Good morning. Today’s stories are mostly about the gap between what a business believes about its own technology and what turns out to be true under pressure. A recovery plan that reads well, a plugin nobody has thought about in years, a verified brand account, a budget line that assumes next year looks like this one. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
An incident response firm looked at more than 800 ransomware engagements and found that almost nobody recovers on the timeline they wrote down. Fenix24 published its first State of Recoverability report on Tuesday, built from more than 500 ransomware recoveries, and the headline number is that only four clients out of 800-plus came close to their own stated 24 to 48 hour recovery targets, and even those only got partial operations back. None reached full capacity until weeks later. The detail that explains most of the delay is identity: 99.2% of clients showed up with no documented plan for restoring their login systems, Active Directory was usually the first major system to fall, and 94% had tied their backup systems to the very directory the attacker had already taken. Backups that survived intact still failed to carry the recovery in 38% of cases, either because they were too old, quietly corrupt, or slower to restore than a rebuild. If you have a recovery time objective written into a contract, an insurance application, or a board deck, the useful question this week is not whether you have backups but whether anyone has ever run the full restore path end to end, including how you would log in to the tools you would need to do it. Fenix24’s recommendation is to pick your single most revenue-critical service, map every dependency behind it including third parties, and test the whole chain against the number you already promised. Read more at Infosecurity Magazine
Attackers are planting backdoors on online stores through a WooCommerce add-on that was patched back in February. The flaw, CVE-2026-27540, sits in the WooCommerce Wholesale Lead Capture premium plugin and lets an unauthenticated attacker upload a PHP file directly to the site, which in practice means a web shell, reconnaissance, and whatever payload they want to add next. Wordfence has now blocked more than 100,000 exploit attempts tied to it, with activity spiking repeatedly through the summer, and the fix has been sitting in version 2.0.3.2 since February 20. That gap between “patched” and “patched on your site” is the whole story, and it is especially common with premium plugins, because those often update only when someone renews a license and clicks through an update that the automatic process never touches. If your business sells anything online, this is worth thirty minutes with whoever maintains the site: confirm the plugin list, confirm which ones are premium and whether their licenses are current, and check the upload directories for PHP files nobody remembers creating. A compromised storefront rarely announces itself, and if one is confirmed, the honest answer is usually to restore from a clean backup rather than try to pick the backdoors out one at a time. Read more at BleepingComputer
Someone hijacked the verified HBO Max account on Reddit and used it to run 108 malicious ads in two days. The campaign, tracked as PasteSwitch, promoted a native HBO Max app for Mac that does not exist, and the download button led to a page that told visitors to copy a command, open Terminal, and paste it in. On Macs the command pulled down credential and crypto wallet stealers, on Windows it delivered a stealer through PowerShell that disguised its traffic as Facebook connections, and both paths installed clipboard hijackers that quietly swap cryptocurrency addresses during a transaction. Reddit suspended the ads once notified. What makes this worth your attention is not the brand involved but the delivery: the ad was legitimate, the account was verified, and the only unusual step in the entire chain was a human being willing to paste a command into a terminal window. No firewall or email filter sits in that path. The defense is the least technical thing in this roundup, which is telling your team plainly that no real company will ever ask them to copy and run a command to install software, and that “the website told me to” is a reason to stop rather than continue. Read more at SecurityWeek
Attackers are forging administrator tokens against WSO2 API Manager, and the flaw is that the software accepted a signature it should have rejected. CVE-2026-5430 carries a 9.8 severity rating and lets someone bypass authentication entirely by signing a token with an algorithm the product was never supposed to honor, which hands them account takeover across WSO2’s API Control Plane, API Manager, Traffic Manager and Universal Gateway. Researchers at watchTowr say their honeypots started catching forged tokens with administrator privileges baked in on September 13, which puts real exploitation ahead of most patching schedules. Most small and midsize businesses do not run WSO2 directly, and that is exactly why this one is worth noting: API gateways are the plumbing underneath the software you actually buy, and when the layer that decides who is authenticated fails, every application sitting behind it inherits the problem without any of its own security controls being touched. The practical version for a business owner is to ask vendors, especially the ones holding customer or financial data, how they learn about flaws like this and how quickly they patch. That question belongs in a renewal conversation, not in an incident. Read more at The Hacker News
Seven in ten security leaders say AI is now the top priority for whatever new money they get, and the overall budget is barely moving. The 2026 Security Budget Benchmark Report from IANS and Artico Search, based on a survey of more than 500 security executives, found overall security spending up 5%, only marginally better than last year’s 4%, with AI named as the leading driver of new investment. The two areas drawing that money are automating security operations and strengthening identity and access management. Eight in ten expect AI to create demand for new roles and skills rather than eliminate them, and seven in ten do not expect to cut headcount because of it. For a smaller organization the read-across is less about AI and more about the flat total: when the budget is roughly the same as last year and the new priority is real, something quietly stops getting funded. That reshuffle is worth making deliberate in your own planning this fall, because the same survey points at identity as where the spending goes, which is the same place the ransomware recovery data above says businesses fall down. Two independent sources landing on identity in the same week is a reasonable signal about where a limited dollar does the most good. Read more at Cybersecurity Dive
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If this edition’s theme lands anywhere, let it be identity, because two separate stories above say that is where the next bad day starts.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.