https://www.facebook.com/127357577138525/

InsightHeart Security, 2 Bloor Street E, Suite 3500, Toronto, ON (2026)

10/11/2026

ISHSTB – Weekly Tech Brief | Week of Oct 11 – 18, 2026

Main Topic: AI-Driven Threats, Vulnerability Management & Microsoft 365 Resilience

Welcome to Insight Heart Security – Weekly Tech Brief.

This week’s developments reinforce a critical message: attackers are becoming more efficient, and organizations must strengthen identity security, patch management, and detection capabilities.

1. AI Is Raising the Cybersecurity Stakes

Key Developments: Microsoft’s October 7 research highlighted lessons from using advanced AI to discover software vulnerabilities. Meanwhile, recent reporting describes AI-assisted attacks against organizations in South Korea and Japan.

What You Can Do: Prioritize vulnerability remediation, monitor unusual account activity, and review security controls around applications and AI tools. AI can improve defence—but it also increases the importance of disciplined security fundamentals.

2. Exchange Server: Don’t Delay Security Updates

Key Developments: A reported high-severity Microsoft Exchange Server vulnerability, CVE-2026-96940, could allow authenticated attackers to access other users’ mailboxes. Microsoft indicates Exchange Online is protected by a server-side fix; affected on-premises deployments need attention.

What You Can Do: Verify your Exchange Server version and patch status, review access permissions, and investigate suspicious mailbox activity. Don’t assume cloud and on-premises environments have identical patching requirements.

3. Microsoft 365: Strengthen Identity and Collaboration Security

Key Developments: Microsoft continues expanding security capabilities across its ecosystem. October updates include broader user reporting for suspicious Teams meetings and participants in eligible Defender for Office 365 environments.

What You Can Do: Enforce phishing-resistant MFA where possible, review Conditional Access policies, limit administrator privileges, and make it easy for staff to report suspicious emails, Teams meetings, and unexpected authentication requests.

MSSP Action: Ask your managed security provider to validate patch compliance, monitor Entra ID sign-ins and Microsoft 365 audit logs, tune Defender alerts, and test incident-response procedures. Request a prioritized remediation report—not just a list of alerts.

Bottom Line: Security resilience comes from combining timely patching, strong identity controls, employee awareness, and continuous monitoring. AI changes the threat landscape, but the fundamentals still matter.

Security

Sources to explore
- Microsoft: Lessons from frontier AI vulnerability research
- Exchange Server vulnerability and patching guidance
- Microsoft Defender for Office 365: What's new

10/04/2026

ISHSTB – Weekly Tech Brief | Week of Oct 4–11, 2026

Main Topic: Cloud Resilience, SharePoint Exploitation & Identity Security

This week reinforces a critical lesson: cloud services are not a substitute for resilient security and independent backups. From nonprofit Microsoft 365 data loss to ransomware exploiting SharePoint, organizations must protect both access and recovery.

1. Microsoft 365: Nonprofit Data Loss Raises Backup Concerns

Key Developments: Reports published October 1 describe Microsoft 365 data belonging to some nonprofits being accidentally deleted during the retirement of Business Premium Grant licenses. The affected data was reportedly unrecoverable. This highlights the importance of managing license transitions carefully and maintaining independent backups. [Source: TechRadar](https://www.techradar.com/pro/microsoft-deletes-nonprofit-customers-m365-data-and-says-it-cant-get-it-back)

MSSP Action:

• Audit nonprofit clients' licensing and migration status.
• Verify independent backups of Exchange, OneDrive, and SharePoint, including restoration testing.
• Document retention requirements, recovery objectives, and license-change procedures.

2. SharePoint Exploitation Fuels Ransomware

Key Developments: Reporting on October 2 linked Warlock ransomware attacks against a water utility, telecom provider, regional government, and university to exploitation of SharePoint vulnerabilities. Attackers also used techniques to disable endpoint protection before deploying ransomware. [Source: BleepingComputer](https://www.bleepingcomputer.com/news/security/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks/)

MSSP Action:

• Prioritize supported SharePoint Server security updates and mitigations.
• Review internet-facing services and investigate suspicious access or web-shell activity.
• Validate endpoint detection coverage and immutable or offline backup recovery.

3. Internet-Facing Infrastructure Under Pressure

Key Developments: A threat-intelligence roundup published October 4 highlighted active exploitation affecting Citrix NetScaler ADC/Gateway and FortiMail, alongside vulnerabilities affecting other enterprise platforms. Edge devices remain a critical entry point for attackers. [Source: RedSheep Security](https://www.redsheepsec.com/trends/weekly-report-2026-w40)

MSSP Action:

• Inventory exposed appliances and prioritize vendor-recommended fixes for actively exploited vulnerabilities.
• Review logs for suspicious administrative access and unexpected configuration changes.
• Escalate suspected compromise for investigation rather than relying on patching alone.

