The threats and deadlines that actually affect a small or midsize business — in plain English, with what to do about each. Government advisories straight from CISA (the U.S. government's cyber-defense agency), the attack stories that matter, and the IT deadlines heading for your calendar. No fear-mongering, no email gate.
Dates when something your business relies on stops working, changes behavior, or becomes an obligation. Every date is verified against the primary source linked on the card — not against someone's blog post.
Sep 1, 2026passed
Microsoft 365: passkeys become the default sign-in
What happens: Users still enabled for text-message or voice codes are automatically enrolled for passkeys and start seeing registration prompts at sign-in. The prompts can be snoozed — for now.
Who it affects: Every business running Microsoft 365 where anyone still signs in with a texted code.
Do this: Inventory who still uses SMS or voice codes, choose each group's passkey method (Authenticator app, Windows Hello, or a hardware key), and tell your team before the prompts surprise them.
CMMC: 60-day review window closed — no outcome published yet
What happens: On July 13, 2026 the Department of War suspended CMMC Phase II and ordered a 60-day program review. That window closed on September 11. As of September 23, the Department's official CMMC page still describes Phase II as suspended and has published no review outcome and no new date. What has NOT changed: Phase I self-assessment requirements remain in place, DFARS 252.204-7012 still requires NIST SP 800-171, and DFARS 252.204-7019 and -7020 still require a current SPRS score and annual affirmation.
Who it affects: Defense suppliers, machine shops, and subcontractors handling federal contract information or CUI — at any tier.
Do this: Do not stand down. Keep your NIST 800-171 self-assessment and SPRS score current. An affirmation is a legal statement, and the Department of Justice's Civil Cyber-Fraud Initiative has pursued contractors over misrepresented cybersecurity compliance whether or not a certification deadline is pending. We will update this entry when the Department publishes the outcome.
Windows 10: business Extended Security Updates, Year 1 ends
What happens: Paid business ESU coverage for Windows 10 is sold in yearly blocks, and Year 1 ends on this date. A business PC keeps getting security patches only if Year 2 (October 14, 2026 to October 12, 2027) has been bought for it. Microsoft lists the business price as $61 per device for the first year, doubling each year. Microsoft has extended the separate consumer ESU program to October 12, 2027, but says that program can't be used in commercial scenarios.
Who it affects: Any business still running Windows 10 PCs, including machines enrolled in ESU as a stopgap.
Do this: Count your remaining Windows 10 PCs now. Upgrade or replace what you can, and buy Year 2 business ESU before October 13 only for machines that genuinely can't move yet. Don't rely on the consumer program for business PCs.
Microsoft 365: text-message and voice sign-in codes retired
What happens: Microsoft-provided SMS and voice delivery is fully retired from the sign-in system behind Microsoft 365 (Entra ID). Users whose only second factor is a texted code hit a blocking passkey-registration prompt — Microsoft's own wording: there is no opt-out, for any tenant. Organizations with a genuine regulatory need for texted codes will be able to buy them back through a third-party provider, at per-message cost — details in our guide.
Who it affects: Every Microsoft 365 organization, every industry, every size.
Do this: Finish moving every user to a passkey, Windows Hello, or a security key before this date. Check whether your password-reset process also depends on text messages — the retirement covers that too.
The stories below are curated and written by us — each with the part most reporting skips: what it means for a business your size, and what to do. The live list underneath comes straight from CISA.
Act nowSep 23, 2026
Microsoft takes down EvilTokens, a phishing service that turned Microsoft's own sign-in page against more than 12,000 inboxes
On September 22, 2026, Microsoft's Digital Crimes Unit announced it had disrupted EvilTokens, a phishing-as-a-service platform that criminals bought by subscription. By Microsoft's count, the service appeared in February 2026 and within a few months was tied to more than 12,000 compromised inboxes at more than 10,000 organizations. Microsoft says victims were most concentrated in the United States, Canada, the United Kingdom, Australia, India and France, and included healthcare, real estate, financial services, construction, wholesale distribution and higher education organizations. The attack abused the device code sign-in flow: a victim was tricked into typing a code on Microsoft's genuine sign-in page, and that handed the attacker a working mailbox session without the password ever being disclosed. According to Microsoft, resetting the password did not end that access unless the sessions and tokens were revoked as well. Once inside, the service's AI assistant could summarize a mailbox, pull out wire-transfer conversations and vendor invoices, and suggest who to impersonate. Acting under authorization from the U.S. District Court for the Eastern District of Virginia, with Health-ISAC as co-plaintiff, Microsoft and its partners seized 50 websites that ran the service and disabled more than 150 related domains. In the United Kingdom, the Metropolitan Police Service arrested two men on September 11, 2026 as part of the investigation. Microsoft Threat Intelligence recommends blocking device code flow wherever possible.
