News

Good morning. The weekend brought a running e-commerce emergency with no patch to install, a dark web listing that turned an identity verification vendor into everybody’s problem, and a court fight over whether a dead company gets to sell its employees’ work email to an AI lab. Underneath most of it is the same uncomfortable question, which is how much of your risk lives in systems you do not own and never chose. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good morning. Almost everything on today’s list comes back to the same idea, which is that the login is the real perimeter and most of us have quietly handed pieces of it to somebody else. An identity provider you did not know you were using, an app your employee approved in ten seconds, a phone system nobody has thought about since it was installed. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

There is a thread running through today’s news about time, specifically how long a problem stays a problem once it is inside your systems. A manufacturer still not shipping a week later, a botnet that outlasted two decades of cleanup efforts, and a model built to shrink the gap between a flaw being announced and being exploited. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good morning. Monday started with Microsoft 365 falling over and never fully got back up, which set the tone for a day where the news was less about clever attacks and more about the plumbing everyone assumes will just work. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. A Microsoft 365 outage that started Monday morning is still not fully resolved, and search is the piece that will not come back. Microsoft began investigating Exchange Online problems at 11:55 a.m. UTC on August 31, traced the root cause to an issue inside a core authentication configuration shared by multiple Microsoft 365 services, and watched it spread into SharePoint, OneDrive, Teams and Copilot. Mail flow was largely restored by late Monday, but as of Tuesday morning the company was still restarting infrastructure to fix search across Exchange, SharePoint, OneDrive and Teams, with no estimated time for full resolution. What makes this one worth reading past the headline is the root cause, because a single shared authentication component took down five products that most companies think of as separate purchases. If your continuity plan assumes that a problem in email will not touch your files or your chat, this incident is the cheap version of finding out otherwise, and the question to bring to your next leadership meeting is what your team actually does for the first four hours when the whole suite is degraded rather than down. Read more at Computerworld ...

Good morning. The long weekend had a theme running through it, and the theme was accounts. Not clever exploits or novel malware, but stolen sessions, phished logins, and trusted software quietly turning on the people who installed it. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. PaperCut shipped a second round of emergency patches over the weekend after researchers found several ways around the first ones. The print management vendor first warned on August 27 that attackers were actively exploiting its NG and MF products, then assigned CVE-2026-81578, an 8.8-rated authentication bypass in the web management interface, and CVE-2026-82078, a 9.4-rated unsafe dynamic class loading flaw in its database connection utilities. Working with researchers at watchTowr and Huntress, PaperCut discovered that the original fixes could be bypassed and published a second emergency release covering versions 24, 25 and 26 on Windows, Linux and macOS. Every supported version is affected, which means your version number tells you nothing about whether you are safe. This one deserves attention out of proportion to how boring print management sounds, because a PaperCut server sits inside your network, holds credentials to your directory and your database, and almost nobody has it on a patch schedule. If your company runs PaperCut anywhere, the question to ask this morning is not whether it was patched but whether it was patched again after August 28. Read more at BleepingComputer ...

Good morning. Thursday was one of those days where the headlines split neatly into two piles: the industry talking about what is coming, and a handful of companies living through what already arrived. A hundred of the biggest names in technology signed a letter about AI-driven attacks while a medical device maker spent the week unable to ship product. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good morning. Wednesday’s news had an odd symmetry to it. AI showed up on both sides of the ledger, finding a serious flaw for the defenders in one story and failing to move the earnings needle in another, while the attackers kept doing the unglamorous work of renting kits and walking through unlocked doors. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good afternoon. Tuesday’s news kept coming back to the same quiet problem, which is how often the thing that puts a business at risk is something nobody was told about. A plugin gets patched without an announcement, a vendor bug sits in the wild for months, an AI tool ships with a setting that made sense to an engineer and not to anyone else. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good afternoon. Tuesday’s news had an unusually clear theme, which is that the gap between what technology can now do and what an ordinary business can actually govern keeps getting wider. Attackers know exactly which companies sit in that gap, regulators have started writing checks against it, and the fixes on offer are mostly about who is watching, not what you buy. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...

Good morning. The weekend’s news kept circling back to the same uncomfortable idea, which is that the security controls we have been told to trust are only as good as everything wrapped around them. Passkeys, cloud keys, AI assistants, and search results all showed up with the same problem, and none of the fixes are technical heroics. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...