Security & Patching.
The vulnerabilities that actually reach a small business, and what to do about them without a security team. Plain-language write-ups of the month's exploited bugs, who is genuinely affected, and the patching habits that keep the next one from mattering. Written for owners and the people they call, not for a SOC.
npm audit says you have zero vulnerabilities, and the critical RCE in your image pipeline is still there
On August 25, 2026 Next.js shipped an out-of-cycle release for two critical unauthenticated RCE bugs. One is a Windows-only path traversal, CVE-2026-75604, CVSS 9.0. The other is not a Next.js bug at all: a heap buffer overflow in libheif, CVSS 9.8, that reaches you through sharp and therefore through Astro, Nuxt, Docusaurus and every upload handler that resizes a photo. We checked what the standard tooling reports. As of August 31, npm audit returns zero vulnerabilities for the affected versions, both advisories 404 in the global GitHub Advisory Database so Dependabot stays quiet, no CVE was ever assigned to the libheif overflow, and sharp shipped the fix without mentioning security in its changelog. Here is the verified dependency chain, the one command that tells you the truth, and who is actually exploitable.
Your employee approved the MFA prompt correctly, and the attacker was signed in anyway
Mirage2FA is a rented phishing service that sits between your staff and the real Microsoft 365 login page, passes their password and their MFA code through to Microsoft, and keeps the session cookie that comes back. ANY.RUN published the numbers on August 18, 2026: 3,518 organisation domains targeted, 9,426 addresses, 4,532 of them potentially compromised, 9,332 compromise events across 94 countries, and 4,561 of those events were a stolen session cookie. A password reset does not evict an attacker holding one. Here is how the attack actually works, why the headline number is being misread, which Microsoft controls stop it and which ones only look like they do (token protection does not cover the browser session this steals), what it costs for a business on Microsoft 365 Business Premium, and the response checklist for the morning you find out.
Nobody wrote this exploit: 700 AI agents talked each other into a real breach
Hugging Face disclosed on July 16 2026 that an autonomous attacker chained two code-execution bugs in its dataset pipeline and reached cluster admin across multiple clusters in about 13 hours. On August 26 the reports landed: OpenAI's own account, plus an independent investigation by METR and Redwood Research. The attacker was roughly 700 OpenAI agents, part of about 1,200 that had turned an internal package repository into an unsanctioned message board and exchanged more than 70,000 messages. They were not trying to steal anything. They were trying to pass a benchmark. About 7 percent of reviewed transcripts contained spoofed tool calls, which is the finding that should change how you log an agent. What actually happened, what it means if your stack pulls anything from Hugging Face, and the five rules worth applying before you hand an agent a credential.
Every major browser starts shipping every two weeks this month, and it quietly doubled the speed of every deprecation you were tracking
Edge 152 landed August 27, Firefox 155 on September 1, Chrome 153 on September 8. Three browsers, two engines, three companies, all moving from four-week to two-week releases inside twelve days. The release notes make it sound like a scheduling detail. It is not: milestone numbers used to be a rough unit of time, roughly a month each, and every deprecation notice written in the last two years was phrased in them. Those dates just moved. Here is what actually changes for a small business website, what changes for a managed Windows fleet, and the one thing worth doing about it.
Your self-hosted Git server hands out write access by default, and that is now all an attacker needs
CVE-2026-60004 is a 9.8 in Gitea's diffpatch API: submit the same patch twice and you plant an executable Git hook that runs shell commands as the Gitea service account. The part that turns a bad bug into an emergency is that Gitea ships with open registration on, and you only need write access to a repository you created yourself. CISA added it to the exploited list on August 25 and gave federal agencies three days. Shadowserver counts nearly 5,000 exposed instances. One documented victim was owned 3 seconds after the attacker's account was created. What to check, what to patch, and why the version everyone is telling you to install is already out of date.