What it means for you: The takedown removes one service, not the technique, and Microsoft itself warns that the approach EvilTokens demonstrated will outlast it. Device code phishing works against staff who did everything they were taught: the sign-in page was Microsoft's own, and no password was typed into a fake site. The fix is a setting, not more training. First, this week, ask whoever manages your Microsoft 365 tenant whether device code sign-in is blocked. Microsoft recommends blocking it wherever possible with a Conditional Access policy and allowing it only where there is a documented need. Run the policy in report-only mode first to see what it would affect, then turn it on. Second, if an account is ever suspected of being taken over, a password reset alone is not the response. Microsoft's guidance is to revoke the user's sign-in sessions, force a fresh sign-in, and disable the account while you investigate, because revoking sessions can leave existing access working for up to an hour. Make sure your IT provider's incident steps include all three. Third, the real target was money. Assume that anyone inside a mailbox can find your payment history in minutes. Every request to change bank details, redirect a payment or approve something unusual gets confirmed through a second channel, such as a phone call to a number you already have, never one supplied in the email. For escrow, title, real estate and accounting firms, that callback rule is the control that matters most.
WordPress fixes a critical flaw in its core software, and attackers started probing sites within hours
On September 22, 2026, WordPress released version 7.1.2, a security release fixing CVE-2026-87902, which the WordPress security advisory rates critical (CVSS 9.2). The flaw is in how WordPress picks the template file for a page: an attacker with no account can make WordPress load a readable PHP file from outside the active theme's folders, and in some server setups that can be turned into running the attacker's own code. The advisory lists WordPress 4.7 through 7.1.1 as affected. The fix was backported to every branch still eligible for security fixes, back to 4.7; fixed versions include 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9 and 4.7.37. WordPress 4.6 and earlier receive no fix. WordPress says that on sites supporting automatic background updates, the update will begin automatically. Patchstack, a WordPress security firm, reports that it saw the first exploitation attempts against sites it protects on September 22, within hours of the release, and that by midday UTC on September 23 the volume was more than ten times what it saw on the first evening, including attempts to write PHP files to disk. According to Patchstack, the file loading works against an unpatched site whose active theme has a top-level folder with a name beginning "page-"; the code-execution attacks it has observed also depend on the PHP setting register_argc_argv being enabled and the PEAR tool pearcmd.php being present on the server.
What it means for you: Most small businesses do not think of their website as a server they are responsible for, but a WordPress site is exactly that, and it is often the least-watched system a company runs. Three things to do this week. First, log in to every WordPress site you own, including the old campaign landing page, the careers site and the microsite nobody has touched in years, and confirm it is on 7.1.2 or the patched release for its branch. Do not assume the automatic update ran; check the version number yourself, because an unpatched site is the one that gets found. Second, if a site is still on WordPress 4.6 or earlier, no fix is coming for it; plan to rebuild or retire it. Third, if a site sat unpatched while this was being probed, have whoever manages it look for PHP files that should not be there and administrator accounts nobody created, then change the site's passwords. A compromised website is rarely just a defaced page: it can serve malware to your customers under your name or host a phishing page aimed at them. If you do not know who can log in to your website or who is responsible for updating it, that is the first thing to fix.
Six vendors in three weeks: September's attacks are aimed at the firewall and VPN box at the edge of your network
Between September 2 and September 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added actively exploited flaws from six vendors to its Known Exploited Vulnerabilities catalog. All six make firewall, VPN or remote-access products: SonicWall SMA 1000 remote-access appliances (two flaws, September 2), Fortinet FortiOS (September 9), Citrix NetScaler ADC and Gateway (September 9), MikroTik RouterOS (two flaws, September 10), Check Point security gateways and management servers (two flaws, September 22) and F5 BIG-IP Access Policy Manager (September 22). CISA's own descriptions include an attacker bypassing sign-in on a NetScaler gateway, running code on a Check Point gateway that uses site-to-site or remote-access VPN, and remote code execution on BIG-IP APM when an OAuth profile is configured. Each of the six carries a three-day remediation deadline for federal agencies. For the F5 flaw, CISA's listing tells agencies to apply the vendor's temporary mitigation first so a forensic check can be done, and only then install the final patch.
