Good morning. There is one question sitting underneath almost everything in today’s news, which is what gets to act on your behalf and how sure you are about it. A box that decides who is logged in, a phone system that signs its own passes, a laptop that proves it belongs to your domain, an AI agent working a task list without a person watching. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Cisco shipped an emergency patch Wednesday for a flaw that lets an unauthenticated stranger walk straight past the login screen on its Identity Services Engine. CVE-2026-76460 carries the maximum severity rating of 10 out of 10, and the mechanics are about as bad as that number suggests: an API endpoint on the appliance does not apply proper authentication controls, so a crafted request bypasses the web management interface entirely and, in a successful attack, runs commands with root privileges. Both ISE and the Passive Identity Connector are affected regardless of configuration, Cisco’s own security team confirms exploitation is already happening, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three day deadline for federal agencies. There is no workaround short of restricting traffic to the device with access control lists, and because root access lets an attacker delete the evidence, Cisco is telling admins to check the access log on every node and to cross-reference network and firewall logs from outside the appliance rather than trusting what the box says about itself. If you do not run ISE, the takeaway is still worth holding onto, because this is the third Cisco product in a week to land on that list, and the pattern is that the systems deciding who is allowed in are the ones getting hit. Read more at SecurityWeek
Spain’s privacy regulator just logged the first data breach it has ever received that was blamed on an AI agent working on its own. The AEPD said an organization notified it that an agent running on a well-known large language model scanned files for weaknesses, logged into the company’s systems, hunted through the target application until it found a flaw, then used that flaw to change personal records and read invoice data, largely without a human directing each step. Deputy director Francisco Pérez Bes was careful to note the information comes from the victim’s own notification and needs further analysis, and that using a particular model does not mean the model or its provider was compromised. What makes this worth your attention is not the novelty but the framing the agency chose, which is that AI-assisted attacks have stopped being a theoretical risk and started showing up in real incident reports, and that the speed and scale of an attack is what changes while the defenses that matter stay exactly the same. His list reads like a reasonable fall checklist for any business: know what data you process, keep less of it, limit who can reach it, fix known vulnerabilities faster, watch your suppliers, and have an actual plan for responding. The uncomfortable part is that an attacker who does not get tired compresses the window you have to notice something is wrong. Read more at Help Net Security
Attackers are taking over business phone systems through a signing key that is identical on every single installation. The flaw is CVE-2026-89026 in the Issabel Framework, the web front end for a widely used open-source PBX platform, and VulnCheck says it is under active exploitation. The problem is a hard-coded JWT signing key sitting in the same file in every deployment, which means an attacker does not need to steal anything to forge a valid access token, they just need to know the key that ships with the product. With that token they can call a management endpoint and have the phone system execute operating system commands. A patch went out on August 1, so the software has been fixable for six weeks. Phone systems are the classic example of infrastructure that gets installed once, works, and then never gets thought about again, which is exactly what makes them attractive: they sit on your network, they usually have a path to the internet, and nobody has logged into the admin console since the vendor set it up. If your phone system is self-hosted or managed by a small local provider, the question to ask this week is simply when it was last patched and who is responsible for patching it, because “it has been working fine” is not an answer to that question. Read more at The Hacker News
Microsoft is investigating reports that this month’s Windows 11 update is breaking the trust relationship between company laptops and Active Directory, locking people out with credentials that are perfectly valid. Administrators reporting on Microsoft’s own forums and on Reddit say that after installing KB5124008 and rebooting, Windows 11 25H2 machines lose their secure channel with the domain controller and start rejecting correct usernames and passwords, while cached credentials keep working offline, which is what points the finger at domain authentication rather than the user. One admin saw 11 of roughly 256 devices fail, another saw every workstation on the network start refusing valid logins. The suspected cause is a security feature called Machine Identity Isolation flipping to enforcement mode during the update and moving the machine account secret into Credential Guard, and Microsoft has confirmed it is looking into it but has not published a root cause or an official workaround. Be careful with the fixes circulating, because turning that feature off has broken domain logins for admins whose machines never installed the update at all. The broader lesson for a business with no dedicated IT staff is that “install updates immediately” and “never install updates” are both bad policies, and the workable middle is patching a small pilot group first and giving it a couple of days before the rest of the company follows. Read more at BleepingComputer
A security vendor built for IT providers just signed a distribution deal that puts privileged access controls in front of 165,000 resellers. CyberFOX, founded in 2022 by former ConnectWise executives and built around the Password Boss and AutoElevate products it acquired, will now sell its privileged access management, password manager and DNS filtering tools through Ingram Micro’s Xvantage platform across North America, with the stated goal of filling the gap between expensive enterprise identity products and something a smaller company can actually run. The business angle here is not the deal, it is what the deal is chasing. Privileged access management means controlling who can install software and run things as an administrator, and it has historically been a large-company purchase that smaller businesses skipped, which is a large part of why so many attacks that start with one ordinary user end with the whole network. Distribution at this scale usually signals that a category is about to become a standard line item rather than an upsell. If you outsource your IT, a fair question for your next check-in is whether anyone at your company still has permanent administrator rights on their own laptop, and if so, what it would take to change that. Read more at ChannelE2E
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you take one thing from this edition, take a look at what on your network can authenticate without a person involved, because that is the list this news keeps pointing at.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.