Good morning. The last day brought a maximum-severity flaw in a tool a lot of businesses quietly rely on for reporting, a vishing crew that keeps talking its way past multi-factor, and OpenAI making a move that says a lot about where the AI money is going. Here are the five stories worth your attention if you are running a small or midsize business, or leading its IT.
A perfect-10 flaw in Metabase is being exploited right now, and scanners may not even flag it. Attackers are actively abusing a maximum-severity zero-day in Metabase, the popular open-source analytics and dashboard tool, that lets an unauthenticated intruder gain admin access and steal the stored credentials for every database connected to it. It rates a CVSS 10.0 and affects versions 1.58 and later, but there is a catch: no formal CVE number was assigned at disclosure, so security scanners that rely on standard vulnerability feeds may not warn you that you are exposed. If anyone at your company stood up Metabase to visualize sales, finance, or operations data, treat this as urgent, get it patched, and rotate any database passwords it had access to. This is the kind of tool that gets installed once and forgotten, which is exactly why attackers like it. Read more at The Hacker News
A vishing crew keeps talking its way past multi-factor by calling your help desk. The threat group tracked as UNC6671 is running a wave of voice-phishing attacks where callers pose as IT help desk staff, get an employee on the phone, and walk them onto a fake login page that captures both their password and their multi-factor code in real time. From there the attackers pivot into Microsoft 365, Okta, and connected apps like Salesforce to steal data and extort the company. The group has been leaning on financial and professional services firms in particular. The uncomfortable lesson is that your multi-factor setup does not help much if an employee hands over the code to a convincing caller. A quick reminder to your team that IT will never call to ask for a login or a code, plus a simple verify-before-you-trust habit, blocks the whole play. Read more at The Hacker News
OpenAI is building a company just to get AI into production, and that tells you something. OpenAI launched a new Deployment Company aimed at helping organizations actually put frontier AI to work and turn it into measurable business results, and it acquired an applied-AI consulting firm, Tomoro, to staff it with roughly 150 deployment engineers. The signal for the rest of us is clear: even the company that makes the models has decided the hard part is not the technology, it is getting it to stick inside a real business. If your own AI efforts have stalled at the demo stage, you are not behind, you are in the same spot as most companies. The work that pays off is picking one workflow, wiring AI into it properly, and measuring the result, not buying a bigger subscription. Read more at OpenAI
AI-assisted shopping searches jumped 200 percent in a year, and it is changing how customers find you. New data this week shows AI-assisted shopping, where buyers ask a chatbot or AI search tool for recommendations instead of scrolling a results page, has surged 200 percent year over year. For a small business, that means a growing share of potential customers are getting a shortlist from an AI before they ever visit your site or read a review. If your business is not showing up in those answers, you are invisible to that buyer. It is worth asking a few AI tools what they say about your industry and your company name, then making sure your website, listings, and reviews give those systems accurate, current information to pull from. Read more at Forbes
IT provider acquisitions keep accelerating, which matters if someone else runs your tech. The pace of managed service provider mergers has not let up, with hundreds of deals logged this year and private equity behind most of them, as platforms keep buying up smaller providers to add talent and fill service gaps. For a business that outsources its IT, an acquisition upstream can be invisible until it is not, showing up later as a new support portal, a different account manager, or quietly changing pricing. It is worth knowing whether your provider is independent or part of a larger rollup, and asking how your service and your main point of contact would hold up if they were acquired. A good partner will answer that plainly rather than dodge it. Read more at ChannelE2E
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.