Ping: The SMB Security Week of Nov 2, 2026

Welcome to Ping, a weekly signal for small and mid-sized businesses. Every week we read the security firehose so you don't have to, and boil it down to what a small shop should actually do: what to patch now, what scams are going around, what's aging out, and where AI is quietly changing the risk. One short read, every item sourced, no fear-mongering.

Here's the week.

AI Watch

The newest, least-familiar risk: attacks that target the AI tools your team has quietly started using.

• Fake OpenAI and SpaceX Event Invites Are Harvesting Microsoft 365 and Google Logins. Two phishing-as-a-service kits are sending polished invitations to fake Anthropic, OpenAI, and SpaceX launch events. The landing pages steal credentials and the session token, which means MFA does not stop the takeover. (source: BleepingComputer)
• Calendar Invites Are the New Phishing Vector, and the Lures Walk Past MFA. Operation CloudFire used Google Calendar invitations, trusted Google redirect links, and lookalike login pages to hijack corporate Google sessions and sail past multi-factor prompts. Blocking unknown-sender invites and forcing reauthentication on sensitive apps shuts most of it down. (source: BleepingComputer: Google Calendar phishing campaign)
• A Stolen OpenAI or Anthropic Key Can Run Up Six-Figure Cloud Bills in a Day. Google is tracking a pattern it calls LLMjacking, where attackers lift an AI API key from source code, a phished developer, or a misconfigured bucket, then rack up more than $100,000 per day in model charges on the victim's account. The key is a billing instrument and deserves the same controls as a corporate card. (source: BleepingComputer)
• A New Infostealer Uses AI to Rank Victims by How Much Money They Can Pay. VOLTA ships stolen browser cookies, Outlook data, and Slack sessions to a language model that scores each victim for monetization potential. Finance-heavy inboxes get worked first, which raises the stakes for anyone with wire approval or AP in their role. (source: New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value (The Hacker News))
• Those Browser Pop-Ups Asking to Send Notifications Are the New Scam Delivery Pipe. Microsoft Edge's Scareware blocker caught scam sites abusing the browser's 'Allow notifications' prompt to pipe fake virus alerts and tech-support numbers directly to the Windows taskbar, long after the user left the page. Setting browsers to block notification requests by default stops the whole chain. (source: Microsoft Edge Blog)

Patch This Week

Known fixes worth applying now.

• SonicWall Firewalls Have an Actively Exploited SSL-VPN MFA Bypass. Patch Now. SonicWall shipped SonicOS fixes for seven flaws including an SSL-VPN authentication bypass already being used in attacks. If your office remote access terminates on a SonicWall firewall, this update outranks everything else on the queue. (source: BleepingComputer)
• Microsoft Paint Has a Network RCE Fix, but Windows Update Will Not Push It. The patched Paint build (11.2609.401.0) is in the Microsoft Store, not in Windows Update. Any PC still running an older Paint can be hit over the network, so IT has to verify the Store version on every machine. (source: The Hacker News)
• QNAP NAS Devices Are Being Breached Through Plex Media Server. Update Plex in the App Center. Attackers are chaining a Plex flaw to break into QNAP NAS boxes that have Plex installed from the App Center. The fix is a Plex update, not a QNAP firmware update, so patch cycles can miss it. (source: BleepingComputer)
• The 1.3 Million Android TV Boxes Google Just Knocked Offline Shipped With a Factory Backdoor. Google says the maker of these cheap streaming boxes intentionally pre-installed malware that rented out the buyer's internet connection for ad fraud. Any no-name streaming device, karaoke machine, or IoT gadget plugged into an office network deserves the same scrutiny as unknown software. (source: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies (Krebs on Security))
• A TeamViewer Flaw Lets the Remote Machine Attack the Technician Controlling It. TeamViewer just patched a bug where the computer being controlled can crash the viewer's TeamViewer and, on some platforms, run code on the machine that connected in. Every workstation your staff use to run remote support sessions needs the update. (source: The Hacker News: TeamViewer flaw lets remote computers attack users)
• One Crafted Text Message Can Crash an Unpatched Android Phone. A public proof-of-concept for CVE-2026-58882, nicknamed SMS of Death, remotely knocks phones off cellular or crashes them with a single text. Confirm every company handset is on the current Android security patch level before someone sends your sales team a reboot loop. (source: BleepingComputer: Android SMS of Death exploit)
• D-Link Disclosed Multiple Zero-Days in DGS-3130 Switches With No Patch Yet, Only Mitigations. D-Link confirmed several unpatched vulnerabilities in DGS-3130 stackable switches and is pointing customers to configuration mitigations while a fix is developed. If these switches sit in your office network, restrict management access and segment them off the business LAN now. (source: BleepingComputer)
• Zyxel Patched a Switch Zero-Day After Attackers Grabbed Config Files From Nearly 1,000 Devices. A flaw in Zyxel GS1900 series network switches let attackers pull configuration files and credentials off almost 1,000 devices before the fix shipped. Offices with a GS1900 in the network closet should apply the update and assume any passwords stored on the switch are already known to someone else. (source: BleepingComputer: Zyxel fixes zero-day)

Scams & Signals

What's actually landing in inboxes and on networks: the social-engineering and breach news to warn your team about.