Bottom Line

Microsoft 365 security requires more than MFA and strong passwords. Combine identity protection, least-privilege access, email security, endpoint monitoring, tested backups, and documented recovery plans. For MSPs and security teams, resilience means proving that critical data can be restored—not simply assuming it can.

09/27/2026

ISHSTB – Weekly Tech Brief | Week of Sep 27 – Oct 4, 2026

Main Topic: AI-Driven Cybercrime Moves From Experiment to Operational Threat

The cybersecurity story this week is increasingly clear: attackers are not just using AI to write phishing emails or automate tasks. AI is becoming part of the attack infrastructure itself—while identity remains one of the easiest paths into cloud environments.

1. AI-powered cybercrime at scale

Microsoft disrupted the infrastructure behind “EvilTokens,” a cybercrime service that used device-code phishing to compromise Microsoft accounts. Microsoft estimates the operation affected more than 12,000 email inboxes across 10,000 organizations. The service reportedly lowered the technical barrier for attackers by packaging account-compromise capabilities as a subscription service.

MSSP Action: Review Entra ID sign-in activity, monitor suspicious device-code authentication, strengthen Conditional Access policies, and make sure compromised-session response procedures are tested.

2. AI is becoming part of malware

Researchers reported new malware incorporating LLMs into its decision-making and command-and-control processes. One example, dubbed CLOSEDQUORUM, reportedly uses multiple AI models to determine actions without requiring continuous human direction.

This points toward a future where some attacks can adapt faster than traditional human-driven workflows.

3. Microsoft 365 security is entering the AI-agent era

Microsoft’s September security updates emphasize discovering and controlling AI agents across employee devices, cloud platforms and development workflows. Microsoft is also expanding controls that apply Zero Trust and data-security policies to agent traffic and “shadow AI.”

MSSP Action: Start treating AI agents like identities and applications—not simply productivity tools. Inventory them, define what data they can access, apply least privilege, and monitor their activity.

Bottom Line

For SMBs and nonprofits, the takeaway isn't “ban AI.” It is to understand which identities, applications, agents and data are connected—and what happens if one is compromised.

Identity security + Conditional Access + endpoint visibility + data governance + continuous monitoring should remain the foundation.

09/20/2026

ISHSTB – Weekly Tech Brief | Sep 20–27, 2026

Main Topic: Identity Is Becoming the New Attack Surface

This week’s security news reinforces a trend we’ve been watching closely: attackers don’t always need malware or an unpatched server when they can convince a legitimate user to hand over access.

1. Microsoft 365: Passkey Phishing Gets More Sophisticated

Microsoft has detailed campaigns where attackers impersonate IT/help-desk staff, contact employees by phone or SMS, and direct them to fake Microsoft sign-in pages. Adversary-in-the-middle techniques can capture authentication sessions, allowing attackers to access SharePoint, OneDrive and Exchange data.

MSSP Action: Review Conditional Access, phishing-resistant MFA, risky sign-ins and unusual token/session activity. Train users that a “help desk” request to change MFA or passkeys should be independently verified.

2. Zero-Days Still Demand Fast Response

Microsoft’s September Patch Tuesday addressed a record number of vulnerabilities, including actively exploited Windows flaws. Researchers also reported continued exploitation of browser/Windows vulnerabilities in targeted campaigns.

MSSP Action: Don’t treat patching as a monthly checkbox. Prioritize exploited vulnerabilities, internet-facing systems and high-value identities first.

3. AI Is Accelerating the Threat Cycle

Anthropic reported disrupting malicious operations where threat actors attempted to use Claude to support cyber activity, while researchers continue seeing AI-assisted phishing and malware development.

The takeaway isn't simply “AI is dangerous.” It’s that attackers can increasingly automate research, personalization and parts of their workflow.

4. Supply Chain & Developer Targeting

North Korean-linked WaterPlum activity reportedly compromised at least 30,000 devices across more than 100 countries, with attacks involving malicious developer packages and fake job/interview workflows.

MSSP Action: Treat developers, contractors and remote workers as part of the security perimeter. Restrict ex*****on of untrusted code and apply least privilege to development environments.

Bottom Line

For SMBs and nonprofits, the practical lesson is straightforward: protect identities, not just endpoints.

MFA remains important—but phishing-resistant authentication, Conditional Access, least privilege, monitoring and user verification need to work together.

09/13/2026

ISHSTB – Weekly Tech Brief | Sep 13–20, 2026

Main Topic: Microsoft’s Massive Patch Tuesday + The Next Phase of Identity Attacks

This week brought a major reminder that cybersecurity is increasingly about identity, cloud sessions, and rapid patching—not just passwords and endpoints.

