Good morning. The weekend’s news has an awkward theme running through it, which is that the things you count on to protect you can also be the things that fail you. A security patch that breaks remote access, a firewall built to keep people out, a verification process that got played, a vendor relationship you cannot easily leave. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Microsoft has confirmed that this month’s Windows Server updates are breaking Remote Desktop Services, and the failures do not show up right away. The affected patches are KB5122876 for Windows Server 2019, KB5122882 for Server 2022 and KB5122871 for Server 2025, all released September 8 as part of a Patch Tuesday that closed roughly 973 vulnerabilities including two already under active exploitation. Servers typically run normally for a few hours after installation, then Remote Desktop connections start failing, users get stuck at “Please wait for the Remote Desktop Configuration,” or sessions drop after a few minutes, and Microsoft has traced it to a deadlock between the RDP service and the Local Session Manager. Administrators who rolled the updates back say remote access came right back, which sounds like an easy call until you remember that rolling back also removes fixes for flaws attackers are already using. If your people connect to a terminal server or a hosted desktop to do their jobs, this is worth a conversation with whoever handles your patching this morning rather than a support ticket on Wednesday when everyone is locked out, and it is a good reminder that the right answer to a broken patch is usually a documented decision with a date on it, not a quiet rollback nobody writes down. Read more at BleepingComputer
The Dutch national cyber agency says attacks on two critical Check Point VPN flaws are coming soon, and it issued that warning before anyone had seen an exploit. CVE-2026-85102 and CVE-2026-85103 both carry a CVSS score of 9.8 and both sit in how Check Point Quantum Security Gateway, Security Management Server and Spark Firewall handle VPN certificates, which means an attacker can reach the vulnerable code before authentication ever happens and run their own code on the gateway. Check Point shipped fixes on September 9, and the NCSC’s position is that the likelihood of exploitation and the potential impact are both high enough to act now even with no public proof-of-concept and no confirmed attacks yet. That early warning is the useful part, because the usual pattern for edge devices is that the patch sits available for weeks and the first sign of trouble is somebody else’s incident report. If a Check Point gateway is what stands between your office and the internet, the version it is running is a reasonable thing to know by lunchtime, and if you outsource that, asking your provider for the build number in writing is a fair request. Read more at BleepingComputer
Revolut handed over customer passports, verification selfies and full transaction histories because someone emailed from inside a real government agency’s domain. The bank confirmed Friday that an unauthorized party submitted fraudulent requests for customer records from a mailbox that genuinely lived on a legitimate government agency’s domain, either newly created there or taken over, and because the mail passed SPF, DKIM and DMARC checks it looked authentic to the team that fulfilled it. What went out included identity documents, addresses, IBANs, account statements, withdrawal records and complete transaction histories. Revolut only learned it had been fooled when it contacted the agency separately to verify the request and was told the agency never made it, and the company says a limited number of customers were affected without giving a number. Nothing was hacked here, which is exactly why it belongs on your desk: every business gets requests that feel official, whether that is a subpoena, an auditor, an insurance carrier or a vendor asking for employee records, and email authentication only proves the message came from that domain, never that the person behind it was authorized to ask. The cheap protection is a written rule that any request for sensitive records gets verified through a phone number you looked up yourself, not one printed in the email. Read more at TechCrunch
Attackers are taking over MikroTik routers through internet-facing SSH with no password at all, and CISA gave federal agencies a weekend deadline to fix it. CERT Polska found six flaws in MikroTik RouterOS and showed that chaining two of them, an SSH authentication bypass rated 9.2 and a crafted-username bug also rated 9.2, gives full administrative control of a device whose SSH service is reachable from the internet, an attack chain it named MikroTrick. Exploitation has been confirmed since at least September 2, and CISA added those flaws to its Known Exploited Vulnerabilities catalog on Friday alongside actively exploited bugs in ConnectWise ScreenConnect and JFrog Artifactory. Fixed builds are RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. MikroTik gear shows up constantly in small offices, branch locations and shops because it is inexpensive and capable, and it is also the kind of equipment that gets installed once and never looked at again, which is the whole problem. Beyond patching, CERT Polska’s advice is worth following literally, meaning somebody should look at the device for user accounts, scripts, scheduled tasks, proxies and tunnels nobody recognizes, because a patch closes the door without evicting anyone already inside. Read more at The Hacker News
Broadcom quietly pulled the download for the toolkit companies use to migrate off VMware, and the way it did it says more than the change itself. The Virtual Disk Development Kit, or VDDK, is a component that migration tools depend on, including Microsoft Azure Migrate, Red Hat’s Migration Toolkit, Nutanix Move and various VMware-to-KVM products, and as of last week it is available only to Broadcom’s larger software partners rather than to anyone who needs it. There was no deprecation notice, no alternative link and no explanation, the old download URL now returns a 404 along with many of its support pages, and copies that showed up on the Internet Archive were removed while the download page itself was excluded from the Wayback Machine. This follows two years of higher prices, tighter support terms and heavier bundling since Broadcom bought VMware, and the pattern is what matters to you even if you have never run an ESXi host. Any vendor that controls both your platform and the tools for leaving it holds more leverage over your budget than your contract suggests, so the question worth asking about your own critical systems is not whether you plan to leave, but whether you could, and what the exit would cost if the vendor stopped helping. Read more at CIO
Follow Up
Follow-up to Tuesday’s ScreenConnect story: ConnectWise has now shipped the patch, and the attacks it was holding off turned out to be spreading on their own. When ConnectWise told customers last week to disable file transfer because it could not fix the flaw yet, the missing detail was how the flaw was being used. CVE-2026-84869 carries a CVSS score of 9.9, allows an attacker to send and run files through an active remote session without authorization, and has been exploited since at least August 20, with researchers observing a modified ScreenConnect instance dropping four VBScript files that establish persistence and then propagate to other ScreenConnect clients, which is worm-like behavior rather than one-off intrusions. The fix landed in ScreenConnect 26.6.5 and CISA added the flaw to its exploited catalog with a three-day clock that runs out today. If your IT provider uses ScreenConnect to support your machines, and a great many do, the reasonable question this week is not whether they patched but whether they checked for the persistence mechanism first. Read more at SecurityWeek
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing with this edition, find out whether anything in your office answers to the internet over SSH.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.