Ping: The SMB Security Week of Oct 12, 2026

Welcome to Ping, a weekly signal for small and mid-sized businesses. Every week we read the security firehose so you don't have to, and boil it down to what a small shop should actually do: what to patch now, what scams are going around, what's aging out, and where AI is quietly changing the risk. One short read, every item sourced, no fear-mongering.

Here's the week.

AI Watch

The newest, least-familiar risk: attacks that target the AI tools your team has quietly started using.

• Your Team Is Pasting Work Into Personal ChatGPT. Here Is What That Actually Exposes. Even companies with a paid ChatGPT Enterprise workspace see staff use personal accounts for convenience, which routes drafts, client lists, and credentials outside the business tenant with no retention controls. The fix is a mix of DNS, SSO, and a clear acceptable-use rule people can follow. (source: BleepingComputer)
• A Stolen Session Cookie Walks Right Past MFA. Shorter Sessions and Device Binding Shut That Door. Modern phishing kits grab the authenticated session token, not the password, so prompting for a code never happens on the attacker's side. Shortening session lifetimes, binding sessions to a device, and enforcing re-auth for sensitive actions removes most of the value in a stolen cookie. (source: Spiceworks: Your MFA won't stop a session cookie)
• Attackers Used Claude Agents and an AI Pentest Suite to Breach South Korean Banks. A Chinese operator chained a commercial AI penetration tool with Claude's agent capabilities to run a live intrusion against financial targets. The practical takeaway for smaller shops is that reconnaissance and phishing are getting faster and more convincing, so MFA on anything internet-facing matters more each quarter. (source: BleepingComputer)

Patch This Week

Known fixes worth applying now.

• BeyondTrust Remote Support Has an Actively Exploited Zero-Day on CISA's Known Exploited List. CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar) has been used by a China-linked group since late August to take over on-prem support servers. Patches are out and CISA added the flaw to its catalog on October 16. (source: BleepingComputer)
• Microsoft Shipped 1,413 Security Fixes in October, Including a Windows Shell Zero-Day Already in Use. October's Patch Tuesday is the largest ever from Microsoft, with over 1,100 Windows fixes alone and an actively exploited Windows Shell bug in the pile. Patch windows that worked a year ago no longer fit this volume, and workstations and servers need separate schedules this month. (source: BleepingComputer)
• Ivanti Connect Secure: Three Chained Zero-Days Give Root Without Login, and Only Two Are Patched. An attacker is chaining three unpatched flaws in Ivanti's VPN appliance to run commands as root with no credentials. Ivanti has shipped fixes for two of the three; the third is still open, so appliance monitoring matters as much as the patch. (source: The Hacker News)
• AOMEI Backupper's Own Update Servers Were Swapped to Push a Backdoor for Minutes at a Time. Between May and July, attackers replaced the files AOMEI's updater fetched during five-to-ten-minute windows, so any copy of the backup tool that checked in during those moments pulled a signed backdoor. Vendor update channels are a trust boundary, and a quiet one. (source: The Hacker News)
• Palo Alto Shipped a PAN-OS Patch for an Actively Exploited RCE in the Firewall Management Interface. CVE-2026-0322 is a remote code execution flaw in the PAN-OS management interface that attackers are already using in the wild. Patch, and in the meantime restrict management access to a short list of trusted admin IPs. (source: The Hacker News: Palo Alto Patches PAN-OS RCE Amid Active Exploitation)
• GitLab Just Patched a Perfect-10 Code Execution Flaw in Its Regex Engine. GitLab released an emergency fix for a maximum-severity vulnerability in its CI/CD Regular Expression Compiler that lets remote attackers run arbitrary code on the server. Any team that hosts its own GitLab needs the update this week; past GitLab critical bugs have been probed within hours of disclosure. (source: BleepingComputer: GitLab max-severity RCE)
• Bricksforge, a Popular WordPress Builder Plugin, Has a 10.0 RCE Under Active Exploitation. The Bricksforge plugin carries a CVSS 10.0 bug that lets unauthenticated visitors upload and run PHP on the site. Patchstack has confirmed in-the-wild attacks; update the plugin or disable it today. (source: The Hacker News: Bricksforge exploited)
• A Docker Hub Flaw Let One Account Push Images as Another for Nearly Two Years. Docker patched a bug in its 'convert account to organization' flow that allowed an attacker holding a personal access token to publish, pull, or delete images under another user's name. If your developers pull images from Docker Hub, now is a good time to pin versions and verify signatures. (source: BleepingComputer)

Scams & Signals

What's actually landing in inboxes and on networks: the social-engineering and breach news to warn your team about.

