Here is your weekend catch-up: a Citrix NetScaler flaw that turned out to be worse than first described, a ransomware crew using old SharePoint bugs to switch off security tools, and a survey that shows how loosely most companies are controlling their AI tools. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Citrix has patched a new NetScaler flaw that attackers are already using, and it may allow more than the knockout it was first described as. CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway appliances that are set up for SAML sign-in. Citrix first called it a denial of service problem, but researchers have since seen patched-looking devices downloading and running malware, which points to remote code execution. CISA confirmed active exploitation and gave federal agencies until October 7 to act, and fixed builds 14.1-73.41 and 13.1-64.28 are available now. If your company uses NetScaler for remote access or single sign-on, this is a today question for whoever runs it: are we on a fixed build, and has anyone checked the appliance for signs it was touched before the update? Treat anything that sits on the edge of your network as a priority to patch, not a task for the next maintenance window. Read more at BleepingComputer
A China-linked ransomware group is breaking in through old SharePoint flaws and shutting off antivirus before it strikes. Warlock used the “ToolShell” SharePoint vulnerabilities, which were patched more than a year ago, to get into water utilities, telecom providers, local governments, and universities. Once inside, the attackers loaded a legitimate but vulnerable security driver to disable endpoint protection on about 40 machines in two hours, then pushed the ransomware out across the network through shared folders and Group Policy. The victims so far are mostly in Europe, Africa, and Latin America, but the playbook works anywhere. The lesson for a business your size is that a patch you skipped last year is still a way in this year, and that your security software is only as strong as the controls protecting it. Ask your IT team or provider whether any SharePoint server is exposed to the internet, whether it is fully patched, and whether anyone would be alerted if your endpoint protection were switched off. Read more at The Hacker News
Nearly every company has an AI data access policy, but about three quarters of employees say they get around the approval rules anyway. A Delinea report found that 99.7 percent of organizations have a formal policy, yet only 57 percent say theirs is well documented and enforced, and just 51 percent check AI access against the policy in real time. On top of that, 76 percent of employees admit to bypassing approvals to use AI tools on work systems, and 42 percent of IT leaders have no automatic way to cut off an AI agent’s access once its session ends. A written policy that nobody checks is a comfort, not a control. If you have an AI policy, ask whoever owns it how it is actually enforced, which tools your people are using today that were never approved, and how you would revoke an AI agent’s access to company data in one step. If you do not have a policy, that gap is the first thing to close. Read more at Help Net Security
Google has frozen its open source bug bounty program because AI-generated reports buried the people reviewing them. The company paused its Open Source Software Vulnerability Rewards Program on October 1, saying a significant rise in automated submissions, the vast majority of them not valid, overwhelmed its engineers and the maintainers of the projects involved. Google plans to update the program in the first quarter of 2027 and is pointing researchers to other bounty programs in the meantime. It is a small story with a bigger message: AI is producing a flood of plausible but wrong output, and the cost of sorting it falls on a human. If your teams are using AI to generate reports, tickets, code, or customer replies, decide who checks the work before it goes out, because the volume will grow faster than your review capacity unless you plan for it. Read more at TechCrunch
IT providers at the MSP Summit were told the way to sell AI is to prove business results, not to sell the technology. Speakers urged providers to start with a discovery assessment and to name a specific buyer, workflow, and outcome for any AI project. One Pax8 executive said roughly 80 percent of client problems can be solved with automation or business intelligence tools that involve no AI at all. That is useful advice for you as the buyer. When any vendor or provider pitches you an AI project, ask what outcome it will deliver, how it will be measured, and whether a simpler tool would do the job for less money. A partner who talks about risk reduction and growth in your numbers is worth more than one who talks about the latest model. Read more at ChannelE2E
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing off this catch-up, find out whether your NetScaler, if you have one, is on a fixed build.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.