Today’s news is a reminder that your risk is often someone else’s mistake: a contractor’s skipped patch exposed FBI employees, and an email server fix lands for anyone still running their own. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
The FBI says a contractor’s missed patch is how ShinyHunters got into its jobs site and took data on thousands of bureau employees. Brett Leatherman, the FBI’s cyber chief, said an Accenture contractor managing the Oracle PeopleSoft platform failed to apply a security patch that had been issued, and the FBI has since removed the contractor and added protections. ShinyHunters announced the breach on September 22, and the group has also lost leaders to arrests in the Netherlands and Jordan in recent weeks. The lesson has nothing to do with the FBI’s size. When a vendor runs a system that holds your people’s data, their patching habits are your risk, and a contract does not apply the update for you. Ask each provider who manages a system with employee or customer data how fast they patch and how you would find out if they fell behind. Read more at SecurityWeek
Microsoft released an out-of-band fix for an Exchange Server bug that lets a signed-in user read other people’s email and attachments. CVE-2026-96940 is rated high severity and affects Exchange Server Subscription Edition, Exchange 2019, and Exchange 2016. Microsoft says it found the flaw itself and is not aware of attacks, and Exchange Online was fixed on Microsoft’s side in late September. The on-premises update is available now through the September 2026 v2 security update, and Microsoft recommends installing it on every Exchange server and every machine running the Exchange management tools. If your company still runs its own Exchange server, this one is yours to schedule this week, because mail servers draw attackers quickly once details are public. If you use Microsoft 365 in the cloud, you are already covered, and this is also a good moment to ask whether keeping a server in the closet is still worth the upkeep. Read more at Help Net Security
Nikkei disclosed that two employee email accounts were hijacked and one was used to send roughly 9,000 phishing emails to staff and business contacts. The Japanese publisher says a Google Workspace account was compromised in late July, exposing names and email addresses for 1,646 people, and a Microsoft 365 account was taken in September and used to send the phishing on September 30. The company reset passwords and warned those affected to watch for impersonation. It has not said who was behind either incident or whether they are linked. A hijacked mailbox is dangerous in a way that a spoofed message is not, because mail from a real colleague’s real account gets trusted. Make sure every account in your business has multifactor sign-in, and tell your people that a message from a known sender asking for something unusual still deserves a phone call to confirm. Read more at BleepingComputer
Apple says it will tighten Full Disk Access in macOS because AI agents are getting powerful enough to make today’s permission too risky. Full Disk Access lets an app see nearly everything on a Mac, including mail, messages, and browsing history. Apple says apps will need clearer user consent for it, though it has not said when, and the move follows reports that Meta’s Muse assistant reached private iMessages without users understanding it, which Meta disputes. For a business with Macs, the practical effect will be more approval prompts and possibly some friction with legitimate tools that rely on the permission. It is also a useful prompt to ask your IT team which apps on company laptops already have that level of access, and whether any AI assistant your people installed on their own has been granted it. Read more at SecurityWeek
Augmentt raised $18 million to help IT providers turn Microsoft 365 security, compliance, and Copilot readiness into repeatable services. The company is connecting Intune, SharePoint, and Teams to its platform and sees two big openings: compliance work under frameworks like CMMC, PCI, and HIPAA, and getting customers ready for Copilot. For a business that buys or outsources IT, the point is that your provider is likely to start offering these as packaged services. That can be good, since clear scope and clear pricing beat vague hourly work, but ask what the package actually covers, what evidence you get that controls are working, and how your own compliance obligations map to it before you sign up. Read more at ChannelE2E
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing off this edition, ask your IT vendors how quickly they patch.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.