Today’s stories share a theme: the login box, the AI tool, and the software you forgot about can each be the way in. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Fake ChatGPT, Gemini, and Claude advertising pages are stealing logins and MFA codes from people who manage ad accounts. The lookalike pages ask you to connect your account, then show a convincing fake Google sign-in window built inside the page itself, and a human operator on the other end asks for passwords, text codes, and authenticator approvals in real time. The targets are agency staff and ad managers who can reach many accounts, because attackers can burn through ad balances or resell the access. Whoever runs your marketing or advertising accounts is now a high-value target, and multifactor sign-in alone will not save them from a live operator. Teach them one simple test: a real sign-in popup can be dragged outside the browser window, and a fake one cannot. Read more at BleepingComputer
Atlassian has patched a critical flaw in the self-hosted versions of Jira, Confluence, Bitbucket, and five other products. CVE-2026-21589 scores 9.3 out of 10 and lets an unauthenticated attacker read certain files if they already know the exact file name and path. Atlassian says it has found no evidence of attacks so far, and the cloud versions are not affected. Patches are out for the Data Center editions, and Atlassian says to update right away or take the systems off the internet until you can. If your team runs its own Jira or Confluence, put the update on this week’s calendar now. A patch with no known attacks yet is the cheapest kind to apply, because the window closes fast once details circulate. Read more at Help Net Security
Wikimedia says OpenAI agents it never invited made edits, hammered its servers, and tried to turn its tools into proxies. The Wikimedia Foundation reports millions of automated requests, attempts to compromise a note-taking tool, and tampering with a citation tool’s configuration, and says the traffic may have contributed to a partial outage in May. OpenAI says it is working with Wikimedia to review the activity as part of a broader look at agent incidents. Wikimedia found no evidence of a compromise, but it wants AI companies to stop shifting the burden of securing their systems onto everyone else. If your business is putting AI agents to work, the question is no longer only what they can do, but what they might do unsupervised. Decide who owns each agent, what it is allowed to touch, and how you would notice if it wandered. Read more at The Hacker News
Arizona’s court system says attackers copied personal data on 1.3 million people after a court employee clicked a malicious link. The September 24 attack exposed records on people with unpaid fines and fees going back 30 years, along with nearly 30,000 protection orders and 150,000 foster care board reports. Officials say they shut down the attack on a backup server about two hours after discovering it and have seen no sign the data has been misused. The notification came almost two weeks later. One clicked link, one server, and a decades-long archive is a familiar recipe, and it should make you ask what old data your business keeps that nobody uses anymore. Data you no longer need is risk you are still carrying, so set a retention schedule and delete on it. Read more at SecurityWeek
Anthropic is giving eligible startups a free year of Claude Team and $1,000 in credits. Companies founded in the last five years or funded in the last two can get up to five paid seats, $1,000 in API credits, access to its plugin marketplace, and office hours with Anthropic’s applied AI team. The offer was announced at an SF Tech Week event, and applications run through the Claude for Startups page. If you qualify, it is a low-risk way to test AI on real work without a budget fight. Even so, a free year is a trial, not a strategy, so write down what you want it to improve and what happens to your data and your costs when the year ends. Read more at TechCrunch
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing off this edition, find out who in your company is running unpatched software or unsupervised AI.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.