Threat Intelligence & Commentary

Security briefings and IT field notes
for real-world SMB operations.

Practical security briefings and IT field notes for business owners, operators, and teams who need clear context without the technical noise.

This Week's Stories Recent Weeks

Asteri Blog

Updated Weekly

Every Story Linked to Its Source

Built for SMB Decision Makers

This Week

Week of September 28, 2026

Three stories from the past week worth a small business owner's attention, each with one thing you can do about it.

Microsoft Office • Updates

A Microsoft update deactivated or removed Office 2016 and 2019 on some business PCs.

Microsoft paused update KB5002907 after it made some Office 2016 and Office 2019 installs show as unlicensed, and in rarer cases uninstalled Office completely. One IT provider reported dozens of affected PCs within about ten minutes on September 24. Microsoft says to re-enter the product key, or reinstall Office where it was removed.

What to do: find the product keys for any one-time-purchase Office copies your business owns and store them somewhere safe, so a reactivation takes minutes instead of a support call.

BleepingComputer Sep 26, 2026 Read the story →

Remote Access • Patching

Attackers are breaking into Citrix NetScaler remote access gateways through two new flaws.

Citrix disclosed eight NetScaler ADC and Gateway flaws on September 27, and two of them (CVE-2026-88771 and CVE-2026-88772) were already being used to run commands on unpatched devices. CISA advises checking for signs of compromise before updating. If your remote access runs through NetScaler, have it checked and upgraded to 14.1-73.37 or 13.1-64.23 now.

CISA Sep 27, 2026 Read the story →

Websites • WordPress

One malicious link could let an attacker add an admin to an Elementor WordPress site.

Elementor versions 4.3.0 and 4.3.1, used on up to 2 million sites, let a link opened by a logged-in admin quietly create a new admin account for an attacker. No attacks have been reported yet. Ask whoever runs your website to confirm Elementor is on 4.3.2 or later.

BleepingComputer Sep 25, 2026 Read the story →

Coverage Areas

The issues that actually show up
inside business environments.

The security and IT topics that come up most often in SMB environments, broken down into areas you can explore.

Identity

Access, MFA, sign-ins, and token misuse

Coverage focused on the ways attackers move through modern cloud identity systems and the controls that still matter for smaller teams.

Backups

Verification, failure visibility, and recovery readiness

Not whether a backup exists, but whether it is current, monitored, and recoverable under real operating conditions.

Patching

Risk windows, active exploitation, and update discipline

Why timing matters, where delays become risky, and how SMB teams can patch without creating constant operational drag.

Operations

Process gaps that become security gaps

Vendor changes, approval loops, remote access, endpoint drift, and the day-to-day decisions that often create the real attack surface.

Recent Weeks

Earlier stories worth
a second look.

Stories from the past several weeks that are still relevant, newest first.

Identity

Microsoft shut down "EvilTokens," a phishing kit that got around password resets.

Microsoft and UK police took down a phishing service tied to more than 12,000 compromised mailboxes that tricked people into entering a sign-in code on a real Microsoft page. In Microsoft 365, block "device code" sign-in for anyone who doesn't need it, and tell staff never to enter a sign-in code they didn't request.

Sep 22, 2026 · The Record Read the story →

Backups

September's Windows updates quietly broke File History backups.

Microsoft confirmed that this month's Windows 10 and 11 updates can stop File History from running while it still looks fine. If any PCs rely on it, make sure another backup is actually completing until the fix ships.

Sep 21, 2026 · BleepingComputer Read the story →

Vendor Breach

A third-party store app exposed BigCommerce shoppers' contact details.

Attackers used stolen credentials for the Ribon apps to plant scripts in BigCommerce storefronts for five days, exposing customer names, emails, and addresses. Every add-on in your online store can reach customer data, so remove the ones you no longer use.

Sep 21, 2026 · BleepingComputer Read the story →

Phishing & Fraud

Fake invoice emails are borrowing real vendor branding and fake reply chains.

Microsoft counted over a million invoice-fraud emails in early August, most aimed at U.S. companies and asking for around $50,000. Before paying a new invoice or changing a vendor's bank details, call them back at a number you already have on file.

Sep 11, 2026 · The Record Read the story →

Identity

Scammers are calling staff and posing as IT to "update" their passkey or MFA.

Two extortion groups have been phoning and texting employees, sending them to fake login pages, then adding their own MFA method to keep access to email and files. Make it a rule that IT never asks for this by phone, and give staff a known number to call back.

Sep 9, 2026 · Microsoft Security Blog Read the story →

Patching

September's Patch Tuesday was Microsoft's largest ever, with two flaws already in use.

The update fixes 974 vulnerabilities, including two that attackers were already exploiting to take full control of Windows machines. Confirm it's installed everywhere, starting with any Exchange, SharePoint, or Remote Desktop server that faces the internet.

Sep 8, 2026 · SecurityWeek Read the story →

About This Blog

Security news that's
actually useful to you.

Most security news is written for security researchers. Each week we pick a few stories that matter to smaller businesses and explain what happened and what to do about it, with a link to the original reporting.

We cover identity security, backup and recovery practices, patching timelines, endpoint protection, and the operational process gaps that create real risk for smaller organizations.

If something you read here applies to your business and you're not sure where to start, that's exactly what a free assessment is for.

Need Practical Guidance?

Not every headline needs panic.
Most need translation.

Asteri helps businesses turn security news into concrete action: patching priorities, backup validation, identity hygiene, and operational controls sized for real SMB environments.

Get a Free Assessment Explore Services

Security briefings and IT field notesfor real-world SMB operations.

Week of September 28, 2026

A Microsoft update deactivated or removed Office 2016 and 2019 on some business PCs.

Attackers are breaking into Citrix NetScaler remote access gateways through two new flaws.

One malicious link could let an attacker add an admin to an Elementor WordPress site.

The issues that actually show upinside business environments.

Access, MFA, sign-ins, and token misuse

Verification, failure visibility, and recovery readiness

Risk windows, active exploitation, and update discipline

Process gaps that become security gaps

Earlier stories wortha second look.

Microsoft shut down "EvilTokens," a phishing kit that got around password resets.

September's Windows updates quietly broke File History backups.

A third-party store app exposed BigCommerce shoppers' contact details.

Fake invoice emails are borrowing real vendor branding and fake reply chains.

Scammers are calling staff and posing as IT to "update" their passkey or MFA.

September's Patch Tuesday was Microsoft's largest ever, with two flaws already in use.

Security news that'sactually useful to you.

Not every headline needs panic.Most need translation.

Security briefings and IT field notes
for real-world SMB operations.

The issues that actually show up
inside business environments.

Earlier stories worth
a second look.

Security news that's
actually useful to you.

Not every headline needs panic.
Most need translation.