The weekend delivered two separate zero-days rated 9.5 out of 10 aimed at software already sitting inside plenty of business networks, a file transfer vendor that told its own customers to shut down for a few hours just in case, and a Friday announcement that if your business runs Microsoft 365, its AI assistant is about to start acting a lot more like a coworker than a chat window. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Two more zero-days are under active attack in Citrix’s NetScaler appliances, and federal agencies have until Tuesday to fix them. Citrix found CVE-2026-88771 and CVE-2026-88772, both scored a near maximum 9.5, while investigating customer incidents, and confirmed this weekend that both are being exploited on unpatched NetScaler ADC and Gateway devices. The first lets an unauthenticated attacker run commands on the appliance outright; the second is a memory overflow that can crash the device or, under the right configuration, do the same thing. CISA added both to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by Tuesday, September 30, under its binding directive authority. Fixed builds are out now. NetScaler sits at the edge of the network handling VPN and application traffic for a lot of businesses that never think about it once it is installed, which is exactly the profile of device that stays unpatched the longest. This is worth a same day message to whoever manages your network, in house or outsourced, asking not just whether NetScaler is patched but whether anyone checked it for signs of compromise first, since patching alone does not remove an attacker who already got in. Read more at The Hacker News
A Microsoft SharePoint flaw patched back in August is now being used to plant backdoors, six weeks after the fix shipped. CVE-2026-65660 lets an attacker who already has low level access to a SharePoint server run arbitrary code, and while it initially required authentication, researchers found it can be chained with a separate flaw to skip that requirement too. Microsoft shipped the fix quietly in August’s Patch Tuesday, originally describing it as a lower severity spoofing issue before correcting that assessment. Real exploitation began September 24 and 25, shortly after technical details became public, with attackers attempting to plant web shell backdoors on vulnerable servers. CISA added it to the Known Exploited Vulnerabilities catalog with a deadline for federal agencies of today. A lot of small and midsize businesses still run SharePoint on premises or in a hybrid setup for internal file sharing, and six weeks is plenty of time for a patch to sit unapplied on a server nobody thinks about until something breaks. If that describes any part of your environment, this is worth confirming today rather than at the next maintenance window, and worth a quick look for files that should not be there. Read more at SecurityWeek
A secure file transfer vendor told its own customers to shut their systems off for the weekend, then said Saturday that nothing was ever actually broken into. Kiteworks, used by healthcare systems, universities, automakers and government agencies to move large or sensitive files, emailed customers Friday recommending a roughly nine hour shutdown after receiving threat intelligence from federal law enforcement suggesting the company could be targeted. The company was clear that this was precautionary rather than confirmed, but at least one healthcare organization that complied saw real disruption to patient communications, and Shodan showed well over a thousand Kiteworks systems reachable from the open internet. By Saturday, Kiteworks lifted the advisory, saying it found no evidence any customer system had actually been compromised and that its current release addresses every known vulnerability. Whatever actually prompted the warning, the more useful story for your own business is how the company handled not knowing: it told customers plainly what it did and did not know, gave them a clear window to act, and updated them as soon as it had more information. That is a fair standard to hold any vendor that touches your sensitive data to, and a fair question to ask the next time one of them goes quiet during an incident. Read more at TechCrunch
Barracuda launched a tool that lets an IT provider see and control which AI apps its clients’ employees are actually using. The new AI Data Security platform, released this week, discovers AI tool usage across more than 1,300 applications, sets policy around it, and protects sensitive data from leaking into tools nobody vetted, all from a single multitenant dashboard built for MSPs and stretched-thin IT teams. It landed alongside other channel news this week, including Cork Cyber expanding automated patching and vulnerability remediation across 115 integrations and more than 13,000 software titles, and fresh MSP 501 research finding nearly a third of MSPs now expect AI work to generate more than a fifth of their revenue this year. The part worth sitting with as a business owner is the gap this kind of tool is built to close: most companies have no real inventory of which AI tools their employees have quietly started using, or what company data has been typed into them. That is not a problem you solve by banning AI, since that rarely works, it is one you solve by knowing what is actually happening. Ask whoever manages your IT, inside or outsourced, whether they could hand you a list of the AI tools touching your business today, and treat a shrug as the answer that tells you something. Read more at ChannelPro Network
Microsoft rebuilt Copilot around an AI agent that keeps working on your projects even when you are not in the room. Announced Friday, the new Copilot is organized around three pieces: Home, which blends chat and task handling and can edit Word, PowerPoint and Excel files directly; Code, which lets an employee describe an app or dashboard in plain language and have Copilot build and host it; and Autopilot, a persistent agent with its own identity and memory that can monitor conversations, track ongoing responsibilities, and pick a project back up after sitting idle for days. In Microsoft’s own demo, an agent watching Black Friday preparations pulled from email, Teams, inventory systems and spreadsheets on its own and caught a shipping problem affecting eighteen stores before anyone flagged it. CEO Satya Nadella was direct about the tradeoff, saying every agent needs its own identity and everything it does needs to be observable. Home and Code start rolling out now to early access participants, with broader Microsoft 365 availability later this year and Autopilot’s preview expanding at the end of the month; pricing is not fully settled, but the new capabilities sit on top of the existing $30 a month tier plus consumption based credits, with moderate use running an estimated $69 to $73 a month per person. Before letting something like this loose in your business, it is worth having clear answers to the same two things Nadella pointed at, who is accountable for what an agent does under its own name, and whether anyone can see what it actually did after the fact, plus a third one Microsoft left vaguer: what it is going to cost once people start relying on it. Read more at VentureBeat
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you chase one item from this edition, find out whether your network runs NetScaler, since the federal deadline for that one is Tuesday.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.