Good morning. Thursday was one of those days where the headlines split neatly into two piles: the industry talking about what is coming, and a handful of companies living through what already arrived. A hundred of the biggest names in technology signed a letter about AI-driven attacks while a medical device maker spent the week unable to ship product. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
More than a hundred technology and financial companies signed a joint letter Thursday warning that AI-powered attacks are about to get much more common and calling for a defensive surge. OpenAI organized the statement and the signatories include Anthropic, Google, Microsoft, Amazon, Cisco, Oracle, Cloudflare, CrowdStrike, Okta, Fortinet and Palo Alto Networks, alongside companies well outside tech like Capital One, Mastercard, Visa, General Motors and Shopify. The letter argues that years of unpatched bugs, excessive permissions, misconfigurations, weak authentication and legacy technical debt have left networks exposed at exactly the moment attackers gain better tools, and it asks leadership at every level to treat cyber defense as an immediate priority rather than a line item. It is easy to be cynical about industry open letters, and the companies signing this one sell security products, but strip away the framing and the argument is one most owners already suspect is true: the backlog of small unfixed things in your environment is about to get scanned by something a lot faster than a person. The useful takeaway is not to buy anything, it is that the boring inventory work you have been putting off, knowing what you run and who can access it, just moved up the list. Read more at CyberScoop
Boston Scientific cannot process or ship customer orders following a cyberattack, and analysts think the disruption could last weeks. The medical device maker disclosed the incident Wednesday, saying an August 25 attack hit its IT network and key business applications, and that it has activated its incident response plan and brought in outside experts with no firm restoration timeline. Boston Scientific makes pacemakers, stents, catheters and neuromodulation devices, so this is not a back-office inconvenience for the hospitals that buy from them, since most carry limited inventory of high-value implantables and scheduled procedures depend on deliveries arriving. The lesson here has very little to do with medical devices and everything to do with concentration risk, because the question worth asking about your own business is which single supplier, if their systems went dark for three weeks, would stop you from delivering to your customers. Most companies can name that vendor immediately and have never once asked them what their recovery plan looks like, which is a short conversation that is much easier to have before you need the answer. Read more at Cybersecurity Dive
A Citrix NetScaler flaw that Citrix labeled a denial of service problem back in June turns out to allow remote code execution, and attackers are already dropping web shells through it. CVE-2026-8452 is a memory overflow affecting NetScaler ADC and Gateway appliances configured with Gateway VPN or AAA virtual servers, patched June 30 in versions 14.1-72.61 FIPS, 13.1-63.18 and 13.1-37.272. Researchers at WatchTowr showed the bug could be pushed past the vendor’s own severity description into unauthenticated code execution, and security firms are now seeing real attacks planting web shells named x.php and z.php and running discovery commands to map compromised networks. CISA added it to the Known Exploited Vulnerabilities catalog on August 26 with a federal deadline of August 29. The part worth sitting with is that a lot of organizations triage patches by the vendor’s severity rating, and this one was quietly worse than advertised for two months, which is a decent argument for patching internet-facing appliances on a schedule rather than on a score. Read more at Help Net Security
Manchester Airports Group confirmed Thursday that attackers accessed data on 8.7 million customers, and almost all of it came from free airport Wi-Fi signups. The breach spans Manchester, Stansted and East Midlands airports and involves email addresses, phone numbers, vehicle registrations and postcodes tied to Wi-Fi registrations plus car parking, lounge and Fast Track bookings, with no bank or payment details in the affected systems. MAG says attackers were inside for a few days before discovery, that it restricted access and brought in outside specialists, and that operations and aviation security were unaffected, though it has temporarily suspended its online Manage My Booking service. The detail worth carrying into your own business is where the data came from, because a guest Wi-Fi signup form is exactly the kind of thing nobody thinks of as a system, and yet it quietly accumulated millions of customer records that a regulator now considers your responsibility. If your company collects email addresses through a marketing form, a visitor kiosk, a loyalty signup or a guest network, that is a data store, and it is worth knowing where it lives, who can reach it and how long you actually need to keep what is in it. Read more at The Record
Nvidia has agreed to buy Hugging Face, the repository where most of the open source AI world publishes its models, for a reported $12.9 billion. The deal was reported Thursday and has not been formally confirmed by either company, but multiple outlets describe an agreement rather than early talks. Hugging Face is the closest thing the open model ecosystem has to GitHub, and the strategic read is that Nvidia benefits when open models stay healthy, since the largest closed labs are designing their own chips while a thriving open ecosystem keeps customers buying general-purpose hardware. For a smaller company this is not a story about chips, it is a story about where the cheap end of AI comes from, because open models are what make it plausible to run something useful on your own infrastructure or through a low-cost provider instead of paying per token to a frontier lab. Whether that stays true now depends on how a hardware company chooses to run a neutral public commons, and if any part of your stack quietly depends on models pulled from Hugging Face, this is worth knowing about before licensing or access terms change. Read more at CNBC
Follow Up
Follow-up to the August 7 TeamPCP story and the August 13 LiteLLM breach: Australian police have charged two men over the campaign. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on Thursday facing a combined 14 offences over their alleged role in TeamPCP, the group behind the March compromise of open source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM. The Australian Federal Police and Western Australia Police executed search warrants at three properties the day before and seized devices for forensic analysis. One uncomfortable detail from the reporting is that the two poisoned LiteLLM builds still return successfully from PyPI’s content delivery network at their direct package URLs five months after being pulled from the index, which is a reminder that a removed package is not always an unreachable one if your build system pins a specific URL. Read more at The Hacker News
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you take one thing away from this edition, make it the supplier question from the Boston Scientific story, since that one costs nothing to ask and tells you a lot.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.