Today’s stories are about trust: the firewall you rely on, the recovery firm you call in a crisis, and the AI agent you are about to give an account of its own. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Attackers are changing passwords and deleting accounts to lock organizations out of their own Fortinet firewalls and VPNs. The FortiBleed campaign, blamed on a Russian access broker, has now compromised more than 86,000 FortiGate devices in about 190 countries, mostly by using stolen or weak credentials on internet-facing VPN portals. An FBI and Secret Service advisory warns that the intruders delete or change the original admin accounts, which keeps the owner out while the attackers look around and sell access to others. If Fortinet gear protects your office, ask whoever manages it today whether every VPN and admin password has been reset, whether the VPN requires phishing-resistant multifactor sign-in, and whether anyone has reviewed the account list for names you do not recognize. A firewall that attackers can log into is worse than no firewall, because everyone assumes it is protecting you. Read more at SecurityWeek
The owner of a Florida ransomware recovery firm is accused of telling victims he could decrypt their data, then secretly paying the criminals and billing them far more. Federal prosecutors say MonsterCloud charged clients more than $19 million while paying over $8 million in ransoms, in one case paying about $8,200 and billing about $150,000. The owner is charged with wire fraud, and these are allegations, not findings. Most small businesses have never vetted a ransomware negotiator or recovery firm, and the middle of an attack is the worst time to start. Before you need one, find out who your cyber insurer and your IT provider would call, what they would charge, and whether they will tell you in writing if a ransom is being paid. The best protection is still a backup you have actually tested restoring. Read more at The Hacker News
Microsoft Teams is getting support for third-party deepfake detection and a warning when a meeting participant may be an impostor. Both features are listed on the Microsoft 365 roadmap, with general availability expected in November. Certified outside providers will analyze meeting audio and video for synthetic content and feed signals back into Teams. Microsoft has not said how the features will be licensed or priced. Fake executives on video calls have already been used to talk employees into wiring money, so this is a real control to watch for. Don’t wait on a feature, though. Set a rule now that any request to move money or change payment details gets confirmed through a second channel, such as a call to a number you already have on file. Read more at BleepingComputer
Google has launched a Gemini agent that carries out tasks on its own, connects to company systems, and gets its own account and email address. The agent works across Google Workspace, Microsoft 365, Slack, Jira, and other tools, lets users pick the underlying model, including Anthropic’s Claude, and records its actions in an audit trail under its own name. Google is starting with businesses and says new spending controls, including real-time caps, will keep costs in check, though no prices were given. An AI agent with its own identity is a new kind of employee, and it deserves the same questions you would ask about a new hire. What can it see, who approves what it does, and how do you turn it off? Answer those before anyone connects it to your email or files. Read more at TechCrunch
Security software failed to protect devices about 21 percent of the time, and three quarters of surveyed security leaders have had downtime after an incident. Absolute Security’s 2026 Resilience Risk Index equates the failure rate to roughly 76 days a year of exposure on enterprise PCs. The argument is that spotting an attack is not the same as being able to keep working through it, so recovery belongs next to protection and detection. The research comes from a vendor with a product to sell, but the point holds for any size of company. Ask your IT team or provider two questions: how do we know our security tools are running on every device today, and how long would it take to get back to work if they failed? Put the answers in writing. Read more at ChannelE2E
Follow Up
Follow-up to Wednesday’s Atlassian story: attackers were probing the flaw within hours of a public exploit going online. Researchers published a working proof of concept for CVE-2026-21589 on October 6, and honeypots logged exploitation attempts the same day, with 190 attempts from 32 addresses by October 8. When Jira is linked to Crowd, the flaw can expose stored credentials and let an attacker add themselves as an administrator. If your team runs self-hosted Jira or Confluence and has not patched, treat it as urgent today, or take the system off the internet until it is updated. Read more at SecurityWeek
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you do one thing before the weekend, confirm that your firewall and VPN passwords have been changed and that someone is checking for the Atlassian patch.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.