What it means for you: These are the devices every remote worker and branch office connects through, and they face the internet by design, which is why attackers go after them first. Three things to do this week. First, list the make, model and firmware of every firewall, VPN and remote-access appliance you run, including the one at a satellite office nobody has logged into in years. If it is on this list, patch it now. Second, a patch does not tell you whether someone already got in: look for administrator accounts you do not recognize, configuration changes nobody made and VPN sessions from unfamiliar places, and treat anything you find as an incident. Third, take the management page off the internet if it does not need to be there; most do not. If a device is past its vendor's end of support, no patch is coming, so replace it. Read our guide →
Microsoft switches passkeys on for your staff automatically on September 1 — and the opt-out expires in February
Microsoft has now spelled out the mechanics of a change most businesses have not prepared for. In its own words: “Starting September 1, 2026, passkeys become the default authentication experience and will be automatically enabled for users enabled for SMS or voice.” That happens inside your tenant without an administrator doing anything — anyone currently set up for texted or voice codes has passkeys switched on for them in the Authentication Methods Policy. September is not the hard part. A temporary opt-out exists for the window between September 1 and February 1, 2027. After that the tone changes: Microsoft states that from February 1, 2027, users whose only available MFA method is SMS or voice “will be required to register a passkey during sign-in to continue accessing their account,” that the prompt will be blocking, and — verbatim — “There is no opt out from this February 1 behavior. It will be enforced for all tenants.”
What it means for you: Two different problems, five months apart. September’s is confusion: your people start seeing passkey prompts nobody warned them about, and an unexpected security prompt is exactly what a well-built phishing page imitates. Send a short note before September 1 saying the prompt is genuine, what it looks like and who to ask — that one email prevents most of the calls and most of the risk. February’s is an outage. Anyone whose only second factor is a texted code will be stopped at sign-in until they enroll a passkey, and there is no administrative switch to defer it. The work itself is not hard: find every account still relying on SMS or voice as its only method and move it to a passkey or an authenticator app. Done this fall it is routine housekeeping. Done on February 2 it is a lockout, in business hours, with no way to buy time. Read our guide →
A SharePoint patch sat available for a month. A proof-of-concept turned it into an attack in one day.
CVE-2026-55040 is an authentication bypass in Microsoft SharePoint — Microsoft describes it as a weak authentication issue that lets an attacker bypass a security feature over a network, exposing files and allowing data to be modified. Microsoft scores it CVSS 9.1. Microsoft shipped the fix in its July 2026 Patch Tuesday. Rapid7 published proof-of-concept exploit code on August 11, 2026, and threat-intelligence firm Defused reported real attacks on August 12 — the next day. It is the fifth SharePoint flaw exploited in the wild this summer, after CVE-2026-50522, CVE-2026-58644, CVE-2026-56164 and CVE-2026-45659.
What it means for you: The fix existed for a month before anyone was attacked with it. That gap is the whole story, and it is not a Microsoft problem — it is a patching-cadence problem. Public exploit code compresses your safe window from weeks to hours, so the question is not whether your team would eventually have applied the July updates, it is whether they were applied before August 11. If you run SharePoint Server on-premises, confirm the July 2026 cumulative update is actually installed, not merely downloaded. SharePoint Online is Microsoft's to patch.
Adobe ships a Priority 1 ColdFusion fix — including a CVSS 10.0 command injection
Adobe security bulletin APSB26-90, dated August 11, 2026 and rated Priority 1, patches sixteen ColdFusion vulnerabilities. The most severe, CVE-2026-48362, is an OS command injection scoring CVSS 10.0 and leading to arbitrary code execution; CVE-2026-48273 (eval injection, 9.9) is close behind. Affected: ColdFusion 2025 through 2025.0.11 and ColdFusion 2023 through 2023.0.22. Fixed in 2025.0.12 and 2023.0.23.
What it means for you: ColdFusion is the kind of platform that is easy to forget you are running — it is usually underneath one old line-of-business application nobody has touched in years, and it is frequently reachable from the internet. That combination is why a CVSS 10.0 here is an emergency rather than a maintenance item: command injection on an internet-facing server is a full compromise with no credentials required. If you do not know whether you run ColdFusion, that is the finding, not the answer — an accurate application inventory is the first thing any of this depends on.
Actively exploited flaw in N-able N-central — and the first fix did not hold
N-able disclosed CVE-2026-18577 on August 2, 2026: an authentication bypass that grants administrative takeover of an N-central server. It exists because the earlier fix for CVE-2026-18556 was incomplete — attackers found another route to the same flaw. CISA added it to the Known Exploited Vulnerabilities catalog on August 3, 2026 and gave federal agencies three days to remediate, its strongest urgency signal. Every build through 2026.3.1 is affected; the fix is N-central 2026.3 HF1 (Hotfix 1). N-central is a platform many IT providers use to manage their clients’ systems, so a compromised server can mean attacker access to every business behind it.
