Every so often, a week comes along where the headlines aren’t about a dramatic new hacking technique — they’re about the boring, unglamorous stuff: patches, updates, and configuration fixes. This is one of those weeks, and it’s worth paying attention to, because this kind of news is where most small businesses actually get exposed.
Cisco, MikroTik, and WatchGuard — three companies whose equipment quietly runs the networks of countless small and midsize businesses — all issued critical security advisories this week. Cisco confirmed attackers are actively exploiting a flaw in its SD-WAN Manager (the tool companies use to manage connections between office locations). CISA (the federal Cybersecurity and Infrastructure Security Agency) flagged a serious bug in MikroTik’s router software that could let an attacker take over a device without even needing a password. WatchGuard patched fifteen separate issues in its firewall software. None of these companies did anything wrong by having bugs — that’s normal in software. What matters is whether the fix gets applied. If your business uses a managed IT provider or MSP (managed service provider), this is a good week to ask a simple question: are our firewalls, routers, and network gear getting patched on a regular schedule, or only when something breaks?
The second theme this week is AI showing up on both sides of the fence. Google published research showing that AI tools are now finding software vulnerabilities faster than before — and that the bugs AI finds are more likely to be the serious kind that let an attacker take remote control of a system. At the same time, researchers found attackers abusing ChatGPT’s ’Custom GPT’ feature, disguising malicious tools as legitimate products to trick people into installing malware. And a separate report raised a newer concern: as businesses start using AI ’coworkers’ — AI agents that operate continuously with their own standing access to systems, rather than just answering one question at a time — the usual rules for managing who has access to what start to break down. None of this means AI is bad for your business. It means AI is becoming infrastructure, the same way email and cloud storage did, and infrastructure needs the same basic governance questions asked of it: who can use it, what can it touch, and who’s watching what it does.
On a quieter note, a Massachusetts-based human services agency reached a settlement over a data breach affecting its substance use recovery and support services program, and a Washington, D.C. Medicaid agency notified nearly 400,000 beneficiaries about exposed personal and health information. Neither story made huge headlines, but they’re a useful reminder that healthcare and human services organizations — even smaller, mission-driven ones — remain frequent targets and carry real regulatory obligations around how they handle personal data.
None of this week’s news calls for panic. It calls for the kind of steady, periodic check-in that’s easy to postpone: confirming patches are current, understanding what AI tools are actually in use across your business, and knowing who’s responsible for reviewing access to your systems. If you’re not sure where your business stands on any of that, or want a second set of eyes on your current setup, that’s what we’re here for.