• Synology Rushed Out Updates After C3RB3R Ransomware Started Hitting NAS Devices. Attackers are actively encrypting files on internet-reachable Synology appliances running older firmware. If an office backup or shared drive lives on one of these boxes, a same-day firmware update and pulling the admin interface off the public internet are the two actions that matter. (source: Synology warns of C3RB3R ransomware attacks targeting NAS devices (BleepingComputer))
• The FBI and CISA Just Told Businesses to Harden Connected Refrigeration and Cold Chain Controls. Federal agencies issued joint guidance after attackers remotely warmed supermarket freezers across Europe and interfered with blood storage temperatures in France. Any business with internet-connected HVAC, walk-in coolers, or building management controls is in scope. (source: CISA: Hardening Industrial Refrigeration and Cold Chain Monitoring Systems)
• DreamHost Confirms a Two-Month Breach of Its File Manager. Rotate FTP and Webmail Credentials. Attackers had access to DreamHost's File Manager platform for roughly two months and walked away with customers' FTP/SFTP usernames and passwords plus webmail session data. Anyone on the host should rotate those credentials, kill active webmail sessions, and move site uploads to key-based SFTP. (source: BleepingComputer: DreamHost confirms data breach)
• mSecure Is Telling Customers to Change Every Password Stored in the App. Password manager mSecure emailed users on November 3 to change master passwords, reset 2FA, and remove passkeys after suspicious activity on its systems. Anyone on your team using it should act today, starting with any vault that holds reusable business credentials. (source: The Hacker News)
• Holiday Gift Card Giveaways on Social Are Collecting Employee Data and Enrolling People in Paid Subscriptions. CTM360 mapped the current wave of fake Starbucks, Amazon, and celebrity gift card lures. The flow ends at a verification quiz and a credit card page, with no card ever arriving. (source: BleepingComputer)
• DigiCert Exposed Customer ID Documents After a Server Migration Left an Internal System Open to the Internet. A certificate authority admitted that moving a server between environments mistakenly published an internal business system, letting outsiders reach customer records and identity documents. The same mistake happens in small-business cloud migrations when firewall rules do not move with the workload. (source: BleepingComputer: DigiCert data breach exposes customer information)
• Windows 11 Is Now Noticeably Faster on 8 GB PCs, Which Changes the Math on Replacing Older Office Laptops. Microsoft shipped memory and responsiveness improvements aimed specifically at 8 GB Windows 11 machines, so laptops you had planned to retire for sluggishness may stay useful another budget cycle. The caveat: this only applies to supported Windows 11 builds, not devices still on Windows 10. (source: Windows Blog: Raising the bar for 8 GB Windows 11 PCs)
• Spend Two Minutes in Google Security Checkup to See Who Still Has Access to the Inbox. Google Security Checkup lists every device, connected app, and forwarding rule tied to a Gmail or Workspace account on one screen. It is the fastest way to catch a forgotten phone or an old third-party app still reading mail after an employee leaves. (source: Google: Security Checkup)

End of the Road

Deadlines that reward planning ahead. A rushed migration is an expensive one.

Runway note: Windows Server 2022 leaves mainstream support on Oct 13, 2026, which means no new features or non-security fixes. Security updates continue under extended support until Oct 14, 2031, so this one is a planning milestone, not a cut-off.

See the runway above for what's coming; nothing new was flagged this week.

Trends & Signals

Because Ping runs every week, we can show the trajectory, not just this week's list. (These track the SMB-relevant items we flag each week: our editorial signal, not a full vulnerability census.)

How we help

Most of what's above is routine when someone owns it: patch on a schedule, watch the gear that gets forgotten, plan the upgrades before the deadline, warn the team about the live scams, and keep an eye on the newer AI risks. That's the boring, durable work we do for the businesses we manage, with a 24/7 team so the 3 a.m. items are handled before you wake up. If your patching and planning currently live in someone's head, let's talk about making it a system.

See you next Ping.