across the UK for over a decade, and Microsoft 365 is a core part of what we do. We can review your SharePoint permissions and help prepare your firm for Copilot before anyone uses it on client work.

If your firm is already using Copilot, we would be interested to hear how you’re getting on. If you’re still weighing it up, get in touch for a chat about where to start.

TL;DR: The SRA AI warning notice, published on 17 August 2026, tells solicitors and firms that using AI does not reduce their professional responsibility. It flags two problems: false information in court documents, and client data ending up in public AI tools without proper safeguards. If your firm has no policy on this yet, you must write one as soon as possible.

What Is The SRA AI Warning Notice?

The SRA published a warning notice on 17 August 2026 about the misuse of AI in legal services. It applies to every firm and solicitor the SRA regulates. The notice reminds you that your existing obligations under the SRA Principles and Codes of Conduct still apply, whatever tool produced the work.

Why Did The SRA Issue This Warning Now?

According to Legal IT Insider, the SRA received 42 reports of potential AI misuse between July 2025 and July 2026. That was enough to trigger a formal notice rather than a quiet word. If your firm treats AI use as a personal choice for each fee earner, that gap is what the SRA now expects you to close.

What Are The Two Main Risks Flagged?

The notice comes down to two core problems, AI hallucinations and confidentiality concerns.

What Counts As An AI Hallucination In Legal Work?

An AI hallucination is when a tool generates a case, a citation, or a fact that sounds real but does not exist. The notice points to four recent cases where this caused real problems in court.

Ayinde v Haringey LBC

Fabricated citations reached the court in this case, leading to a wasted costs application and a referral to the regulators.

UK v Secretary of State for the Home Department

This tribunal case involved inaccurate AI-generated authorities, and also raised the confidentiality point covered below.

BCP v A Mother

An unregistered barrister included AI hallucinations in her submissions. The court found no intent to mislead, but felt she underestimated how serious that was.

Cork and another v Smith

The High Court again set out the responsibilities on lawyers when errors trace back to unchecked AI output.

How Does AI Put Client Confidentiality At Risk?

In the UK v SSHD case, the tribunal compared putting client letters into an open tool such as ChatGPT to putting that information online. It becomes permanent and public. Privilege can be waived with no way back. This is not limited to free tools. Paid products can carry the same exposure, depending on their contractual and technical safeguards.

What Happens If Your Firm Ignores The SRA AI Warning?

The SRA has said plainly that firms failing to have proper regard to the notice risk disciplinary action. It ties this to Principles including honesty, integrity, and acting in clients’ best interests. It also points to supervision duties. If a junior colleague submits a hallucinated citation and nobody reviewed it, the supervisor can also be found in breach.

What Should Your Firm Do?

You do not need to stop using AI. You need a way of using it that you can defend if the SRA ever asks.

How Can You Reduce The Risk Of AI Hallucinations?

Every citation, case reference, and factual claim generated by AI needs a human check before it goes near a client or a court. Build a sign-off step into your process where someone other than the drafter checks each AI-assisted citation.

How Can You Protect Client Confidentiality When Using AI?

Client information should never go into a public AI tool your firm has not reviewed and approved. Know whether the tool stores data, trains its model, or lets others access it. Labyrinth Technology’s managed security services keep client data inside environments where those answers are known. Authentication solutions control who can reach that data in the first place.

How Should You Roll Out AI Tools Across Your Firm?

Ad hoc AI use, where everyone picks their own tool and works out the risks alone, is no longer defensible. Firms need vetted tools, trained staff, and someone checking the rules are followed.

Matt Dunn, our COO and CTO, puts it bluntly:

“Train your fee earners. Regularly. Don’t hide behind a policy. A one-off training session doesn’t cut it.”

They need to know which tools are approved, how they can be used, and what their responsibilities are to check the output.

Labyrinth Technology’s AI implementation and training service replaces scattered AI use with a governed setup you can point to if the SRA ever asks.

The SRA already holds 42 reports of AI misuse on file. One fabricated citation with your firm’s name on it would make that 43.

TL;DR: Passwordless authentication is becoming the standard way to log in, and Microsoft will retire SMS and voice-based MFA for Microsoft 365 on 1 February 2027. If your firm still relies on text message codes, now is the time to plan the switch to passkeys.

Why passwordless authentication matters to your firm right now

Microsoft has confirmed that SMS and voice authentication for Microsoft 365 stops working on 1 February 2027. From September 2026, staff using text codes will start seeing prompts to set up a passkey instead. It affects every partner and every member of staff who logs into email or your case management system.

The National Cyber Security Centre has also changed its position. In April 2026, at CYBERUK, it announced it will recommend passkeys “wherever a service supports them”. For a law firm holding privileged client information, any delay in tightening login security is a delay in reducing your exposure to phishing.

What is passwordless authentication?

