Good morning. Wednesday’s news had an odd symmetry to it. AI showed up on both sides of the ledger, finding a serious flaw for the defenders in one story and failing to move the earnings needle in another, while the attackers kept doing the unglamorous work of renting kits and walking through unlocked doors. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
A $320 a month phishing service is quietly stealing Microsoft 365 sessions using real Docusign notifications as the lure. Researchers detailed NovaCookies this week, an adversary-in-the-middle phishing platform that rents attackers everything they need, including lures, domains, hosting, redirects, and support, to relay a Microsoft 365 login in real time and walk off with the authenticated session. The infrastructure spans at least 755 domains and has been used against hundreds of organizations across the US, UK, Canada, Germany, Israel, and the UAE, and some campaigns arrive inside genuine Docusign envelopes and route clicks through legitimate Microsoft or Google sign-in endpoints before landing on the kit. What makes this worth your attention is that the sign-in looks completely normal from your side, because it is normal: the employee really did authenticate, really did approve the MFA prompt, and the attacker simply took the resulting session. If your security plan stops at “we turned on MFA,” this is the story that says the next step is conditional access and device trust, so a stolen session from an unmanaged machine cannot actually open anything. Read more at The Hacker News
Ubiquiti just disclosed 22 flaws across nearly its entire UniFi product line, 21 of them rated critical. The bugs touch UniFi OS, Protect, Talk, Access, gateways, routers, storage devices, and recorders, and three of them carry maximum severity scores, including an input validation weakness in the UniFi Protect video surveillance application, a CRLF injection flaw that lets a remote attacker bypass authentication on UniFi OS, and a command injection flaw in UniFi Talk. All three can be exploited with low complexity, no privileges, and no user interaction. Ubiquiti has not seen active exploitation yet, which is exactly why this week is the week to update. UniFi is enormously popular in small and midsize offices precisely because it is affordable and easy to stand up, and the flip side of that is a lot of gear sitting on business networks that nobody has logged into since the day it was installed. If your camera system, your Wi-Fi, or your phone system runs on UniFi, ask whoever manages it to confirm the firmware version this week rather than assuming automatic updates handled it. Read more at Cybernews
An AI agent built by a security company chained six separate weaknesses into a zero-click takeover of a WordPress theme running on more than a million sites. BleepingComputer reported Wednesday on CVE-2026-18431, a 9.8-severity vulnerability chain in the Avada theme and its companion Fusion Builder plugin that lets an unauthenticated attacker execute arbitrary PHP code on the server, which in practice means malware, database access, visitor redirection, or a rogue administrator account. The chain combines authorization, input validation, trust boundary, and file handling issues that only work when executed in a specific order, and it was found by a new agent Wordfence built specifically to hunt multi-step exploit chains rather than single bugs. That last detail is the real story for business owners, because the same capability that let defenders find this will let attackers find the next one, and the window between a flaw existing and a flaw being weaponized is going to keep shrinking. Practically, if your website runs Avada, update the theme and the plugin today, and if you cannot say when your site was last patched, that answer is now a business risk rather than a housekeeping detail. Read more at BleepingComputer
McKinsey surveyed 1,719 executives and found that almost everyone feels more productive with AI while almost nobody can find it in the financials. The State of AI 2026 report, covered Wednesday, found that roughly 80% of individual workers report productivity gains from AI, but only 6% of organizations attribute a meaningful share of earnings to it, a number that has not moved since last year. Thirty-nine percent report some EBIT impact at the enterprise level, and 94% of executives say they intend to keep investing regardless of near-term returns. It would be easy to read that as evidence AI is overhyped, but the more useful reading is that individual time savings do not become company profit unless somebody redesigns the work around them, and most organizations have not done that part. For a smaller company, this is actually good news, because you are close enough to your own processes to change them. The question worth sitting with is not which AI tool to buy next, it is which specific process in your business you would restructure if three people got two hours back every week. Read more at IT Pro
WhatsApp is replacing its six-digit security PIN with a real password and letting accounts carry multiple passkeys. Meta announced three account security changes on Wednesday: two-step verification moves from a six-digit numeric PIN to a longer alphanumeric password that accepts special characters, accounts can now register multiple passkeys across both Android and iOS so each device gets its own, and Android users will see additional context on calls from unknown numbers including location and shared groups. None of this is dramatic on its own, but WhatsApp has quietly become real business infrastructure for a lot of companies, especially those with customers, suppliers, or field crews overseas, and an account takeover on a business WhatsApp line is an impersonation problem with your name on it. If anyone at your company uses WhatsApp to talk with customers or vendors, the practical move is to have them set the new password and register a passkey now rather than waiting for a prompt, and to agree on how your team verifies a payment or account change request that arrives by message. Read more at Help Net Security
Follow Up
Follow-up to the July 30 Gitea story: that flaw is now being exploited in the wild and CISA has put it on the federal must-fix list. CVE-2026-60004, the critical remote code execution bug that lets anyone with ordinary repository write access plant a Git hook and run shell commands as the service account, went from patch to active attack in under a month. CISA added it to the Known Exploited Vulnerabilities catalog on August 25 with a federal remediation deadline of August 28, and at least one reported attack dropped a cryptocurrency miner payload on an exposed instance that allowed open registration. Gitea shipped a fix in 1.27.1 back on July 27, with 1.27.2 current, so if your development team self-hosts Gitea, the version check is a five-minute job. Read more at SecurityWeek
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you only act on one item here, make it the Ubiquiti firmware check, since that gear is sitting on more small business networks than almost anything else on this list.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.