Essential Solutions, LLC

10/27/2026

Check the sender's email address. Hover over the link before you click. Make sure two-factor authentication (2FA) is turned on.

Earlier today, an email landed in our inbox that passed every single one of those checks, and it was still a trap. It came from a known contact's hijacked mailbox, used a genuine Intuit/QuickBooks tracking link inside a PDF to slip past spam filters, and redirected to a proxy Microsoft 365 login page built to steal live session cookies right past standard 2FA.

Instead of clicking or replying, we traced it in an isolated sandbox and called the contact on the phone to warn them. Here's a look at how the attack worked and what actually protects a business when every visual check looks clean:

For years, small-business security training has boiled down to the same handful of habits. Check the sender's email address. Hover over the link before…

10/27/2026

A small-business owner's loan application. A CEO's internal revenue review. A full-year staff vacation calendar.

All of them were found in plain sight last week by security researchers, not because a server was hacked, but because people clicked the built-in "Share" button in Meta's new Muse AI assistant to send a draft to someone they trusted. Because of how those share links were structured, 6,800 shared conversations showed up in searchable DNS databases from a single query.

When your team uses AI to draft real business documents, the biggest blind spot usually isn't the prompt. It's what happens when they hit "Share." Here's a look at what happened and how to put real boundaries around AI in your business:

On October 20, Dan Goodin at Ars Technica reported on findings from security firm Claroc about Muse, Meta's new general-purpose AI agent. Only a few weeks…

10/19/2026

Here's one worth a few minutes of your week. Researchers found phishing emails with hidden instructions written for your AI assistant, not for you. You ignore the sketchy email, then ask your assistant to summarize your inbox, and it tells you the urgent to-do is to "update this vendor's payment details."

You can't spot text you can't see, so this one isn't about being more careful. It's about deciding what your AI tools are allowed to do and keeping a person in the loop when money is involved. That's exactly the kind of thing we help businesses sort out.

The full story and what to think about:

On October 12, Pieter Arntz at Malwarebytes wrote up research from Barracuda about a new kind of phishing email. A week later, the headlines have moved…

10/13/2026

Copilot is about to start doing things on your PC, not just chatting. Microsoft announced on Oct 7 that, with your permission, it'll be able to organize files, troubleshoot and run workflows for you. That's great for busy teams, as long as someone has decided what it's allowed to touch. Here's what small businesses should know:

On October 7, Microsoft said Copilot on Windows will soon do more than answer questions. On Copilot+ PCs, Copilot will be able to understand content on…

10/07/2026

Most AI talks still start with “should we let the team use AI?” That ship has sailed.

The real issue is visibility — and Verizon’s 2026 data puts hard numbers on shadow AI, personal accounts, and what gets pasted into free tools.

See what an actual advisory process looks like (and why a blanket ban usually fails):

Most AI conversations with business owners still start from the wrong premise: "should we let our team use AI?" By every recent measure, that ship has…

09/28/2026

Over the weekend, CISA flagged two critical Citrix NetScaler flaws that are already being exploited in the wild — CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5).

These hit NetScaler ADC and Gateway appliances — the edge/VPN gear a lot of businesses use as the front door to apps and remote access. Federal agencies have until September 30 to remediate. Private-sector teams should treat that as a same-week job, not a “next maintenance window” item.

If you (or your IT partner) run NetScaler, ask today:
• What build are we on?
• Are we on the fixed releases Citrix published?
• Did anyone look for signs of compromise before patching?

Plain-English write-up + checklist:
https://esllc.com/Blog/cisa-just-flagged-two-critical-citrix-netscaler-flaws-patch-edge-appliances-this-week

Essential Solutions · Baton Rouge / South Louisiana · (225) 336-0273

09/21/2026

AI helpers are showing up in email, Microsoft 365, CRMs, and websites. Each one needs access to do its job — which means each one is an identity in your environment.

You do not need every new Microsoft SKU tomorrow. You do need a list of what exists, who owns it, what it may touch, and how to shut it off.

Plain-English checklist here:
https://esllc.com/Blog/your-ai-agents-are-identities-treat-them-like-users-with-badges

Essential Solutions · South Louisiana · clients nationwide

Most businesses are experimenting with AI the way they once adopted cloud apps: one team, one use case, one “let’s try this” at a time. Chat assistants…

09/16/2026

Microsoft just dropped its biggest Patch Tuesday of the year — and the same week, CISA flagged actively exploited flaws that go beyond Windows.

Two of them hit tools businesses actually run day to day: Adobe Commerce / Magento storefronts, and N-able N-central (the remote management platform many MSPs use).

If your IT partner manages you through an RMM, it’s fair to ask: are we on the emergency hotfix, and did anyone check for unexpected admin accounts after that weekend?

Full write-up (plain English, checklist included):
https://esllc.com/Blog/septembers-patch-tuesday-was-record-sized-and-the-same-week-hit-the-tools-that-run-your-business

Essential Solutions · South Louisiana · clients nationwide

Microsoft’s September 2026 Patch Tuesday was the largest of the year — roughly 964 CVEs in a single release, with more than a hundred rated critical. Two…

09/08/2026

Two major security flaws got attacked in August, and both stories end the same way: the fix existed, and a lot of businesses hadn't applied it yet — or still had the system sitting on the public internet.

One took attackers about a day after the details went public. The other hit 361 victim IP addresses in 47 countries in two weeks.

If you're not sure whether your business is exposed, that uncertainty is the actual problem — and it's a solvable one.

Two of the most severe vulnerabilities disclosed this year both got weaponized in the same stretch of August 2026 — and neither gave defenders much more…