Today brings a perfect 9.8 flaw in Cisco’s SD-WAN management software that attackers are already using, an AI agent that hacked a security nonprofit on its own, and two AI announcements that land directly on a small business budget. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Attackers are exploiting a 9.8 severity authentication bypass in Cisco’s SD-WAN Manager, and there is no workaround, only an upgrade. Cisco says CVE-2026-76504 lets an attacker craft a specially encoded request that skips the login check and use the Manager’s API as the admin user, no credentials required. Cisco’s own team saw it being used in real attacks during September, and fixed releases are available for every affected version. The only interim step is to cut off internet access to the Manager and limit connections to trusted hosts. If your company uses Cisco SD-WAN to tie together offices or branch locations, the management console is the keys to the whole network, so this is a same day question for whoever runs it: is the Manager reachable from the internet, and has it been upgraded? Ask that person to also confirm nobody has been poking around in it already. Read more at The Hacker News
An autonomous AI agent broke into the network of a Dutch security nonprofit by chaining two previously unknown flaws in a help desk platform, reaching full control in seconds. The Dutch Institute for Vulnerability Disclosure says the attacker exploited two zero-days in Zammad, an open source ticketing system used by more than 2,000 organizations, to hijack a session, run code, and escalate to root. The investigation was unusually easy because the agent left behind notes explaining its own decisions, which the team called loud and messy, and the fix is to move to Zammad version 7 or take the system offline until you can. The part worth sitting with is the speed. A human attacker would have needed hours or days to do what this agent did in moments, and your help desk or ticketing tool is exactly the kind of quiet, trusted system that holds passwords, customer details, and network diagrams. If you run any self-hosted tool like this, know who is responsible for updating it and how fast they can move, because the window between discovery and exploitation keeps getting shorter. Read more at BleepingComputer
Microsoft is moving Microsoft 365 Copilot Business licenses to usage-based billing by default starting November 2. The change arrived alongside a batch of new Copilot features, including a home screen, a communications hub called Today, an app and workflow builder, and an assistant called Autopilot. The billing shift is the piece that matters most to smaller companies, because it turns a predictable per seat line item into a cost that moves with how much your people, and their AI agents, actually use it. That can be good news if only a handful of people use Copilot heavily and you were overpaying for idle seats, and a surprise if the tools take off. Before November 2, it is worth deciding who owns the Copilot budget, setting an expected monthly range, and asking whoever manages your Microsoft licensing to show you the usage reporting so the first bill is not the first time anyone looks. Read more at ChannelE2E
Meta launched an AI agent for small businesses that connects to tools like Shopify, QuickBooks, Slack and Canva, and it is free to start. Muse for Small Business, released in the US and Canada on Tuesday, analyzes sales and social performance, drafts marketing content, flags unusual expenses, and suggests what to do next, with paid tiers of roughly $20 and $100 a month for heavy users. Meta says nothing publishes or sends without the owner’s approval. It is an appealing pitch for an owner working 65 hour weeks, but think hard before you connect your accounting system and payment processor to any new AI agent. Each connection is a door into your financial data, so decide who approves it, what it can see, and how you would cut it off, and treat it like onboarding a new employee with access to the books rather than installing an app. Read more at Axios
Hackers spent months inside a Pentagon file sharing system and walked out with records on millions of people, stored without encryption. The Defense Manpower Data Center, which manages military identity credentials, disclosed Tuesday that an attacker exploited a vulnerability between October 2025 and mid-July 2026 and took names, Social Security numbers, birth dates and service details on roughly 2.8 million living people and nearly 300,000 who have died. The records were reportedly sitting unencrypted. If your business is a defense contractor, or simply employs veterans or reservists, some of your people may be affected, and the bigger lesson applies to everyone: a file sharing system that holds sensitive personal data is a prime target, and unencrypted sensitive data turns any single break in into a full disclosure. Ask your IT team or provider where your most sensitive records actually live, whether they are encrypted, and how long an intruder could sit in that system before anyone noticed. Read more at TechCrunch
Follow Up
Follow-up to Monday’s Citrix NetScaler story: the attacks began weeks before the patch and more than 100 organizations are already known victims. Mandiant and Google’s threat intelligence group now say exploitation started in early September, targeting government, finance, education, legal and professional services firms across North America and Europe, with custom web shell and tunneling malware that supports lateral movement and credential theft. Suspected state sponsored actors are involved, and Palo Alto Networks counted around 50,000 potentially exposed NetScaler instances. That shifts the question from “have we patched?” to “were we already compromised before we patched?”, so if you run NetScaler, ask for a compromise check, not just confirmation of the update. Read more at SecurityWeek
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing this week, find out whether your Cisco and NetScaler gear is patched and checked.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.