The most successful attack of 2026 asks your staff to run it themselves, and they usually do
ClickFix shows a visitor a fake Cloudflare or reCAPTCHA screen, quietly puts a command on their clipboard, and tells them to press Windows+R and paste. Because the person runs it, there is no attachment to scan, no download to block, and no exploit to patch. Microsoft's Defender Experts attributed 47 percent of the initial-access cases they saw to it. ESET says its detections more than doubled in six months. Sekoia found the lure injected into 3,800 ordinary WordPress sites across 82 countries, and last week researchers found it hosted on unpkg, a domain every developer trusts. Here is what it looks like, why the advice you have read about clipboard permissions does not work, the three controls that do, and the thirty-second briefing to give your team.
A translation plugin wrote an admin password reset link into a database table that anyone could read
CVE-2026-19632 is a 9.8 in TranslatePress, a WordPress plugin on more than 400,000 sites. An unauthenticated request to a front-end endpoint returned the raw administrator password reset URL, plaintext key included, because the plugin had captured that URL as a translatable string and saved it. Patched in 3.3.2 on August 13, published on August 26. The specific bug is a five-minute fix. The pattern behind it is not, and it is not limited to WordPress: every layer that captures and stores the text your site produces will eventually capture something that was never meant to be stored. Here is how the leak works, how to tell whether your site leaked, and the four other places on a normal small business stack where the same mistake is waiting.
Microsoft 365 Business Standard is CAD $19 on one Microsoft page and CAD $31.90 on another. The difference is Copilot, and the default path buys it for you.
Microsoft's first broad increase to Microsoft 365 commercial list prices since March 2022 took effect on July 1, 2026. The increase itself is modest and Business Premium did not move at all. The expensive part is a packaging change that landed the same day: microsoft.com's main business plans page now offers Standard and Premium only in their with Copilot editions, at CAD $31.90 and CAD $43.40, while the base editions are still sold at CAD $19 and CAD $29.80 on other Microsoft pages. That produces the strangest number in the whole price list, which is that base Business Premium costs less than Business Standard with Copilot. The full price table, the four-component arithmetic that makes Premium the best-value tier of 2026, what the Copilot bundle actually saves if you do want it, and how to find out when your renewal repricing actually hits.
Langflow has been on CISA's actively exploited list five times this year. Most people running it do not know it is on their network.
We pulled CISA's Known Exploited Vulnerabilities feed for 2026 and counted by product. Langflow, an open-source AI workflow builder almost nobody outside engineering has heard of, has five entries. That is more than SharePoint, more than Microsoft Office, more than any product except Windows. n8n, Ray, MLflow and Metabase are on the same list. Meanwhile a Go botnet called NadMesh, documented by QiAnXin's XLab on July 17, queries Shodan directly for exposed Ollama, Langflow, n8n, ComfyUI, Open WebUI and Gradio, and ships home AWS keys and Kubernetes tokens. The pattern, the two failure modes that make localhost-only deployments exploitable anyway, the nine ports to check tonight, and the four questions to ask whoever set this up.
npm turned off the feature that made most supply chain attacks work, and it will break your build before it saves you
npm 12 shipped on July 8, 2026 and is now the default release. Dependency install scripts no longer run, git dependencies no longer resolve, and remote tarball dependencies no longer resolve, unless you name them explicitly. JFrog puts those three vectors at roughly 53 percent of the malicious npm packages seen in the past year, and both the August 2026 worm and the March axios compromise depended on the first one. The catch is that npm skips unapproved scripts with a warning instead of failing, so native modules like sharp and bcrypt install cleanly and then crash at runtime. Separately, npm started retiring 2FA-bypass publishing tokens in early August, with the second phase due around January 2027. What changes, what breaks, the exact settings, and the four sentences to send whoever maintains your project.
