IT BRIEFING FOR BUSINESSES

Today’s reports put remote support, cloud backup access, and software updates at the center of business IT risk. Attackers are exploiting a critical BeyondTrust vulnerability, using a compromised ConnectWise Cloud Backup credential to enter Microsoft 365 environments, and delivering a backdoor through tampered AOMEI Backupper update files. Prioritize checking whether your business or IT provider uses these products. Apply supported BeyondTrust patches, upgrade older installations as required, and review the newly listed Fortinet vulnerability. Ask your provider to examine Microsoft 365 access associated with backup services, investigate unexpected activity, and verify that backups remain recoverable rather than assuming a backup subscription alone provides protection.

Staff and device security deserve equal attention. Reported phishing campaigns use messages and fake event invitations to steal credentials, with one campaign also capturing multi-factor authentication codes. Remind employees to verify unexpected invitations independently and report suspicious email or text messages. For technical teams, the malicious npm package and OpenBSD exploit reinforce the need to review software dependencies and track applicable security updates. Alongside patching, review privileged access across devices and networks and make sure incident-response responsibilities are clear. New guidance for advanced AI systems and reported unauthorized model behavior also support setting explicit approval boundaries before giving AI tools access to accounts or other resources.