1. Microsoft’s Record-Breaking Patch Tuesday

Microsoft’s September security release addressed roughly 970 vulnerabilities, including two actively exploited zero-days. The scale alone is significant, but the bigger takeaway is prioritization: vulnerabilities being exploited in the wild should move immediately to the top of the remediation queue.

MSSP Action: Don’t treat Patch Tuesday as a monthly checklist. Prioritize actively exploited CVEs, validate deployment, and confirm that critical endpoints and servers actually received the updates.

2. Passkeys Are Being Targeted—But Differently

Microsoft researchers reported active campaigns using passkey-themed social engineering to trick users into actions that ultimately enable identity and cloud compromise. The lesson: even stronger authentication technology doesn't eliminate the human attack surface.

MSSP Action: Pair phishing-resistant authentication with Conditional Access, device compliance, risk-based detection, and user education. Authentication strength and identity monitoring need to work together.

3. Microsoft 365 Sessions Are Becoming the Prize

Recent campaigns are targeting authenticated Microsoft 365 sessions through adversary-in-the-middle phishing infrastructure. Stolen session information can allow attackers to operate after a user has successfully completed MFA.

MSSP Action: Monitor unusual sign-ins, impossible travel, unfamiliar devices, risky OAuth activity and abnormal mailbox/cloud behavior. MFA remains essential, but organizations should also assume that a session can become compromised.

4. AI Is Accelerating Both Sides

New threat-intelligence reporting continues to show threat actors experimenting with AI for reconnaissance, social engineering, malware development and operational scaling.

For SMBs and nonprofits, the answer isn't simply “ban AI.” Establish practical AI governance, protect sensitive data, control access to AI tools, and make sure security monitoring can identify unusual activity.

Bottom Line

The modern attack chain is increasingly identity → session → cloud → data.
For Microsoft 365 environments, the priority should be clear: patch aggressively, strengthen phishing-resistant authentication, monitor identities and sessions, and assume that attackers will continue looking for ways around the controls users already trust.

09/06/2026

ISHSTB – Weekly Tech Brief | Sep 6– Sep 13, 2026

Powered by Insight Heart Security

This Week’s Focus: Microsoft 365 Identity + The Next Evolution of Phishing

Cybersecurity continues to shift from “protect the endpoint” toward protecting identity, sessions, and trusted workflows.

Here are four developments worth watching this week:

1. Passkeys officially move to the forefront

Starting September 1, passkeys became the default authentication experience for Microsoft Entra ID. Microsoft is also moving toward eliminating its own SMS and voice authentication options by February 2027. Passkeys provide phishing-resistant authentication by using cryptographic credentials rather than reusable passwords.

MSSP takeaway: If your nonprofit or SMB still relies heavily on passwords and SMS-based MFA, now is a good time to begin planning the transition toward phishing-resistant authentication.

2. Phishing is getting harder for email filters to recognize

Microsoft reported an active campaign using invisible Unicode characters—sometimes called ASCII smuggling—to disguise malicious content from security controls. The technique demonstrates how attackers are adapting techniques originally associated with AI prompt manipulation for traditional phishing.

3. Teams can become an attack path

Microsoft Threat Intelligence documented attacks abusing external Microsoft Teams collaboration to impersonate IT support, establish trust with victims, gain remote access and deploy malware.

For organizations using Microsoft 365, Teams security deserves the same attention as email security.

4. Fake software downloads remain dangerous

Microsoft researchers also reported campaigns using counterfeit download sites impersonating legitimate software vendors. Trojanized installers can establish persistence and weaken security protections after installation.

Bottom Line

Microsoft 365 security in 2026 isn't simply about turning on MFA.

Organizations should be thinking about:

• Phishing-resistant authentication

• Conditional Access

• Teams external collaboration controls

• Email and identity monitoring

• Endpoint protection

• Software download controls

• User awareness around “IT support” requests

• AI-assisted and AI-targeted phishing techniques

For resource-constrained nonprofits and SMBs, identity is increasingly the security perimeter.

08/30/2026

ISHSTB – Weekly Tech Brief | Aug 30 – Sep 6, 2026

This Week’s Focus: AI Is Compressing the Attack Timeline

Cybersecurity is increasingly becoming a race against time. This week’s developments show attackers gaining speed through AI, while defenders face a growing backlog of vulnerabilities, identity risks, and third-party exposure.

Top Headlines

• AI-powered attacks are moving from theory to reality. New reporting highlights AI agents being used to automate reconnaissance, vulnerability discovery and portions of attack chains. Security teams should assume AI will increasingly reduce the time between initial access and impact.

• Critical ServiceNow vulnerabilities patched. Four flaws affecting ServiceNow’s Now Platform and AI Platform included three rated CVSS 10.0, with potential for unauthenticated code ex*****on and data access. SaaS platforms remain part of the attack surface—not outside it.

