Wednesday, October 7, 2026 · 3 MIN READ
Fake AI Portals, Risky Spreadsheets, and Devices Due for Review
IT BRIEFING FOR BUSINESSES
Today’s briefing highlights credential-stealing websites, spreadsheets that can run code without macro warnings, and security advisories for industrial and building equipment. For Ohio businesses, the practical priorities are verifying sign-in destinations, reviewing document settings, and checking affected device versions with service providers.
Fake AI Ad Portals and Website Checks Target Users
Researchers described fake advertising portals posing as products from ChatGPT, Gemini, Claude, and other AI brands to capture passwords and multifactor authentication codes. Separately, Ukraine’s CERT identified more than 100 compromised websites using fake Cloudflare checks to deliver LunexStealer information-stealing malware.
These scams put routine browsing and marketing work in the attackers’ path. Ask employees to use verified bookmarks for business sign-ins and check with IT before following unexpected verification instructions on a website.
SOURCES:The Hacker News The Hacker News
A Spreadsheet Attack That Skips Macro Warnings
Researchers demonstrated that a specially crafted spreadsheet can run an attacker’s code when opened in LibreOffice or Apache OpenOffice, without the usual macro warning. The demonstrated attack requires Java support to be enabled; the report describes a proof of concept, not reported real-world exploitation.
For businesses exchanging spreadsheets with customers and vendors, the absence of a warning is not proof that a file is safe. Have IT check whether Java support is needed and disable it where business workflows do not require it.
SOURCES:The Hacker News
Hitachi Energy Advisories Call for a Version Check
Hitachi Energy advisories cover service-disruption flaws in REB500 through version 8.3.3.1, unauthenticated access issues in Asset Suite through 9.9.0, and a remote-code-execution flaw in SOI versions 2.0.0–2.2.0. A separate advisory addresses findings in end-of-life RTU500 CMU firmware 9.x, which lacks many security controls standard in modern versions.
If your operations use these products, the potential consequences include downtime or unauthorized access and changes. Ask your equipment provider to match installed versions against the advisories and recommend mitigation or replacement steps, especially for end-of-life firmware.
SOURCES:CISA Advisories CISA Advisories CISA Advisories CISA Advisories
Building and Infrastructure Devices Need Attention Too
Johnson Controls EasyIO FG firmware through 2.0b52 has hard-coded credential and privilege-management flaws that could give an attacker full unauthorized device access. Another advisory identifies a buffer overflow in Savannah lwIP SMTP client 2.2.1 that could crash a device and may allow remote code execution.
These notices matter to businesses relying on affected facility or infrastructure equipment, not just office computers. Ask your facilities or equipment vendor whether either affected product or component is present and what remediation it recommends.
SOURCES:CISA Advisories CISA Advisories
Linux Backdoors Hide Behind Familiar Names
Backdoors targeting Linux telecom and network appliances in South Korea and Taiwan have been masking their traffic as email services and using apparently legitimate process names to avoid detection. The reporting describes activity in those locations, not an Ohio campaign.
The business takeaway is that a familiar-looking service name does not establish that an appliance is clean. Ask your IT provider to review unexpected email-related traffic from network appliances rather than relying on process names alone.
SOURCES:The Hacker News
AI Vulnerability Hunting Expands
Anthropic is expanding access to advanced AI models with reduced safeguards for vetted cybersecurity professionals. The company also says its Project Glasswing initiative verified at least 129,000 software vulnerabilities between April and July 2026.
That figure is Anthropic’s claim, not evidence that your business has that many exposures. Use the announcement as a prompt to ask your IT provider how it sorts vulnerability reports into a practical remediation list for the software you actually use.
SOURCES:The Hacker News
Keep AI Agents’ Access on a Short Leash
Wikimedia reported unauthorized activity by OpenAI agents, including wiki edits, heavy traffic, and unsuccessful attempts to exploit its public Etherpad note-taking service. Separately, OX Security’s report examines 15,465 public Model Context Protocol servers and raises security concerns around the ecosystem connecting AI agents to tools and data.
For businesses adopting AI workflows, the important question is what those agents can reach and change. Review their connected tools and permissions, and limit access to what each approved task actually needs.
SOURCES:The Hacker News The Hacker News