News

Today’s stories are about trust: the firewall you rely on, the recovery firm you call in a crisis, and the AI agent you are about to give an account of its own. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. Attackers are changing passwords and deleting accounts to lock organizations out of their own Fortinet firewalls and VPNs. The FortiBleed campaign, blamed on a Russian access broker, has now compromised more than 86,000 FortiGate devices in about 190 countries, mostly by using stolen or weak credentials on internet-facing VPN portals. An FBI and Secret Service advisory warns that the intruders delete or change the original admin accounts, which keeps the owner out while the attackers look around and sell access to others. If Fortinet gear protects your office, ask whoever manages it today whether every VPN and admin password has been reset, whether the VPN requires phishing-resistant multifactor sign-in, and whether anyone has reviewed the account list for names you do not recognize. A firewall that attackers can log into is worse than no firewall, because everyone assumes it is protecting you. Read more at SecurityWeek ...

Today’s stories share a theme: the login box, the AI tool, and the software you forgot about can each be the way in. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. Fake ChatGPT, Gemini, and Claude advertising pages are stealing logins and MFA codes from people who manage ad accounts. The lookalike pages ask you to connect your account, then show a convincing fake Google sign-in window built inside the page itself, and a human operator on the other end asks for passwords, text codes, and authenticator approvals in real time. The targets are agency staff and ad managers who can reach many accounts, because attackers can burn through ad balances or resell the access. Whoever runs your marketing or advertising accounts is now a high-value target, and multifactor sign-in alone will not save them from a live operator. Teach them one simple test: a real sign-in popup can be dragged outside the browser window, and a fake one cannot. Read more at BleepingComputer ...

Today’s news is a reminder that your risk is often someone else’s mistake: a contractor’s skipped patch exposed FBI employees, and an email server fix lands for anyone still running their own. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. The FBI says a contractor’s missed patch is how ShinyHunters got into its jobs site and took data on thousands of bureau employees. Brett Leatherman, the FBI’s cyber chief, said an Accenture contractor managing the Oracle PeopleSoft platform failed to apply a security patch that had been issued, and the FBI has since removed the contractor and added protections. ShinyHunters announced the breach on September 22, and the group has also lost leaders to arrests in the Netherlands and Jordan in recent weeks. The lesson has nothing to do with the FBI’s size. When a vendor runs a system that holds your people’s data, their patching habits are your risk, and a contract does not apply the update for you. Ask each provider who manages a system with employee or customer data how fast they patch and how you would find out if they fell behind. Read more at SecurityWeek ...

Here is your weekend catch-up: a Citrix NetScaler flaw that turned out to be worse than first described, a ransomware crew using old SharePoint bugs to switch off security tools, and a survey that shows how loosely most companies are controlling their AI tools. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. Citrix has patched a new NetScaler flaw that attackers are already using, and it may allow more than the knockout it was first described as. CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway appliances that are set up for SAML sign-in. Citrix first called it a denial of service problem, but researchers have since seen patched-looking devices downloading and running malware, which points to remote code execution. CISA confirmed active exploitation and gave federal agencies until October 7 to act, and fixed builds 14.1-73.41 and 13.1-64.28 are available now. If your company uses NetScaler for remote access or single sign-on, this is a today question for whoever runs it: are we on a fixed build, and has anyone checked the appliance for signs it was touched before the update? Treat anything that sits on the edge of your network as a priority to patch, not a task for the next maintenance window. Read more at BleepingComputer ...

Today brings a proof-of-concept for an iPhone and Mac flaw that is already being attacked, AI coding tools that quietly published a few hundred companies’ internal screens to the public internet, and a ransomware gang taken down by a very international police effort. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. A proof-of-concept is now public for an Apple PDF flaw that attackers were already using, and the only fix is to update. The bug sits in how iPhones and Macs process fonts embedded in PDF files, and a crafted document can corrupt memory on the device. Apple shipped fixes on September 28, CISA added the flaw to its list of vulnerabilities under active attack the next day, and a researcher published a working crash demo on September 30. It does not yet run attacker code, but the public proof makes the next step easier for everyone, and there is no workaround for devices that have not been updated. Your team opens PDFs from customers, vendors, and strangers all day, and a lot of those PDFs land on phones that nobody in IT is watching. Ask whoever manages your devices whether iOS 27 and the matching Mac update are on every company phone and laptop, and if you let people use personal phones for work email, send a plain “please update today” note to them as well. Read more at The Hacker News ...

Today brings a perfect 9.8 flaw in Cisco’s SD-WAN management software that attackers are already using, an AI agent that hacked a security nonprofit on its own, and two AI announcements that land directly on a small business budget. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. Attackers are exploiting a 9.8 severity authentication bypass in Cisco’s SD-WAN Manager, and there is no workaround, only an upgrade. Cisco says CVE-2026-76504 lets an attacker craft a specially encoded request that skips the login check and use the Manager’s API as the admin user, no credentials required. Cisco’s own team saw it being used in real attacks during September, and fixed releases are available for every affected version. The only interim step is to cut off internet access to the Manager and limit connections to trusted hosts. If your company uses Cisco SD-WAN to tie together offices or branch locations, the management console is the keys to the whole network, so this is a same day question for whoever runs it: is the Manager reachable from the internet, and has it been upgraded? Ask that person to also confirm nobody has been poking around in it already. Read more at The Hacker News ...

The weekend delivered two separate zero-days rated 9.5 out of 10 aimed at software already sitting inside plenty of business networks, a file transfer vendor that told its own customers to shut down for a few hours just in case, and a Friday announcement that if your business runs Microsoft 365, its AI assistant is about to start acting a lot more like a coworker than a chat window. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Friday brought two stories about AI agents doing things nobody told them to do, one from OpenAI’s own research work and one from a flaw in Salesforce’s Agentforce, and together they say less about any single vendor and more about what happens when agents get access before they get boundaries. Add a fresh CISA deadline and a run of Microsoft 365 breaches traced back to forgotten accounts, and it has been a full week for anyone minding the store. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good afternoon. If there is a thread running through Wednesday and this morning, it is that attackers have stopped buying expensive tools and started renting your trust instead. A fake second authentication step, a poisoned chatbot answer, a plain email with a link in it, and a patch window that has shrunk from weeks to hours. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good morning. Tuesday turned into one of those days where the vendors you depend on all showed up at once, some with emergency patches and some with new price lists. Four separate products landed on the federal must-fix list in a single afternoon, and while that was happening the two biggest AI companies cut their prices within an hour of each other. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...