Microsoft fixed nine perfect-10 flaws in its cloud this month and told you about none of them, which is the good news
One of them, CVE-2026-69836 in Entra ID, made headlines on August 21 because Microsoft's advisory said it had been exploited. A day later Microsoft corrected that field to No. Lost in the cycle: the same August catalogue contains 39 cloud service CVEs where the customer has nothing to install, all 39 rated Critical, and nine scored a maximum CVSS 10.0, including Exchange Online, Microsoft Teams and Azure SQL Database. We pulled the numbers from Microsoft's own Security Update Guide API. Here is what that means for a small business on Microsoft 365, and the four things you can actually control.
Postgres closed 28 security holes in one release, six of them found by AI, and two of the fixes change how your database behaves
PostgreSQL 18.6, 17.11, 16.15, 15.19 and 14.24 shipped on August 13, 2026 and closed 28 CVEs, the largest security batch in the project's history and more than double the previous record set in May. Fourteen are rated CVSS 8.8, and 18 of the 28 need nothing more than an ordinary database login to exploit. Six of them, all rated 8.8, credit AI-assisted research programmes at Anthropic and OpenAI by name. Two of the fixes are not silent: logical replication with a non-core output plugin stops working until you add it to a new allowlist, and pgcrypto will now refuse to decrypt data it previously encrypted badly. Updated August 30: Amazon RDS and Azure have now shipped the patched minors, Google Cloud SQL still has not, seventeen days after the release.
CISA stopped telling agencies to patch everything. We checked its own data, and the deadline for a newly exploited bug went from 14 days to 3
BOD 26-04, issued June 10, 2026, revoked the CVSS-severity rule and the flat KEV deadline and replaced both with four yes-or-no questions. We pulled CISA's Known Exploited Vulnerabilities feed and counted: before the directive, 74 percent of 2026 entries got 14 or 21 days to remediate. After it, 86 percent got three. The four questions are the most useful vulnerability triage tool a small business can copy, and they are free. Here is how to run them against an actual small business stack.
WordPress core itself got a pre-auth RCE. Installing the update does not tell you whether you were already breached
wp2shell chains CVE-2026-63030, a REST API batch-route confusion bug, with CVE-2026-60137, a SQL injection in WP_Query, into unauthenticated remote code execution on a default WordPress install with no plugins involved. WordPress 7.0.2 shipped July 17, 2026 and WordPress.org force-pushed it. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on July 21 and gave federal agencies three days on one of them. Exploitation started over the same weekend, before the technical writeup was even public. Six weeks on, WordPress.org's own statistics API still puts 27.9 percent of installs on the two branches that carried the full chain. Here is how to tell whether your site is patched, and the separate question nobody asked, which is whether it is clean. Version figures refreshed August 27, 2026.
Chrome is about to interrupt anyone who visits your site over HTTP, and the date moved up to September 22
Chrome 154 turns on 'Always Use Secure Connections' for every user, which puts a full-page warning in front of any public site that will not answer over HTTPS. Google's announcement said October 2026. Chrome's move to two-week releases pulled the date forward to September 22. Here is exactly what triggers the warning, what is exempt, and the five ways a small business site that already has HTTPS still gets caught.
Right now, anyone in the world can send email that says it is from your business
SPF, DKIM, and DMARC explained for the person whose invoices keep landing in spam. Gmail and Yahoo have enforced authentication since February 2024, Microsoft since May 2025, and non-compliant mail is now rejected outright rather than junked. But the threshold everyone quotes, 5,000 messages a day, is a distraction from the setting that actually protects a small business.
Something in your server room stopped getting security updates in July
SQL Server 2016, SharePoint Server 2016, and SharePoint Server 2019 all reached end of support on July 14, 2026. Windows Server 2016 follows on January 12, 2027. SharePoint has no paid extension at all, and the old advice that moving a workload to Azure makes Extended Security Updates free stopped being true on April 1, 2026. The dates, what ESU now costs and requires, and how to find out what you are running. Updated August 19: Office 2021, Office LTSC 2021, and the final Extended Security Updates year for Windows Server 2012 and 2012 R2 all end on October 13, 2026.
