Good morning. Most of today’s news is not about anything new arriving in your business. It is about things you already own and already turned on, quietly accumulating risk while nobody looked at them. A mail appliance, a decade of shared folders, a plugin that updates itself, a password somebody reused. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Attackers are taking over Cisco email security appliances by sending them an email, and CISA has given federal agencies until Wednesday to patch. Cisco disclosed Monday that CVE-2026-76461, a flaw rated 9.8 in the email parsing logic of AsyncOS for Secure Email Gateway, is already being exploited in the wild, and it works exactly the way it sounds: an unauthenticated attacker sends a crafted message containing malicious SQL statements through the device and ends up running commands as root on the underlying operating system. It affects both physical and virtual appliances regardless of configuration, Cisco patched four other critical Secure Email Gateway flaws the same day, and Shadowserver currently sees more than 400 of these appliances exposed to the internet. The detail worth sitting with is that the attack arrives through the device’s normal job, which is accepting mail from strangers, so there is nothing unusual about the traffic that gets someone in. Cisco is also warning that attackers clean up after themselves, so admins should cross-check firewall and network logs rather than trusting the mail logs alone. If a Cisco appliance filters your company’s email, the version it is running is a reasonable thing to know before Wednesday, and if a provider handles that for you, ask them in writing whether they patched and whether anyone looked for signs of a visit. Read more at BleepingComputer
Ninety percent of IT leaders surveyed have had a Microsoft 365 security incident tied to permissions nobody was watching, and most are switching on AI over exactly that mess. Syskit surveyed more than 300 IT and security decision makers and found that 90% experienced or suspect they experienced an incident caused by misconfiguration or over-permissioned access in the past two years, with 39% confirming one outright. More than three quarters have deployed or piloted an AI tool on their Microsoft 365 data, but fewer than half did a thorough review of permissions and oversharing first, and fewer than a quarter have any written policy defining what AI agents are allowed to reach. The most common problem the report identifies is ownerless content, meaning orphaned Teams sites and groups that no human has reviewed in years but that an AI assistant will happily read and summarize on request. This is the least dramatic story in today’s roundup and probably the most likely to affect you, because Microsoft 365 permissions accumulate quietly through shared links, guest accounts and people changing roles, and Copilot does not introduce new access so much as make the access you already granted suddenly easy to use. Syskit’s Toni Frankola makes the practical point that you do not need perfect governance before turning AI on, you just need to know where sensitive information is exposed, and the same review usually turns up unused licenses and storage that cost you money anyway. Read more at CIO Dive
A third of companies say employees went and got their own AI tools because the approved ones did not show up fast enough. OneTrust’s 2026 AI-Ready Governance Report found 74% of respondents have AI in active use across teams or business processes, and 87% say their organization actively encourages employees to use AI agents, but only 47% of those have defined governance and controls in place while the rest are encouraging use while the rules catch up. Nearly half reported at least one incident in the past year where an AI system or agent took an action nobody approved, only 5% say accountability is clearly defined across the AI lifecycle, and 33% say staff reached for unapproved tools because the sanctioned option was not available quickly enough. That last number is the one to take personally, because it reframes shadow AI as a service problem rather than a discipline problem: people are not sneaking around, they are trying to get work done and your approval process is slower than their deadline. The fix that scales for a smaller company is not a longer policy document, it is naming two or three approved tools, saying plainly what company information may and may not go into them, and making the path to approving a new one short enough that nobody routes around it. Read more at Help Net Security
WordPress is going to start scanning every plugin update for malicious code before it reaches your website. The platform announced that automated security review will now run on every plugin release before it goes out through the WordPress.org update API, closing a gap that has been sitting in plain sight for years: new plugins get reviewed before they enter the directory, but the updates that ship continuously afterward did not get a consistent review step. David Perez, co-lead of the official plugin repository team, put the reasoning simply, which is that a plugin can be secure today and introduce a vulnerability or outright malicious code in a future release. WordPress says the automated review already caught a backdoor committed to a release of a plugin with roughly 20,000 active installations on July 28, caught during a cooldown window before it went out to users. If your company website runs on WordPress, and a large share of small business websites do, this is genuinely good news that does not let you off the hook, because your site’s exposure still comes down to how many plugins you run, how many of them are abandoned, and whether anyone has looked at that list since the site was built. A plugin inventory is a thirty-minute job that most businesses have never done once. Read more at The Hacker News
Telus spent sixteen months with attackers quietly inside customer accounts, and they got in with passwords the customers had used somewhere else. The Canadian telecom is notifying customers that their accounts were accessed between February 2025 and June 2026 in what looks like a credential stuffing campaign, using credentials obtained elsewhere rather than any break-in at Telus itself. What the attackers could see once inside was the ordinary contents of a customer account: names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details and payment history. The part that makes this more than a routine breach notice is what they did with it, which was contact customers using their real account details to try to talk them into moving their service to a competitor, and in some cases make unauthorized changes to the services themselves. Telus has reset the affected credentials, added monitoring and offered identity protection, but the lesson lands on any business that keeps customer portals: a reused password is not really your customer’s problem alone, because the consequences show up as your churn, your support calls and your reputation. Multi-factor authentication on customer-facing logins and alerting on account changes are unglamorous, and they are what turns sixteen months of access into a bad afternoon. Read more at SecurityWeek
Follow Up
Follow-up to yesterday’s Windows Server story: Microsoft shipped emergency out-of-band updates Monday to fix the Remote Desktop failures. The September 8 security updates were breaking Remote Desktop Services on Windows Server 2019, 2022 and 2025 a few hours after installation, and the only workaround was rolling back patches that also fixed actively exploited flaws. The fixes are KB5129238 for Server 2019, KB5129237 for Server 2022 and KB5129235 for Server 2025, with matching updates for Windows 10 and 11, and they also clear up a Hyper-V shared folder problem with Linux virtual machines and part of a USB audio bug that is still being worked on. If anyone rolled back a September update last week to get remote access working again, the follow-up task is putting the security fixes back on now that they no longer break anything, because a rollback nobody revisits is how a temporary decision becomes a permanent hole. Read more at BleepingComputer
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing with this edition, go look at who still has access to your Microsoft 365 files.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.