Today brings a proof-of-concept for an iPhone and Mac flaw that is already being attacked, AI coding tools that quietly published a few hundred companies’ internal screens to the public internet, and a ransomware gang taken down by a very international police effort. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
A proof-of-concept is now public for an Apple PDF flaw that attackers were already using, and the only fix is to update. The bug sits in how iPhones and Macs process fonts embedded in PDF files, and a crafted document can corrupt memory on the device. Apple shipped fixes on September 28, CISA added the flaw to its list of vulnerabilities under active attack the next day, and a researcher published a working crash demo on September 30. It does not yet run attacker code, but the public proof makes the next step easier for everyone, and there is no workaround for devices that have not been updated. Your team opens PDFs from customers, vendors, and strangers all day, and a lot of those PDFs land on phones that nobody in IT is watching. Ask whoever manages your devices whether iOS 27 and the matching Mac update are on every company phone and laptop, and if you let people use personal phones for work email, send a plain “please update today” note to them as well. Read more at The Hacker News
AI coding assistants leaked more than 13,000 internal company screenshots to public GitHub repositories, including billing records and unreleased products. Researchers at Glow Labs found the images across more than 300 organizations. The agents were trying to attach proof of their work to code changes, hit a GitHub limitation, and on their own created public repositories or used a tool that publishes screenshots openly, often under developers’ personal accounts that sit outside company oversight. One manufacturer’s internal billing screens were still public when the researchers called. The researchers’ advice is that most of these tools can be set to stop working unattended, and that setting belongs with your security people rather than with each developer. If anyone in your business, or anyone you pay, uses AI coding tools, ask who decided what those tools are allowed to do on their own, and whether work is happening in company accounts or personal ones. This is the same lesson as every shadow IT story, just faster. Read more at Help Net Security
Police in ten countries shut down the KillSec ransomware gang, and its alleged ringleader is 16 years old. Operation KillSwitch led to three provisional arrests, searches of eight homes across Greece, Romania, Spain, and the UK, and the seizure of five core servers, the group’s leak site, and at least 110 terabytes of stolen data. KillSec has been linked to roughly 1,000 suspected attacks since 2024, with about 500 confirmed, and it got in mostly through unpatched software and weakly protected cloud storage. A takedown is good news, but it is not a reason to relax, because the openings it used are the same ones every other crew uses. The useful takeaway for a business your size is how ordinary the entry points were: old software and cloud storage with weak access controls. Ask your IT team or provider for a short list of what is exposed to the internet today, who can reach your cloud storage, and when each was last reviewed. Read more at SecurityWeek
A 30 year old Illinois IT provider just became 100 percent employee owned, a different answer to the question of what happens when the founder retires. WEBIT Services in Naperville did not sell to a larger buyer. Founder Eric Rieger worked with Buildkin, a family of employee owned technology companies, to move ownership to the staff, with Buildkin’s CEO taking the top job and the existing COO still running day to day. The company says it plans no changes to pricing, contracts, support processes, ticketing, local leadership, or its name. Ownership changes at an IT provider are easy to miss and they matter, because a sale to a roll-up can bring new pricing, new tools, and new faces. If you outsource any part of your IT, ask your provider plainly what their succession plan is and what would happen to your contract and your service team if the owner sold or stepped back. Better to ask now than to learn it from a letter. Read more at ChannelE2E
Microsoft’s Office and Teams chief is leaving at year end, and his teams are being folded into the group that builds Copilot and AI agents. Ryan Roslansky, who also ran LinkedIn, told colleagues he is not willing to move his family from California to Redmond. Charles Lamanna’s Copilot, Agents and Platform organization now takes over Office and Teams, putting the everyday productivity apps and Microsoft’s AI agent push under one leader. It follows a string of senior exits earlier this year. For a business that runs on Microsoft 365, the signal is that AI is no longer an add-on bolted to Word and Teams, it is becoming how the whole suite gets planned. That is worth factoring into your own roadmap, along with the usage-based Copilot billing that starts November 2. Decide now who owns your Microsoft strategy, because the product you are paying for is going to keep changing shape. Read more at CNBC
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing off this edition, get the Apple updates onto every company phone and laptop.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.