What it means for you: This is a supply-chain risk: the question isn’t whether YOUR systems run this software — it’s whether your IT provider’s do. Ask one question today, and note that the obvious version of it is now the wrong one: “patched for CVE-2026-18556” is no longer a sufficient answer, because 2026.2 fixed that path and remained exploitable. The question to ask is: “Is our N-central instance on 2026.3 HF1 or later, and on what date was it applied?” A good provider answers with a version and a date. Silence is an answer too.
Hotel and guest Wi-Fi hijacked to steal Microsoft 365 logins
Microsoft Threat Intelligence is warning about a campaign it calls CaptiveCrunch, attributed to a Russian state-linked group. Attackers compromise the sign-in pages of hotel, conference, and other guest Wi-Fi networks (the "captive portal"), then redirect users to fake software-update prompts. The download installs malware that harvests browser cookies, passwords, and Microsoft 365 session tokens, and can capture keystrokes, screenshots, and audio. Active since at least May 2026, targeting travelers worldwide.
What it means for you: If your people travel — escrow officers at closings, partners at conferences, anyone working from a hotel — treat guest Wi-Fi as hostile by default. Use a phone hotspot or your company VPN. A Wi-Fi login page that offers you a software update is an attack, every time.
Reminder: Microsoft's clock is running on text-message sign-in codes
Microsoft's updated guidance re-confirms both dates on the tracker above: passkey prompts begin September 1, and texted sign-in codes end February 1, 2027.
What it means for you: The office that migrates in September does it calmly; the office that waits for February does it during a lockout. Read our guide →
Actively exploited right now — CISA's Known Exploited Vulnerabilities
Flaws confirmed to be under real-world attack — not theoretical. When your software appears here, patching stops being routine maintenance and becomes urgent. Newest 15 entries; full catalog at CISA.
Source: CISA Known Exploited Vulnerabilities catalog (U.S. government, public domain). Feed refreshed Sep 26, 2026.
Added
Software
What it is
Used in ransomware?
Sep 25, 2026
Microsoft SharePoint CVE-2026-65660 Common in small-business networks
Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.
None reported
Sep 22, 2026
Check Point Multiple Products CVE-2026-93616 Firewalls and remote access — check with whoever manages yours
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
None reported
Sep 22, 2026
Check Point Multiple Products CVE-2026-85102 Firewalls and remote access — check with whoever manages yours
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
None reported
Sep 21, 2026
Zyxel GS1900 Series Switches CVE-2026-7273 Firewalls and remote access — check with whoever manages yours
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
None reported
Sep 16, 2026
Cisco Identity Services Engine CVE-2026-76460 Firewalls and remote access — check with whoever manages yours
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
None reported
Also added in this period, in systems far less common in small-business environments —
MikroTik RouterOS, WordPress Core, WSO2 Multiple Products, Adobe Commerce and Magento, Arista VeloCloud Orchestrator, F5 BIG-IP APM, Linux Kernel, Linux Kernel, Linux Kernel, Google Pixel.
Listed for completeness; if you don't run them, there is nothing here for you to do.
“None reported” means CISA has no record of this flaw being used in a ransomware campaign — it is not an all-clear, and it can change as investigations catch up.
Government data, republished as intended. The vulnerability and advisory lists come from CISA and NIST — U.S. government publications in the public domain (17 U.S.C. §105), published expressly for reuse. We reproduce them faithfully and link the originals.
News, in our own words. Curated stories are summaries we write ourselves from the underlying facts, always crediting and linking the original reporting. We never republish another outlet's text — their reporting deserves the click.
Facts are stated as of the date shown. Vulnerability and deadline entries reflect the linked source at the time we recorded it. Vendors' own advisories are the authoritative record, and a date that moves is the vendor's to move — if you are acting on something here, click through and confirm the current position first.
Headlines are links, nothing more. The industry-headlines list carries each outlet's title, date, and a link to their site — no excerpts, no copies. If a headline interests you, the click belongs to the people who reported it.
What this isn't. A briefing, not incident response. If something on this page is happening to you right now, don't read — call (949) 916-6444.
Want someone watching this for you?
Secure IT clients don't read threat feeds — our 24/7 security operations coverage does it for them. See where your business stands, with the owner.
We use cookies to understand how visitors use our site (Google Analytics & Microsoft Clarity) — analytics only, never sold. No analytics load unless you accept. Privacy policy
AI answers can be imperfect — confirm anything important with us. Messages are processed by our AI provider to generate replies; questions are kept (without your identity) to improve answers. Please don’t include passwords or sensitive data.
