Good morning. Two days after the largest Patch Tuesday Microsoft has ever shipped, a researcher published a working exploit that beats one of the fixes, which is a useful reminder that patching is a floor and not a ceiling. The rest of today’s news lands on the same nerve from different angles, because most of what showed up in the last twenty four hours is about controls that look solid on paper and turn out to have a way around them. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
A researcher published a Microsoft Defender zero-day that hands over SYSTEM access on machines that already installed this week’s patches. The exploit, named ShieldCrash, is a bypass for CVE-2026-69414, a flaw the same researcher reported last month and that Microsoft addressed in an update to the Malware Protection Engine days before Patch Tuesday. The proof-of-concept demonstrates arbitrary file read as SYSTEM on a fully updated Windows machine, and every supported desktop version is said to be affected, with the researcher’s public position being that Microsoft fixed several paths to the bug and missed one. If your team or your provider spent Tuesday and Wednesday reporting that patching is complete, this is the story that says complete is a moving target rather than a finish line. The practical version for a smaller company is not to panic about a proof-of-concept with no known criminal use, but to make sure somebody is watching for the follow-up fix and that your endpoint tooling would actually tell you if a local user suddenly gained SYSTEM rights. Read more at BleepingComputer
A Fortinet flaw patched back in January is now being exploited to plant a remote access tool on firewalls, and CISA has given federal agencies three days to fix it. CVE-2025-25249 is an unauthenticated code execution bug in FortiOS and FortiSwitchManager rated 7.4, and SOCRadar reports that attackers have been using it since at least July to deploy a FortiGate backdoor called PivotC2 that gives them shell access, traffic tunneling, network scanning and the ability to harvest device configuration. The researchers scanned the campaign at more than 30,000 targeted IP addresses with 178 devices actually infected, mostly at US organizations, with at least two intrusions leading to data theft, and they believe the tool was itself built with AI assistance by a Russian-speaking crew. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday with a three-day clock. The uncomfortable part is the eight-month gap, because a firewall patched in January would have been fine, and the devices getting hit are the ones nobody has logged into since the last time something broke. Fixed builds are FortiOS 7.6.4, 7.4.9, 7.2.12 and 7.0.18, and if you do not know which build yours is running, that is the question to send this morning. Read more at SecurityWeek
Okta found thousands of live AI session tokens sitting in a single batch of stolen data, and a token like that walks past your password and your multi-factor prompt without touching either. Researchers analyzed a seven gigabyte infostealer dump posted to Telegram in August, covering 5,871 infected machines across 162 countries, and found 1,843 unexpired authentication tokens still valid on the day the file was released, including tokens tied to Google, Microsoft, Anthropic, Amazon, Notion and Cursor, along with two dozen working API keys for Gemini, OpenAI, Groq and OpenRouter. Nearly 18% of the tokens carried plaintext personal information such as a name, phone number or email address, which does not expire the way a session does. Jeremy Kirk, Okta’s director of threat intelligence, framed it plainly by noting that once a token is replayed the attacker is effectively logged in without ever logging in, and that stronger authentication has made password takeovers harder without stopping a stolen session. For a business that has quietly accumulated AI subscriptions across a few departments, the exposure is both an unexpected bill and an account with your company’s work in it, and the fixes are unglamorous: know which AI tools your people are signed into, keep sessions short, scope API keys narrowly, and treat an infostealer infection on one laptop as a credential emergency rather than a cleanup ticket. Read more at The Hacker News
Barracuda documented a phishing campaign where the fake login page never exists on a website at all, because it is assembled inside the victim’s own browser. The lure is a DocuSign-themed email with a calendar invite attached, which makes it read like an ordinary meeting request, and the link genuinely points at a Microsoft OAuth endpoint before a crafted redirect hands the victim off to Microsoft Teams, which loads a resource from an outside domain that builds the credential-harvesting page locally from a blob URL. The page then registers a service worker and runs part of its logic in a sandboxed frame so the operators can change what the victim sees in real time, and hidden configuration in the code shows this is a managed platform running many victims at once rather than a one-off page. What makes this worth your attention is that the usual defenses look for a suspicious domain or a known bad URL, and there is not one here, since every hop the user can see belongs to Microsoft. Barracuda’s own advice is the right takeaway for a smaller company: move to phishing-resistant multi-factor such as passkeys or hardware keys, use email filtering that follows a link all the way to its destination instead of checking only the first hop, and tell your staff that a signature request is worth a phone call even when it appears to come through Microsoft. Read more at Help Net Security
Bain put a number on the AI reshuffle, and the interesting part is not the number but where the money moves. The firm’s new research projects that AI will deeply transform roughly 71% of business sectors by 2035, compared with the 41% the internet transformed between 1995 and 2015, and it puts $4.7 trillion of profit in play as a result. Bain’s framing is that the internet mainly collapsed the cost of distribution while AI collapses the cost of production itself, and the split inside that $4.7 trillion tells the story: about $1.1 trillion comes from productivity gains, while $3.5 trillion comes from innovation and competitive shifts, meaning profit moving from one company to another rather than simply appearing. Dunigan O’Keeffe, a partner in Bain’s strategy practice, argues that leaders need to take a position on what their industry’s profit pool looks like on the other side of this and work backward to what technology that requires. That is a more useful exercise than another pilot, and it is one a fifty-person company can actually do in an afternoon. The question is not whether AI saves your team a few hours a week, it is whether a competitor in your market can now do something for a customer that you cannot, and what it would take to close that gap before they get the account. Read more at CIO Dive
Follow Up
Follow-up to Monday’s Chrome zero-day story: Proofpoint now says four separate espionage groups have been chaining that flaw through a shared exploit kit, and Google patched a seventh Chrome zero-day on Tuesday. The exploit kit, called BlueMoon, combines CVE-2026-85046, the V8 type confusion bug behind last week’s emergency Chrome update, with a sandbox escape and Windows vulnerabilities, and its first observed use was attributed to the China-aligned group APT31 on August 28. Within days several other espionage clusters picked up the same kit, most with a suspected China connection and some still unattributed, which suggests it is circulating rather than being held closely. Google’s Tuesday release closed 230 issues including CVE-2026-87491, another actively exploited V8 flaw and the seventh Chrome zero-day of the year. If you asked everyone to restart Chrome last week, ask again, because there is a newer build than the one you told them about. Read more at The Hacker News
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing with this edition, find out what build your firewall is running.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.