The last roundup went out Thursday, so five days of news piled up behind the holiday, and a striking amount of it lands on the same nerve: the software other people run on your behalf, whether that is the platform your IT provider uses to reach your machines, the store engine behind your online orders, or the vendor who scans a customer’s ID at your front counter. Here are the six stories that matter most if you are running a small or midsize business, or leading its IT.
N-able rushed out its fourth emergency patch in five weeks for the platform a great many IT providers use to manage their clients’ computers. CVE-2026-86218 carries a CVSS score of 10.0 and allows remote code execution on an N-central server with no login required, and the company shipped Hotfix 4 on September 5, bringing on-premises builds to 2026.3.1.14. N-able’s own communications disagree about whether it has been attacked yet, since the public release notes say there is no confirmation of exploitation while an urgent notice sent directly to customers says the flaw has been observed being exploited in the wild and calls it a zero-day. Huntress says it first heard about the problem from an N-able employee’s post in an MSP community chat, before any official announcement, and servers patched to Hotfix 3 only a day earlier still need this one. If your IT is outsourced, N-central is exactly the kind of tool that sits above your environment with administrative reach into every machine you own, so it is entirely fair to ask your provider whether they run it, whether they are on 2026.3.1.14, and whether they audited their user accounts afterward. A good provider will already have that answer ready. Read more at Help Net Security
ConnectWise is telling customers to turn off file transfer in ScreenConnect because there is a flaw it cannot patch until later this week. The issue affects file transfer behavior in Remote Access Support and Access sessions across both cloud and on-premises deployments, and it has not been assigned a CVE number yet, which means routine vulnerability scanners will not flag it for you. The interim fix is manual, requiring an administrator to open each user role and deselect the TransferFiles permission for every session group, and Shadowserver currently counts nearly 6,000 ScreenConnect instances exposed to the internet. It arrives the same week researchers at Huntress documented attackers tricking people into installing rogue ScreenConnect clients through tech support scams and fake refund forms, then using those sessions to push scripts to newly connected machines. Remote access software has quietly become one of the most reliably attacked categories in a small business environment, and the habit worth building from it is simple: nobody installs a remote session on one of your machines because of an inbound phone call or an email, and if someone claims to be your provider, you hang up and call the number you already have. Read more at BleepingComputer
Online stores running Magento and Adobe Commerce spent the holiday weekend being backdoored through a flaw that had no patch until Sunday night. Dutch e-commerce security firm Sansec disclosed the zero-day, which it named StyleSmuggler, on September 5 after attacks began the day before, and published early because stores were being compromised in real time. The attack needs no login, plants code in a file Magento writes itself, and then gets the platform to execute it by triggering a routine payment failure reminder email, leaving behind a backdoor disguised as an ordinary Linux system process. Adobe finally published bulletin APSB26-146 on Sunday evening at its highest priority rating, assigning CVE-2026-75650 with a score of 10.0 and affecting every version from 2.4.4 through 2.4.9. The part merchants need to hear is that patch level did not protect anyone, since the first confirmed victim was fully current on the security updates Adobe offered at the time, and the operators changed their payloads several times a day. If you sell online through either platform, applying the hotfix is only half the job, because any store that was reachable over the weekend needs to be scanned for a backdoor that is already there. Read more at Sansec
Scans of more than 153 million American and Canadian driver’s licenses went up for sale on a dark web service, and the trail leads back to an identity verification vendor most of those people never heard of. The FBI’s New Orleans field office has opened an investigation into an apparent breach at IDScan.net, a company that processes more than 21 million identity verifications a month for roughly 20,000 locations including well-known retail, rental and hospitality brands, and multiple lawsuits have already been filed against it. Each driver’s license entry in the listing reportedly includes six images, the front and back of the license as plain scans plus infrared and ultraviolet versions of the same, which is considerably more than most people picture when a clerk swipes their ID. If your business asks a customer for identification at check-in, at pickup, at the point of sale, or as part of an age check, you are almost certainly using a service like this one, and the exposure it creates attaches to your name even though the systems are not yours. The questions worth answering this week are which vendor performs that scan, how long they keep the image, and whether your contract says anything at all about it. Read more at CSO Online
Google shipped an emergency Chrome update on Friday for a zero-day that attackers were already using. CVE-2026-85046 is a type confusion flaw in V8, the JavaScript engine at the heart of Chrome, rated 8.8, and a malicious web page is enough to get code running inside the browser. Google confirmed an exploit exists in the wild while holding back the details, and this is the sixth Chrome zero-day exploited in the wild this year, with fixed builds at 152.0.7977.82 and .83 and the same fix flowing into Edge, Brave and the other Chromium browsers on their own schedules. This one earns a paragraph rather than a shrug because Chrome only finishes updating when it is relaunched, and a meaningful share of your staff have not closed their browser in weeks, which after a four day weekend is truer than usual. Pushing the update centrally, or simply asking everyone to restart Chrome and confirm the version, is a five minute task that closes the most used application in your business against something being exploited right now. Read more at The Hacker News
Sam Altman apologized for a messy launch of OpenAI’s newest model after paying customers discovered they could not actually use it. GPT-6 Astra arrived on September 4 as the company’s most capable model, but access at first went only to organizations enrolled in its Daybreak cybersecurity program, leaving Plus, Pro, Business, Enterprise and API customers waiting while availability widened over the following days with no firm timeline. The analyst commentary was more useful than the apology. Sanchit Vir Gogia of Greyhound Research pointed out that announced, available, entitled and production ready are four separate states, and Gartner told Computerworld that leaders should set the hype aside and judge these tools on specific use cases, demonstrated outcomes and reliable autonomy. That framing travels well down to a twenty person company. If you are paying for a higher AI tier because of a capability you read about in a launch announcement, confirm it is actually switched on in your own account before you build a process around it, and when a vendor pitches you an AI feature, asking which of those four states it is in today is a perfectly reasonable question. Read more at Computerworld
Follow Up
Follow-up to the August 20 Citrix story: the NetScaler flaw researchers expected to be attacked within days is now being attacked. CVE-2026-19490 is an unauthenticated authentication bypass in NetScaler ADC and Gateway rated 9.3, and vulnerability intelligence firm Previdian reported active exploitation in the wild on Friday, after public exploit code appeared earlier in the month. The exposure depends on how the appliance is configured, with AAA virtual servers and Gateway deployments such as SSL VPN, ICA Proxy and RDP Proxy at risk, and the fixed builds are 14.1-73.32 and 13.1-63.21 or later. If your remote access runs through a NetScaler appliance and it has not been touched since August, that is the first thing to look at this morning, ahead of anything else on this list. Read more at BleepingComputer
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you outsource your IT, today is a good day to ask which remote management tools run on your network and whether they are current.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.