IT BRIEFING FOR BUSINESSES

Today’s reports show why business patching needs to cover more than Windows Update. Microsoft’s Paint fix is available only through the Microsoft Store, while an actively exploited WordPress flaw can remain attackable during installation of its fix. CISA also added a SonicWall SSLVPN authentication vulnerability to its exploited-vulnerability catalog, and attackers targeted a narrowly defined OpenSSH configuration shortly after disclosure. For small and mid-sized businesses, the priority is to identify affected devices, remote-access systems, and websites, then verify that fixes actually reach them. Have your IT provider check Store-managed applications separately, review VPN authentication, confirm whether any Linux servers match the reported OpenSSH conditions, and plan website maintenance with exposure during updating in mind. Verify recoverable backups before making server or website changes.

AI tools also deserve a place in everyday security reviews. One report found credentials in public copies of Claude Code settings files; another demonstrated how a malicious browser extension could use Claude Dispatch to trigger code execution on a computer. Review which AI tools and browser extensions staff use, restrict unnecessary extensions, and check development repositories for saved passwords or API keys. Revoke and replace any exposed credentials rather than simply deleting the files containing them. Include email and Microsoft 365 credentials in that review if staff have used them in development commands, and remind employees not to place secrets in prompts or command approvals. New AI security-research capabilities add another reason to maintain a clear inventory and a repeatable process for assessing and resolving vulnerabilities.