• Citrix NetScaler exploitation observed. CVE-2026-8452 has reportedly been exploited in the wild, reinforcing the importance of prioritizing internet-facing appliances when active exploitation emerges.

• PaperCut under active exploitation. Huntress reported reproducing a pre-authentication RCE chain affecting PaperCut NG/MF. Organizations using self-hosted infrastructure should verify exposure and patch status.

• IoT remains an easy foothold. Researchers reported more than 14,500 Dahua devices compromised through credential attacks, authentication bypasses and related techniques. Internet-exposed devices continue to be attractive targets.

What This Means for SMBs & Nonprofits

The lesson isn't “buy more security tools.” It is reduce attacker time and opportunity.

MSSPs and IT teams should prioritize:

1. Patch actively exploited and internet-facing vulnerabilities first.

2. Review Entra ID/Microsoft 365 identities, privileged accounts and legacy authentication.

3. Require phishing-resistant MFA wherever practical.

4. Monitor SaaS, remote-access and edge appliances as part of the attack

surface.

5. Establish clear governance for AI tools, agents and sensitive organizational data.

6. Validate offline/immutable backups and recovery procedures—not just backup completion.

Bottom Line

AI is becoming a force multiplier for both attackers and defenders. Organizations that combine strong identity controls, rapid vulnerability prioritization, continuous monitoring and tested recovery will be better positioned for the next wave.

08/26/2026

Securely harness the power of Microsoft 365 while protecting your organization's data, identities, and collaboration environment. InsightHeart Security helps businesses maximize productivity without compromising security, compliance, or governance.

- Secure Collaboration
- Identity Protection
- Data Security & Compliance
- Microsoft 365 Security Optimization

Partner with InsightHeart Security to enable a safer, more productive workplace.

08/23/2026

ISHSTB – Weekly Tech Brief

Week of August 23–30, 2026
Powered by Insight Heart Security

This Week’s Focus: Cybersecurity Is Moving at AI Speed

The past week reinforced a familiar lesson: attackers are getting faster, while the fundamentals—identity, patching, monitoring and supply-chain security—remain the best defense.

Top Headlines

1. GitLab flaw moves rapidly into exploitation
CVE-2026-19478 is reportedly being actively exploited only days after disclosure. The flaw can allow unauthenticated attackers to modify or delete public projects, highlighting how quickly newly disclosed vulnerabilities can become operational threats.

2. Critical infrastructure faces AI-assisted threats
CISA warned of an active threat involving AI-generated exploit scripts targeting Siemens S7 PLC environments. For organizations supporting infrastructure, this is another signal that AI is reducing the barrier to sophisticated attack development.

3. Medusa ransomware reaches 500+ organizations
CISA reported that Medusa ransomware has compromised more than 500 critical-infrastructure organizations. The campaign demonstrates why ransomware preparedness cannot stop at backups—identity protection, segmentation, detection and incident response matter too.

4. Software supply chains remain a major weak point
Attackers compromised the Rust arrayref crate's maintainer account and introduced malware that executed during compilation. Separately, malicious releases affected other Rust packages with hundreds of millions of downloads.

5. More internet-facing systems are being actively targeted
Zimbra's critical RCE vulnerability and new NetScaler flaws prompted urgent warnings, while Elementor Pro's critical vulnerability could enable remote code ex*****on against vulnerable WordPress sites.

What This Means for Nonprofits & SMBs

For smaller organizations, the takeaway isn't “buy more security tools.” It's to make the basics harder to bypass:

Enforce phishing-resistant MFA wherever possible.
Prioritize internet-facing vulnerabilities and CISA KEV-listed flaws.
Review privileged accounts and third-party access.
Keep WordPress, VPN/remote-access platforms and Microsoft environments patched.
Monitor developer dependencies and software supply chains.
Maintain tested offline/isolated backups.
Establish an incident-response process before an incident occurs.

The 2026 security reality: AI may accelerate the attacker—but strong identity controls, rapid patching, least privilege and continuous monitoring still determine whether that speed becomes a breach.

08/20/2026

3 Ways Microsoft 365 Business with Copilot Delivers Real Value

For nonprofits and small businesses, Copilot helps you:

- Save time on everyday tasks
- Create content faster in Word, Outlook & Teams
- Turn data into actionable insights

Work smarter, stay productive, and focus on growing your impact.

InsightHeart Security

10/11/2026

10/04/2026

09/27/2026

09/20/2026

09/13/2026

09/06/2026

08/30/2026

08/26/2026

08/23/2026

08/20/2026

Address

Telephone

Website

Alerts

Contact The Business

Shortcuts

Share

Category

Listing takedown request