Passwordless authentication means logging in without typing a password. The most common form is a passkey. When you set one up, your device creates two matching digital keys. One stays on your device, the other is held by the service you are logging into.

When you log in, your device and the service check that their two keys match. You confirm it is you by unlocking your device with a fingerprint, face scan or PIN. Nothing gets typed, and nothing travels across the internet that a criminal could intercept.

This is what makes passkeys effective against phishing. A fake login page can look identical to the real one, but it cannot request the key on your device, because that key only responds to the genuine website it was created for. Even if a member of staff clicks a convincing phishing link, there is nothing for them to hand over.

Why is Microsoft retiring SMS and voice MFA?

Text messages and phone calls can be intercepted, and attackers have got better at tricking people into approving codes they never requested. Passkeys close that gap entirely.

Matt Dunn, COO and CTO at Labyrinth Technology, explains:

“Phish-resistant multi-factor authentication, such as passkeys, is extremely effective in combating the risk of phishing attacks. This is because it uses a device-bound key which cannot be compromised through a traditional email phishing or man-in-the-middle attack.”

The timeline is fixed. From 1 September 2026, Microsoft prompts SMS and voice users to register a passkey. From 1 February 2027, Microsoft-provided SMS and voice authentication stops working, with no opt-out.

“We’ve started talking to our clients about this, and it’s already clear this change will create a lot of friction,” Matt adds.

What is MFA fatigue and why does it matter for law firms?

MFA fatigue is when an attacker who already has your password sends repeated approval requests to your phone, hoping you eventually tap “approve” just to stop the notifications. Passkeys remove this risk, since there is no approval prompt to accept.

This matters more where client money is involved. Action Fraud recorded 143 cases of conveyancing fraud between April 2024 and March 2025, with losses of £11.7 million and an average loss of £78,393 per case. Most follow the same pattern: an attacker gets into an email thread and sends convincing instructions to change bank details at completion. Passkeys make that initial compromise far harder to achieve.

What should law firms do before the February 2027 deadline?

Audit who is still using SMS or voice MFA

Ask your IT provider for a list of every user still relying on text or phone call authentication. This is the group who will see prompts from September 2026.

Roll passkeys out in stages

Start with a small group that includes at least one partner, so you catch device issues early. Pay attention to staff using personal phones under a bring your own device policy, since their settings tend to be less consistent than firm-managed laptops.

Check your case management system

Confirm whether it supports passkeys directly, or only through your Microsoft 365 login, before you switch everyone over.

How Labyrinth Technology helps

Labyrinth Technology’s authentication solutions already supports passwordless authentication for clients moving away from passwords and one-time codes. For firms on Microsoft 365, that typically starts with Microsoft Entra ID passkeys, with WatchGuard AuthPoint or Okta for firms needing more advanced access controls.

Microsoft’s deadline is 1 February 2027. From today, that gives you under six months to get every partner and every fee earner switched over before the fallback disappears.

Get in touch today.

TL;DR: SRA AI guidance makes solicitors personally responsible for anything AI produces, including research and court submissions. Two firms have already been referred to the SRA this year after AI-generated citations turned out to be fake. Verification, staff training, documented use and client disclosure are what the SRA expects firms to have in place.

What does the SRA’s AI guidance actually say?

The SRA has not written a rulebook for AI. Its compliance tips, last updated in February 2026, restate the Code of Conduct and apply it to AI tools directly.

You stay responsible for your work, whoever/whatever produced the first draft. Client confidentiality applies regardless of the platform. And you must understand a tool well enough to spot when it has got something wrong.

Who is responsible for AI compliance in your firm?

The SRA expects your Compliance Officer for Legal Practice (COLP) to take ownership of AI governance across the firm.

That means someone specific is accountable for how AI tools are used and checked, with the authority to enforce it.

Why are solicitors being referred to the SRA over AI use?

Pinsent Masons referred itself to the SRA after a junior solicitor used AI to research a point of insolvency law. The tool invented a statutory provision that did not exist, and it made it into a letter to the court. Two senior solicitors had signed that letter off without catching the error. (Source – Law Gazette)

In a separate case, Rodney v Gee’z Micro Bar & Pitstop, His Honour Judge Grimshaw referred two solicitors at AML Legal after a skeleton argument cited authorities that turned out to be fabricated. One document even included the line “your client was a litigant in person,” language the judge noted read like something generated rather than written by a lawyer. (Source – Law Gazette)

Judge Grimshaw called for a “robust approach” from the courts, describing fake AI citations as a growing threat to the justice system. Neither case involved a rogue actor trying to deceive the court. Both involved firms that skipped the verification step.

See what Matt has to say

What should your law firm have in place to meet SRA AI guidance?

Governance does not need to be complicated. It needs to exist and be followed.

Verify every citation before it leaves the building

Any citation or quotation an AI tool produces gets checked against the primary source before it reaches a client or a court. No exceptions for time pressure.