• ConnectWise Shut Down Its Cloud Backup Service After Attackers Signed Into 173 Microsoft 365 Tenants With Its Credentials. A compromised application credential tied to ConnectWise Cloud Backup (formerly SkyKick) gave attackers direct access to customer Microsoft 365 environments. If your IT provider uses that product, ask what access was rotated and which tenants were reviewed. (source: BleepingComputer)
• The DOJ Just Seized 187 Computers in a North Korean IT Worker Scheme That Hit More Than 70 US Companies. US prosecutors charged 14 people and shut down over 40 laptop farms running fake remote workers for American employers. Payroll went to the operators, and in several cases the workers also stole code and extorted the companies that hired them. (source: The Hacker News)
• Run a Cloned-Voice Payment Drill Before the Real Call Reaches Your Controller. A quarterly tabletop that walks finance through a fake urgent payment call from the 'CEO' reveals exactly where callback rules, out-of-band confirmation, and approval limits break down. The exercise takes an hour and costs nothing. (source: The Hacker News: How to Run a Deepfake Readiness Drill)
• Hijacked Office Routers Are Being Resold as Residential Proxies. Check Your D-Link and Ubiquiti Gear. A proxyjacking campaign across 34 countries is turning compromised routers into paid exit nodes for a commercial proxy service, which means your public IP ends up tied to someone else's fraud. Firmware updates, strong admin passwords, and disabled WAN-side management close the common entry points. (source: BleepingComputer: Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth)
• Attackers Warmed Hundreds of French Supermarket Fridges by Hijacking the Remote Maintenance Controller. The route in was the Danfoss controller that lets a maintenance firm manage every fridge in a store remotely. Any SMB with a vendor-managed HVAC, access control, or refrigeration system has the same exposure if that controller sits on the open internet. (source: The Hacker News: Attackers Heat French Supermarket Fridges)
• The One-Person IT Trap: Keeping the Office Running While Your Only Admin Takes PTO. Nearly half of tech staff report burnout, and a solo IT person going on vacation often means after-hours calls get missed, backups silently fail, and the shared mailbox goes unread. Co-managed coverage and a named escalation contact keep operations running while they are away. (source: Spiceworks)
• A Contractor's Malware Infection Exposed 8.7 Million Customer Records at a Major Entertainment Brand. The breach happened at a subcontractor, not the brand consumers recognize, and that is where the malware landed. Vendor contracts need breach notification timelines, limits on what data leaves your systems, and proof that endpoint protection runs on anything the vendor touches. (source: BleepingComputer)
• A Cyberattack on a Defense Contractor Took Down the US Federal Bankruptcy Notice System. BAE Systems was hit, and the fallout reached the court system that depends on it. Vendor concentration tends to stay invisible until one incident stops a service your business counts on. (source: BleepingComputer)
• A Billion Scam Messages Trace to Three Phishing Kits Microsoft Just Disrupted. Microsoft, Health-ISAC, Cloudflare, and partners took action against CoGUI, Haozi, and Iron Man System, phishing kits responsible for over a billion scam emails and SMS since January. The templates imitate parcel delivery, bank fraud alerts, and government notices your staff see every week. (source: The Hacker News: Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages)
• Counterfeit Ledger Hardware Wallets Sold Through a Reseller Drained Over $86 Million. Ledger confirmed that devices distributed by a Southeast Asian reseller contained a hidden hardware implant that quietly siphoned crypto from buyers. Security hardware should be bought direct from the manufacturer, with tamper-evident packaging checked on arrival. (source: BleepingComputer: Ledger spy chip implant)

End of the Road

Deadlines that reward planning ahead. A rushed migration is an expensive one.

Runway note: Windows Server 2022 leaves mainstream support on Oct 13, 2026, which means no new features or non-security fixes. Security updates continue under extended support until Oct 14, 2031, so this one is a planning milestone, not a cut-off.

See the runway above for what's coming; nothing new was flagged this week.

Trends & Signals

Because Ping runs every week, we can show the trajectory, not just this week's list. (These track the SMB-relevant items we flag each week: our editorial signal, not a full vulnerability census.)

How we help

Most of what's above is routine when someone owns it: patch on a schedule, watch the gear that gets forgotten, plan the upgrades before the deadline, warn the team about the live scams, and keep an eye on the newer AI risks. That's the boring, durable work we do for the businesses we manage, with a 24/7 team so the 3 a.m. items are handled before you wake up. If your patching and planning currently live in someone's head, let's talk about making it a system.

See you next Ping.