Why I Stand with Joe Tidy, The BBC’s Cyber Correspondent

On Thursday 22 October 2026, in the middle of the biggest web security emergency in years, the BBC’s live coverage carried a line about its cyber correspondent, Joe Tidy. He said he hadn’t known PHP existed until the morning before and called PHP one of those things we take for granted.

Within hours the screenshot was everywhere. X, Bluesky, LinkedIn, Mumsnet, even football forums. Hundreds of people lined up to mock him, and the pile on he experienced was immense.

I want to say this clearly before anything else – Joe has my 100% support. I’m not technical myself, and I know exactly how this kind of pile-on feels from the inside.

What Happened

2 critical flaws in PHP, now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), leaked online before the fix was ready. The PHP team rushed out emergency updates on 21 October. Governments, councils and the BBC itself took websites offline as a precaution. PHP sits underneath WordPress, Drupal, Joomla and a huge share of the web – even my websites are driven by PHP. Wiz estimated roughly 70% of the internet was affected, a figure the BBC said it was unable to verify.

Joe worked on the story from the start. He co-wrote the BBC’s main news report, explained how AI tools helped researchers find flaws hidden for over a decade, and spoke to the IT teams working through the night to patch millions of websites. He even reported on what IT teams on the front line of this were going through.

Out of all that work, a single sentence on a live BBC blog became the story about him.

The Reaction

Some of the comments asked how he had ever been given the job. Others put the word expert in sarcastic quotation marks. One suggested the BBC hadn’t fired enough journalists yet. A LinkedIn post questioned whether he was properly qualified for the role, and a HackerNoon article used his comment to argue tech journalists lack real expertise.

I’m not naming the people behind those posts. Cyber Kindness exists to challenge ideas and respect people, and naming individuals here would turn this article into another pile-on. I won’t do to anyone what I’m asking others to stop doing to Joe.

What Joe Said Next

On 23 October Joe posted a video that he shared to his social media channels including Bluesky. You can see the video here. He said he isn’t, and has never claimed to be, a coder or a cyber security practitioner. Cyber is his reporting beat. He is a reporter, and he is learning every day. He thanked the cyber experts who had helped him over the previous 48 hours.

That is a grown up, honest response. It is also the exact behaviour we ask of everyone in this industry. Know your limits, ask people who know more than you, keep learning and say thank you. These are all things that I do every day in the industry.

The Part I Won’t Pretend Doesn’t Exist

Some critics have a fair point because PHP is not obscure, and plenty of people in tech were surprised a cyber correspondent hadn’t come across the name before. You’re allowed to be surprised.

Surprise and cruelty are different things though. A fair response says, “I’m surprised that Joe doesn’t know what PHP is, here’s what it is and why it matters.” A pile-on says the person has no right to be in the job.

Joe’s job is to find out what happened, ask the people who know and explain the story to millions of people who have never heard of PHP either. On this story, he did his job, and he did it well.

Tall Poppy Syndrome, Again

In September I wrote about tall poppy syndrome here on Cyber Kindness, and why we still cut down the people who speak up. Joe is a tall poppy. He became the BBC’s first ever cyber correspondent in 2018. His BBC documentaries have millions of views. His book, Ctrl+Alt+Chaos, about teenage hacking gangs, came out in 2025 to strong reviews. When someone so visible admits a gap, some people see a chance to cut them down to size.

The research I cited in September shows what happens next. In the Women of Influence+ Tallest Poppy study, 75% of respondents said being cut down reduced productivity, and 77.5% said it damaged trust within their team. People go quiet, and some leave altogether.

What gets me the most about this whole situation is that Joe told the truth. If the reward for honesty in cyber security is public ridicule, the next journalist, correspondent, analyst or graduate starter will bluff instead, and bluffing is how incidents get worse.

I Have Been Called a Fraud Too

Earlier this year, people in this industry I had respected publicly called me a “cyber fraud”. They mocked my award nominations and wins, and I’ve faced assumptions a PR company writes my award entries. Spoiler alert – I don’t have one, and even if I did, award nominations are NOT something I would focus on. To this day, I have NO idea who has nominated me for anything. I wish I did know though, so I could thank them personally (hopefully they will see this and know how grateful I am). I’ve been told more than once I’m not technical enough to be in cyber security. Even though my name was not actually mentioned, it didn’t take a rocket scientist to work out that it was me they were talking about.