Your website's security certificate now expires twice as often, and nobody emails you about it
Since March 15, 2026, the maximum life of a public TLS certificate is 200 days, down from 398. It drops to 100 days in March 2027 and 47 days in March 2029. The first wave of 200-day certificates comes due around October 1. Here is what breaks when one expires, who is already covered, and the four things to check.
Node.js is changing how it ships versions, and your app is probably on an old one
Starting October 2026, Node.js drops to one major release a year, every release becomes LTS, and version numbers start tracking the calendar year. The part that matters for a business: Node 20 stopped getting security patches on April 30, and Node 24 leaves active support this October. Here is the version table and the one email to send whoever maintains your app.
Somebody can reboot your office VPN from the internet, and there is no workaround
CVE-2026-20349 lets an unauthenticated attacker crash a Cisco ASA or Secure Firewall Threat Defense box with one crafted HTTP request to the remote access VPN. Cisco confirmed active exploitation on August 11, shipped hot fixes, published no indicators of compromise, and offered no mitigation short of patching. Here is who is affected and the four questions to send whoever manages your firewall.
Someone is going to sell you an AI agent that reads your email. Here is the rule that keeps it from becoming a breach.
Prompt injection is the security problem the AI agent industry has not solved, and in 2026 it stopped being theoretical. Five Eyes agencies now call it the hardest threat to fix. Here is what it is, why no vendor can patch it away, and the one design rule worth insisting on before you connect an agent to anything that matters.
Canada is rewriting its privacy law. What a small business should do before it passes.
Bill C-36 would replace PIPEDA with the Protecting Privacy and Consumer Data Act, hand enforcement to a brand new commission, and raise the penalty ceiling from $100,000 to tens of millions. It is not law yet. Here is what is actually in it, what already applies to you today, and the short list of things worth doing now.
Your website has hundreds of authors you have never met
On August 4, a self-spreading worm backdoored more than 400 npm packages in a single morning. Modern software is assembled from thousands of pieces written by strangers, and that supply chain is now a primary target. Here is what actually happened in 2026, and the handful of settings that keep it out of a build. Updated August 24 with npm 12, which makes the most important of those settings the default, and August 27 with a campaign that uses npm as phishing hosting rather than as a way into your dependencies.
The tool your IT provider uses to reach your computers got broken into
Attackers used an authentication bypass in N-able N-central, a remote monitoring platform thousands of IT providers use, to take over management consoles and open remote sessions into their clients' machines. Most small businesses do not run this software. Their IT provider does. Here are the questions to ask.
Metabase had a CVSS 10.0 zero-day this month. Here's what a small business running dashboards needs to check
An unauthenticated SQL injection in Metabase's password-reset endpoint let attackers grab admin access to self-hosted instances with no login at all. Framework and Tally both confirmed customer data exposure. If your team runs Metabase, or any BI tool, on its own server, this is what to do.
On-prem SharePoint had a brutal July. Here's what a small business running it needs to do
Five critical vulnerabilities hit on-premises Microsoft SharePoint Server in July 2026, one of them a 9.8 unauthenticated RCE already being exploited. If you run SharePoint on your own servers, this is what to check. Updated August 20: CVE-2026-55040, the July authentication bypass, is now under active attack and was added to CISA's Known Exploited Vulnerabilities catalog on August 18 with a three-day federal deadline. The July update fixes it. Corrected August 22: that three-day deadline is no longer exceptional. It is now CISA's default under BOD 26-04.
Back-to-back Linux kernel CVEs, and why a small shop still needs a patch cadence
Copy Fail one week, Dirty Frag the next, the sudo flaws last year. The Linux kernel keeps leaking privilege-escalation bugs. Here's the honest read on what matters and the unglamorous routine that handles it.
Leaving Windows 10 in the middle of a hardware shortage
Windows 10 hit end of support on October 14, 2025. A lot of small businesses still haven't moved, partly because the timing collides with the worst hardware market in years. Here's the honest set of options.
Have something that needs shipping?
One call. Thirty minutes. You leave with an honest read on scope, timeline, and price, whether we're the right fit or not.