Train staff on what AI can and cannot do

Staff need to understand that a confident, well-formatted answer from an AI tool can still be entirely wrong, these are known as AI hallucinations.

Keep client data out of AI tools

AI tools can store and reuse whatever is typed into them, so confidential client information should never go near one. The confidentiality duty always applies, no matter which tool is involved. What matters most is knowing where shadow AI might be creeping into your firm, and training staff to use only the tools you have approved.

Record AI use in the matter file

If AI contributed to research or drafting, note it. This protects the fee earner and gives the firm a clear audit trail if something is later questioned.

Tell clients when AI is part of the process

The SRA’s guidance is explicit on this point. Clients should be told when AI is involved as a normal part of client care.

How Labyrinth Technology can help

We work with law firms across the UK to put the practical structures behind compliance guidance like this. That means secure systems for how AI tools connect to your data, and IT support that understands why a law firm’s obligations are different from a typical small business.

If you are reviewing how AI is used across your firm, we can help you build the policies and secure systems that sit behind it.

Two firms have already been referred to the SRA this year over uncaught AI citations. The next one is being decided right now, one verification step at a time.

We are pleased to announce that Labyrinth Technology is now a NetDocuments partner. We have been working with law firms running NetDocuments for years, and this partnership formalises that relationship.

What is NetDocuments?

NetDocuments is a cloud-based document management system built specifically for law firms. It is the system your firm’s documents and matter files are built around. A large number of UK firms have made it the foundation of how they manage their practice, and adoption has been growing steadily.

If your firm is already on NetDocuments, you will know how much of your day-to-day operation depends on it working reliably. A failed migration or a platform issue has an immediate knock-on effect across the whole practice. Having an IT partner who knows NetDocuments properly means you are far less likely to find yourself in that position.

Why this partnership matters for your firm

As a NetDocuments partner, Labyrinth Technology now has a direct relationship with the platform and its support infrastructure. For you, that means faster resolutions and better-informed guidance when your firm is planning anything significant on the platform.

We have dedicated in-house NetDocuments product owners who work with the platform day to day, which means the support your firm gets is grounded in real working knowledge of it. That knowledge is what makes the difference when something needs to move quickly.

This is not a new area of work for us. We have been supporting firms through NetDocuments implementations and migrations for a number of years. The partnership reflects experience we already had.

What Matt Dunn, CTO and COO at Labyrinth Technology, had to say

“As a specialist IT partner for law firms, we’ve spent a decade helping firms that put NetDocuments at the heart of their practice. Managing matters, documents, and client data with confidence.

NetDocuments is strategically important to our clients, so it’s strategically important to us.

With dedicated in-house NetDocuments product owners, we bring deep platform expertise that will translate directly into faster rollouts, smoother migrations, and ongoing support your team can rely on. We’re proud to formalise that commitment through this partnership.”

How can Labyrinth Technology support you

This partnership sits alongside everything else Labyrinth Technology does for law firms. We support firms across Microsoft 365, network security, backup and disaster recovery, and cloud migrations.

NetDocuments also integrates directly with Microsoft 365, so if we already support your firm’s Microsoft environment, the two areas of support connect naturally.

If you would like to talk through what this means for your firm, get in touch with the team.

Every law firm I talk to is asking about Claude Legal at the moment.

Claude, Copilot, Lexis+ AI, Harvey, Thomson Reuters, Clio. The list goes on.

How do you stay ahead without ending up with 5 different AI subscriptions per person that most people are not using?

Here are some of my recommendations from experience.

1. Dedicated research team

It’s a good idea to have a test group of ‘power users’ from different roles across the business to be trying out new AI tools and features and seeing which ones deliver the most value. There needs to be some guard rails and governance here though.

You don’t want to be rolling out new tools every week, or you’ll end up needing an expensive digital transformation project in a year to unpick and consolidate it all!

You also need to do your cyber security due diligence and make sure anything you are testing is set up properly, securely and the data it leverages is ready (accurate, access controlled correctly etc.)

2. Lead with the requirements

Many other law firms are using or experimenting with these tools. So it can be easy to jump to leading with the solution and trying to make it fit.

Take the time to understand how fee earners work, sales, marketing, HR, accounts. Understand their pain points and where AI could save them the most time. Then you can look at matching a solution to those requirements.

3. Measure ROI

The reality is that most law firms will benefit from a combination of these tools to suit different requirements and business functions. Lexis+ for example only uses data from trusted legal sources. Copilot and Claude can leverage Microsoft 365 data and meet you where you work.

But can you clearly demonstrate and measure the ROI from each of these tools? Do that per department and consider whether each one is actually needed by everyone in the business.

4. Governance

You need to define how each of these tools will be used, and consider the appropriate quality, ethical, legal and data privacy implications.

Document it, but make it clear, concise and don’t hide behind policies. Train your team. Regularly. They will forget, trust me.

Look at technical controls to enforce your AI policies.