I went through a maelstrom of different emotions – I was hurt, then angry, then for a few days I seriously considered deleting all my achievements from social media including any mention of my MBE and leaving the industry altogether. Thanks to some very good and close friends in the industry who helped me through it, I didn’t do that and instead, the idea for Cyber Kindness was born. I also know how close I came to doing it and walking away though, and I know people who did walk away after experiences like mine.

So, when I saw the screenshot of Joe, I didn’t see a punchline – I saw a pattern I know far too well.

I’m Not Technical, and I Belong Here

I came into cyber security from journalism and broadcasting, joining Titania Ltd over 17 years ago. I can’t write PHP. I couldn’t explain how memory corruption works inside an interpreter. What I do well is explain a cyber-attack to a board, a worried member of staff or a TV and radio audience in plain language. That skill is part of security too.

Our industry needs coders, analysts and threat hunters – of course it does. It also needs communicators, trainers, writers and journalists. Joe is one of the best communicators we have and is a brilliant journalist. Every time he explains an attack on the BBC, millions of people learn something about protecting themselves.

As a Co-Founder of International Imposter Syndrome Awareness Day, I noticed something else. Several people on Bluesky said they were saving the screenshot for the next time imposter syndrome hits, as a reminder even the BBC’s cyber correspondent is learning on the job. That is the healthiest response to this whole episode I’ve seen, and I’ve saved the screenshot for the exact same reason. When imposter syndrome strikes me, or if I find myself the subject of a pile on targeting the fact I don’t belong in cyber security, it will be a reminder of how I am learning in this industry every single day.

The People Who Stood Up in Support of Joe Tidy

Not everyone joined in, and I want to thank the people who didn’t join in and spoke up in support of Joe including:

Graham Cluley who reminded Bluesky that Joe is the reporter who strung along a ransomware gang trying to recruit him as an insider, then explained the story to millions. He wrote: “Pile-ons are what bad communities do,” and he is absolutely right. He also said our industry needs more good communicators, not people sneering at them.
Javvad Malik, Lead CISO Advisor at KnowBe4, wrote on LinkedIn about gatekeeping. He argued mocking people for admitting what they don’t know drives away the people security needs most.
Ant Davis, host of the Click Happens podcast, recorded a video explaining why the pile-on missed the point and why not every role in cyber is technical.
Davide Del Vecchio, a CISO, said on LinkedIn he felt sorry and ashamed of how our community treats non-technical people, and asked us to take care of each other.
Ciaran Martin, the founding head of the UK’s National Cyber Security Centre, says Joe Tidy has genuine cyber security expertise, and there is more than one way to be valuably expert in cyber.
Stuart Aston, who is retired, said admitting what you don’t know builds trust, and shaming people for it only teaches others to lie.
Jonathan Davies, CEO of Pervade Software, said people like Joe Tidy do more for public cyber awareness than most of the industry, and kindness costs nothing.
Gary Hibbert FCIIS, Founder of Consultants Like Us, said Joe Tidy should not quit, because his reporting does more to protect people from cyber attacks than most of the professionals piling on him.

If I have missed any of you, please do let me know via lisa@cyberkindness.org.uk and I’ll add you to this list happily. And to everyone who has supported Joe through this, thank you all. This is what speaking up in the moment looks like, which is what I am doing now.

Take the Pledge to Support Joe

I’m asking you to do something simple. Click here to take the pledge to support Joe Tidy. By signing it, you commit to:

Challenging ideas, not mocking people or engaging in a pile-on
Answering a gap in someone’s knowledge with an explanation, not a sneer
Speaking up when you see a pile-on, in public and at the time
Valuing communicators, trainers and non-technical people as part of cyber security
Being honest about what you don’t know, so others feel safe to do the same

Take the pledge to support Joe Tidy.

Joe, if you read this, you told the truth, you did your job and you thanked the people who helped you. That is what good looks like in this industry, and I applaud you massively for it. You have my 100% support, and I hope after reading this, you’ll know you have the support of many others too.

If you have been on the receiving end of a pile-on like this, I would love to hear from you at lisa@cyberkindness.org.uk.