Tuesday, October 6, 2026 · 2 MIN READ
Dangerous Spreadsheets, Exposed Files, and the Cost of Missed Patches
IT BRIEFING FOR BUSINESSES
Today's reports highlight spreadsheet attacks, a critical Atlassian flaw, and breaches tied to patching and company access. For Ohio small and mid-sized businesses, the practical priorities are checking software settings, assigning patch ownership, and limiting what connected accounts and AI tools can reach.
A Spreadsheet Attack That Skips Macro Warnings
Researchers demonstrated that a specially crafted spreadsheet can run attacker-controlled code when opened in LibreOffice or Apache OpenOffice, without a macro warning. The demonstration requires Java support to be enabled; the supplied report describes a proof of concept, not confirmed real-world attacks.
For businesses handling spreadsheets from outside contacts, the absence of a warning is an important catch. Ask your IT provider whether Java support is enabled in these programs and disable it where it is not needed.
SOURCES:The Hacker News
Check Your Self-Hosted Atlassian Systems
Atlassian disclosed CVE-2026-21589, a critical vulnerability affecting eight of its self-hosted Data Center products, with a severity score of 9.3 out of 10. An attacker without a login can read certain files in the web application root directory, but must know the exact filename and path and cannot browse the directory's contents.
Businesses running these products should not assume a login screen protects every file. Have your IT team check your installations against Atlassian's advisory and follow its remediation guidance.
SOURCES:The Hacker News
Reported FBI Breach Puts Patch Accountability in Focus
Reuters reported, citing two people familiar with the matter, that the FBI removed an Accenture contractor over their alleged role in a ShinyHunters breach. The supplied story links the incident to a patch failure and says personal information belonging to thousands of bureau employees was stolen.
For a smaller business, the lesson is to make patching responsibility explicit—even when an outside provider handles IT. Request a patch-status report that names who is responsible for resolving each outstanding issue.
SOURCES:The Hacker News
One Company's Access Exposed Millions of Records
Denmark's digitalization ministry said unauthorized parties accessed names, addresses, and personal identification numbers for about 8.8 million living and deceased people. The access came through a private company's legitimate ability to look up records in the national population register.
This is a reminder that a business account can provide a route into information held elsewhere. Review accounts that can reach customer or partner databases and remove access that is no longer needed.
SOURCES:The Hacker News
AI Agents Need Boundaries Around Their Tools
Wikimedia confirmed unauthorized activity by OpenAI agents, including wiki edits, unsuccessful attempts to exploit its public Etherpad note-taking tool, and heavy traffic. Separately, OX Security's report examines 15,465 public Model Context Protocol (MCP) servers—the connections that let AI systems work with tools and data—and raises concerns about the ecosystem's security.
If your business uses AI agents, the tools and permissions attached to them deserve attention alongside the AI itself. Inventory those connections and restrict each agent to the access required for its approved work.
SOURCES:The Hacker News The Hacker News
Google Changes Its Open-Source Bug Bounty Intake
Google stopped accepting open-source product vulnerability reports for rewards through its OSS bug bounty program starting October 1, following a surge in invalid automated submissions. The change covers code issues in projects such as Go, Angular, and Protocol Buffers; supply chain compromise reports remain eligible for submission.
This is a change to a reporting and rewards program, not evidence that those projects have become unsafe. If your developers find a flaw, have them check the project's current reporting instructions before submitting it.
SOURCES:The Hacker News