Good morning. Almost everything on today’s list comes back to the same idea, which is that the login is the real perimeter and most of us have quietly handed pieces of it to somebody else. An identity provider you did not know you were using, an app your employee approved in ten seconds, a phone system nobody has thought about since it was installed. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
The FBI issued a public alert about a phishing technique that gets around passwords and multi-factor authentication entirely, because it never asks for either one. The bureau’s Internet Crime Complaint Center says attackers have been running OAuth consent phishing since late 2025, impersonating government officials, journalists and public figures to reach prominent individuals along with their relatives and personal contacts. The trick is to send something plausible, often a request to review a draft document, that routes the victim through a legitimate Microsoft or Google authorization screen and asks them to approve a malicious application. Once the target clicks approve, the attacker holds a token with standing access to email and files, and the FBI is blunt about the consequence: changing the password does not revoke it, and neither does MFA, because the user granted the access voluntarily. For your business the useful move is not another training slide about suspicious links, it is a five minute look at whether your Microsoft 365 or Google Workspace tenant currently lets any employee approve any third-party app on their own, and a standing habit of reviewing what has already been connected. Most owners have never looked at that list, and it is usually longer than they expect. Read more at Help Net Security
Roughly 5,000 Dropbox accounts were taken over without anyone stealing a password, because of a flaw in an identity system most of those customers did not know they were relying on. Dropbox is notifying users that an unauthorized party exploited a weakness in Lenovo’s email verification process to register Lenovo IDs using other people’s email addresses, then used those fraudulent IDs to sign in to the matching Dropbox accounts. Dropbox uses Lenovo Identity Provider Services as part of its authentication setup, so some affected people had never created a Lenovo account at all. The access ran from August 4 through August 21, files were viewed and downloaded in some cases, and every single compromised account had one thing in common, which is that multi-factor authentication was turned off. Dropbox has since expired all Lenovo-authenticated sessions and now requires the Dropbox password alongside a Lenovo ID login. The lesson for a smaller business is that your vendors have vendors, and a break in any of them lands on you, which is why MFA on every account that holds company data is the one control worth being inflexible about. It was the difference between a notification email and a bad month for everybody on that list. Read more at BleepingComputer
Attackers are actively exploiting a flaw in Sangoma Switchvox that lets them run code on a company phone system without a password. The vulnerability, CVE-2026-9586, carries a CVSS score of 9.3 and affects Switchvox SMB Edition 8.3, where an endpoint meant for Polycom phones passes user-supplied data straight into a database query with no sanitizing, allowing an unauthenticated attacker to execute commands as the database superuser and drop a reverse shell. Sangoma shipped the fix back on July 14 in version 8.4.0.2, which means the exploitation now underway is landing on systems that have gone almost two months without an update. Phone systems are the classic example of infrastructure that gets installed, works, and then disappears from everyone’s mental map, and this one sits on your network with a route to everything else on it. If your business runs Switchvox, the version number is worth checking this morning, and the broader question worth asking is which other appliances in your office are quietly in the same category. Read more at The Hacker News
A working exploit is now circulating publicly for a fresh flaw in Cleo Harmony, the file transfer platform many midsize companies use to exchange data with their partners. CVE-2026-84115 is a privilege management weakness in how Harmony handles JWT refresh tokens, rated 8.3, and it lets a remote attacker manipulate HTTP header arguments to bypass access controls and escalate privileges. It affects builds through version 5.8.1.10, and the fix is 5.8.1.11 or later. Cleo products have been here before, since the mass exploitation of Cleo file transfer software in late 2024 turned into one of the more damaging extortion campaigns of that year, and file transfer tools are attractive precisely because everything moving through them is the data two companies agreed was worth protecting. If you exchange files with customers, vendors or a billing partner through a managed transfer product, the questions to ask today are what version it is on, who owns updating it, and whether the answer to that second question is a person or a shrug. Read more at SecurityWeek
Anthropic announced a setup that lets business customers keep their AI activity logs in their own cloud storage rather than the vendor’s, which is a bigger deal than it sounds. Enterprise Frontier Safeguards pairs zero data retention with automated monitoring for misuse, storing the activity data used for that monitoring in the customer’s own Amazon S3, Azure Blob Storage or Google Cloud Storage under the customer’s encryption keys and access policies, with no human review by Anthropic staff. The company says it built the approach with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail and the public sector, will roll it out in phases this fall, and will not charge for it. Whether or not you use Claude, the thing to take from this is that “where does our data actually live, and who can read it” has become a question vendors are competing to answer well. That gives you leverage. The next time a software vendor pitches you an AI feature, asking what is retained, for how long, who reviews it, and whether any of that can sit in infrastructure you control is now a perfectly normal question, and a vendor who cannot answer it plainly is telling you something. Read more at CSO Online
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you only do one thing, go look at which third-party apps have standing access to your Microsoft 365 or Google Workspace.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.