Most small businesses can name their main software: the accounting package, the email system, the customer database. Far fewer can list everything else that is connected to the internet on their behalf. That includes the office router, the VPN (a ’virtual private network,’ the tool that lets staff connect securely from home), and the file-sharing server someone set up a few years ago. This week’s news keeps circling back to those quieter pieces.
Theme 1: The edge of your network gets attention too
BleepingComputer reports that attackers are exploiting a critical flaw in a Collabora Online component that is built into Nextcloud, a popular self-hosted file-sharing and collaboration platform. The flaw lets them run commands on the server. Separately, a high-severity bug in Ivanti Connect Secure, a widely used VPN product, is being exploited as a ’zero-day.’ That means attackers were using it before a fix was available. And a campaign has taken over D-Link and Ubiquiti networking devices in 34 countries to resell victims’ internet bandwidth through a commercial proxy network. Nothing was stolen from those victims. Their connections were simply rented out to strangers.
The common thread is that these are devices and add-ons people tend to set up once and forget. A practical first step is a simple written list. What do we run ourselves? What faces the internet? Who is responsible for each item? If the answer to the last question is ’not sure,’ that’s worth fixing before anything else. If you rely on an IT provider, ask them for that list. It’s a reasonable thing to request.
A related headline is a flaw in the Linux kernel, the core of many servers, that lets code in one virtual machine read memory on the host computer. A researcher demonstrated it against Vercel’s live cloud. For most small businesses the takeaway is about shared infrastructure. When you rent space on someone else’s cloud, part of your security depends on how well they run it. Asking a provider how they handle issues like this is fair.
Theme 2: A breach has a long tail
The HIPAA Journal’s July 2026 report counts 77 healthcare data breaches affecting 500 or more people, reported to the U.S. Department of Health and Human Services. In a separate story, a Minnesota pain clinic has settled class action litigation that arose from a breach in July 2025. That’s roughly a year of legal follow-through after the incident. SecurityWeek also reports that the scope of the UK Legal Aid Agency hack grew after a forensic review, with most of the affected data covering applications, claims, and payments from 2007 to 2025.
Two lessons stand out. First, the first estimate of a breach’s size is often not the final one, so it helps to have logs and records that let you answer ’what exactly was exposed?’ later. Second, the more old data you keep, the more there is to lose. Ask yourself whether you truly need information from 15 or 20 years ago. Retention rules vary by industry and situation, so it’s worth asking your own advisor what you are required to keep and what you can safely let go.
Theme 3: If it gets that far, the details matter
Krebs on Security reports that the U.K. has sanctioned Cryptomus, a cryptocurrency platform that experts say has been a major channel for ransomware-related payments. It also reports that the FBI arrested a co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group. We don’t know more than the headlines say, and it would be unfair to draw broad conclusions from them. But they are a reminder that decisions made in the middle of an incident, like who you bring in to help or how a payment might be handled, can carry legal and regulatory weight. Those questions are worth thinking through with your own legal counsel and insurer before you’re under pressure.
A small win
Google is rolling out AI-powered defenses on Android against scam messages and call-forwarding abuse. If you or your staff use Android phones, check that the device is up to date so you can receive these protections as they reach eligible devices.
If you’d like help putting together that ’what do we run?’ list, or just want to talk through how any of this applies to your business, that’s what we’re here for.