The last day brought fresh data on just how hard ransomware gangs are leaning on small and midsize businesses, a cautionary tale out of one of the country’s largest healthcare companies, and a couple of moves that will shape how AI actually shows up in your tech stack this fall. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...
The last day brought a fresh SharePoint escalation worth acting on immediately, a wave of enterprise AI product launches from OpenAI, Microsoft, and Google, and new data on the gap between using AI and actually profiting from it. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. A fourth SharePoint flaw is under active attack, and this one steals the keys needed to forge trusted logins. Researchers confirmed active exploitation of CVE-2026-50522, a critical SharePoint Server flaw that lets attackers steal “machine keys,” the credentials SharePoint uses to sign valid authentication tokens, after a public proof-of-concept exploit appeared on July 20. Microsoft patched the underlying bug on July 14, but stolen keys remain useful to an attacker even after patching, so security researchers are urging affected organizations to rotate those keys, not just install the update. If your business or your IT provider runs on-premises SharePoint Server, patching alone will not close this door. It is worth explicitly asking whether machine keys have been rotated, not just whether the patch was applied. Read more at BleepingComputer ...
This week’s theme is autonomous AI agents cutting both ways: one broke into a major AI platform, one is running ransomware campaigns against AI infrastructure specifically, and one got so good at finishing its assigned tasks that it kept escaping the sandbox built to contain it. There is also a government database wiped after a failed extortion attempt, and a Washington deal that could change how soon you get access to the next frontier AI model. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. ...
It has been a mixed 24 hours in business IT: a vendor breach touching thousands of hospitals, a notable identity security acquisition in the MSP channel, fresh data on small business AI adoption, and a Microsoft price hike finally landing on invoices. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. A billing software breach at a vendor serving thousands of hospitals is a reminder that vendor risk is your risk. Edinburgh based Craneware, whose billing and pharmacy software is used by more than 2,000 U.S. hospitals and nearly 10,000 clinics and retail pharmacies, disclosed that hackers stole a portion of its employee, customer, and partner data before being expelled from its systems. The company says much of what was taken is non sensitive or already public information, and it has notified the FBI and UK’s Information Commissioner’s Office while its investigation continues. When you hand core operations like billing to a specialized vendor, your risk exposure follows their security posture, not just your own, so it is worth asking any vendor holding sensitive data for your business what breach notification commitments they have actually made to you, before you need the answer. Read more at TechCrunch ...
It was another loaded weekend in business IT: a new software supply chain attack, a fresh ransomware claim with a data leak threat attached, a European AI acquisition, and new data on just how many SMBs are still stuck in AI pilot mode. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. A new software supply chain attack shows old, abandoned developer accounts are a real risk. Researchers uncovered “SleeperGem,” an attack where two RubyGems maintainer accounts that had sat quiet for six or seven years were hijacked and used to slip malware into three packages, one of them impersonating Microsoft’s own Git Credential Manager and carrying over 500,000 downloads. The malicious code checks for CI/CD environment variables to avoid detection inside automated build pipelines before installing itself as a persistent background service. You do not need to write Ruby code for this to matter. If any vendor or contractor you rely on builds software using open source packages, and nearly all of them do, this is a reminder that “our vendor was never breached” is not the same as “our vendor’s dependencies were never breached.” It is a fair question to ask a software vendor how they monitor the packages their product depends on. Read more at The Hacker News ...
It has been a heavy security week, and it is closing out with a record Patch Tuesday, an escalated warning on SharePoint, and a ransomware attack that shut down a household name’s production line. There is also a big AI model launch expected today. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT. Rewst bets its platform’s future on AI agents and MCP, not more workflow templates. Rewst rebuilt its automation platform this month around an AI Agent tool that turns a plain-language description of a process into a working automation, plus a Model Context Protocol server that lets outside AI agents discover and run Rewst automations directly. The company frames the rebuild around a real skills gap: an estimated 80,000 MSPs worldwide and only about 1,000 people with the skills to build this kind of automation for them. The new version is in broader partner testing now, with general availability expected later this year. If your IT is outsourced, this is a good window into where the automation is headed on your provider’s end: more of your day-to-day support handled by AI agents they build and review, not just a technician clicking through a checklist. It is worth asking your provider directly how they validate what those agents do before it touches your environment. Read more at ChannelE2E ...
It has been a busy stretch out there, from a paused federal compliance deadline that will still keep MSPs busy to a fresh warning from Microsoft’s CEO about what businesses are really paying for AI. Here are the five stories from the last day or so that matter most if you are running or advising a small or midsize business. CMMC Phase 2 is paused, but the security work is not. The Department of War has suspended the second phase of the Cybersecurity Maturity Model Certification program, putting third-party certification requirements on hold while it runs a 60-day review to look for ways to cut costs and simplify the process. Defense contractors still have to meet the underlying NIST SP 800-171 controls and support their SPRS scores through self-assessment, and MSPs who manage firewalls, identity, backups, or cloud environments for those clients are still on the hook to provide supporting evidence. If you serve anyone in the defense industrial base, this is a good moment to reframe CMMC conversations around ongoing risk reduction and contractual obligation rather than a looming audit date, because that framing just got a lot more durable than the deadline did. Read more at MSSP Alert ...
Yesterday was Patch Tuesday, and it was a big one, so today’s roundup leans heavy on security. There’s also a partner program shakeup worth knowing about and a fresh look at why AI adoption isn’t translating into results for most companies. Let’s get into it. Microsoft’s biggest Patch Tuesday ever lands, with two zero-days already under attack Microsoft shipped fixes for a record 570 vulnerabilities this week, more than triple June’s previous high, including two flaws already being exploited: an elevation of privilege bug in on-prem SharePoint Server (CVE-2026-56164) and one in Active Directory Federation Services (CVE-2026-56155). A third issue, a BitLocker bypass, was publicly disclosed but not yet confirmed as exploited. John’s take: the sheer size of this release is going to tempt some teams to triage loosely and get to it next cycle. Do not do that with the SharePoint and ADFS fixes specifically, since those two are already being used in real attacks. ...
Ubiquiti shipped security updates this week addressing five vulnerabilities in UniFi OS, three of which carry maximum severity ratings. If you have UniFi Consoles or other UniFi OS-based devices in your environment, this is not one to let sit over a long weekend. What Was Patched The three maximum-severity flaws are: CVE-2026-34908 targets an Improper Access Control weakness that allows remote, unauthenticated attackers to make unauthorized changes to affected systems. ...