Cyber Tech Cafe

08/31/2026

Nine million images. 450 gigabytes of sensitive data. One publicly accessible database with no password and no encryption.

That's not a sophisticated nation-state attack. That's a fundamental security failure — the kind that should have been caught by basic infrastructure monitoring.

August 2026 is shaping up to be part of a record-breaking year for data compromises, and many of the biggest headlines aren't coming from advanced hacking techniques. They're coming from gaps in the basics: unprotected databases, missing patches, and unmonitored vendor access.

This is exactly why we built MyIT the way we did. Proactive IT management isn't about chasing the latest threat-of-the-week. It's about making sure the fundamentals are handled — encryption, access controls, patch management, and vendor oversight — so the obvious failures never happen on your watch.

If your current IT approach is reactive, you're already behind. Let's fix that.

Sources:
- Security Magazine: https://www.businesstechweekly.com/technology-news/cybersecurity-dilemmas-data-breaches-ai-vulnerabilities-and-government-risks-in-august-2026/
- SharkStriker August 2026 Breach Roundup: https://sharkstriker.com/blog/august-2026-data-breaches/

Here are some of the biggest data breaches of August 2026. Let us understand their impact through insights like how much data is compromised, the entities affected, regulatory fines, and ransom paid.

08/28/2026

It’s Friday, and while you’re thinking about the weekend, your office printer just achieved “active security threat” status. 🖨️🔥

PaperCut — yes, the software running basically every office printer — now has a zero-day exploit being actively used in attacks. Your printer isn’t just out of toner; it’s officially on a threat intelligence brief.

Let’s be honest: we all knew printers were evil. This just makes it legal.

This is exactly why proactive IT management exists. Because someone needs to be out there patching the random stuff you’d never think to worry about… while you focus on literally anything else.

Have a great weekend. May your printers jam only on Mondays. 😄

📰 The Hacker News: https://thehackernews.com/2026/08/papercut-zero-day-exploited-in-attacks.html

PaperCut says a zero-day affecting all NG and MF versions is actively exploited; emergency patches are available for v25 and v26.

08/27/2026

Attackers are getting smarter about how they deliver malware — and their latest trick is hiding inside Microsoft Teams.

A new phishing campaign is using Teams messages to push malware called SynkLoader. Because Teams is a trusted platform most businesses use daily, these messages bypass email filters and feel legitimate. One click on a malicious attachment or link, and the payload is on your system.

The good news: Microsoft just rolled out new admin controls that let IT teams block external bots from joining Teams meetings — cutting off one pathway attackers use to reach your users.

Here's the reality, though: platform-level controls are only part of the answer. Even with the best email filtering and Teams settings, determined attackers find ways through. That's why MyIT includes monitoring for suspicious software installations. If something like SynkLoader makes it onto a managed device, we see it immediately and take action — before it becomes a bigger problem.

If your team lives in Teams and you're managing security yourself, this is a lot to stay on top of. That's kind of the whole point of MyIT.

Sources:
- BleepingComputer: https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/microsoft-teams-now-lets-admins-block-external-bots-from-meetings/

Microsoft is rolling out a new Teams meeting protection policy that allows administrators to automatically block all identified external bots from joining Teams meetings.

08/26/2026

Ubiquiti patches three max severity security vulnerabilities

Ubiquiti has released security patches for three new maximum-severity vulnerabilities that threat actors can exploit remotely without privileges.

08/26/2026

AI-Powered "Apple Support" Scams Are Now a Thing — And Your Business Needs to Know

Cybersecurity researchers just uncovered a Phishing-as-a-Service platform called AnonyMousKIT that uses AI voice agents to call stolen iPhone owners pretending to be Apple Support. The goal? Trick victims into handing over their device passcodes and 2FA codes to disable Activation Lock.

This isn't a distant threat. It's automated, scalable, and happening now.

What businesses should take away:

✅ No legitimate support desk — Apple, Microsoft, or your IT provider — will ever call you unsolicited and ask for your password or 2FA code.
✅ If your employees use company-owned or BYOD iPhones, this is now a social engineering vector that targets them directly.
✅ Proactive device management and security awareness training aren't "nice-to-haves" anymore. They're how you stop this before it starts.

With CTC's MyIT proactive management, device policies and user training are baked into the plan — not an afterthought when something goes wrong.

Sources:
The Hacker News: https://thehackernews.com/2026/08/fake-apple-support-ai-calls-target.html
BleepingComputer: https://www.bleepingcomputer.com/news/security/anonymouskit-phaas-uses-voice-ai-agents-to-phish-iphone-passcodes/

A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature.

08/25/2026

A new phishing campaign called Mirage2FA has hit over 4,500 U.S. and EU companies, stealing passwords and session cookies to bypass two-factor authentication and access Microsoft 365 accounts.

What stands out: the attackers aren't breaking MFA — they're bypassing it by hijacking authenticated sessions after the user logs in legitimately. Once inside, they can move through corporate email, SSO-connected apps, and sensitive data for extended periods before anyone notices.

This comes on the heels of France's tax agency confirming a breach affecting 678,000 citizens, where an attacker entered via a compromised VPN account and wasn't detected for weeks.

The common thread isn't sophisticated zero-day exploits. It's identity and access management: who gets in, what they can touch once inside, and whether your systems are watching for abnormal behavior after login.

That's the gap proactive IT management is designed to close — not just setting up MFA, but monitoring sessions, managing conditional access, reviewing privileges, and treating "inside the network" as a place that still requires verification.

Sources:
- Mirage2FA campaign analysis: https://thehackernews.com/2026/08/mirage2fa-surge-hits-4500-us-and-eu.html
- France DGFiP breach details: https://www.cybernetica.fr/piratage-des-impots-comment-en-est-on-arrive-la/

La France de 2026 est au niveau de la Bulgarie en 2019

08/24/2026

CISA issued an emergency directive today: U.S. federal agencies must patch a critical Zimbra email vulnerability within three days. It's already being actively exploited in the wild.

The flaw (CVE-2026-73570, CVSS 8.9) allows unauthenticated remote code ex*****on through a command injection in Zimbra's SNMP service. In plain terms: attackers don't need a password to take control of an unpatched email server.

Here's why this matters even if you don't run Zimbra. When CISA orders a 3-day patch window, it's a signal that the threat is real, current, and severe. The same pattern plays out across every platform — email, identity, endpoints — every month. The difference between the businesses that weather it and the ones that don't isn't luck. It's how fast they patch.

For MyIT clients, this is routine. Critical patches get tested, scheduled, and deployed without waiting for an emergency directive. If your patch process is still manual — or if you're not sure when your email server was last updated — that's a gap worth closing.

Sources:
- BleepingComputer: https://www.bleepingcomputer.com/news/security/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw/
- The Hacker News: https://thehackernews.com/2026/08/attackers-exploit-zimbra-snmp-flaw-for.html

Attackers exploit CVE-2026-73570 on Zimbra servers with zimbra-snmp installed and SNMP notifications enabled, allowing unauthenticated RCE.

08/21/2026

GitHub was down for almost 8 hours on Monday. Not a typo — 7 hours and 47 minutes.

If you were in an office, you probably heard the collective sigh of every developer refreshing a page that wasn't coming back. Pull requests frozen. Pipelines broken. That one guy who said "I'll just push this real quick" — not today, friend.

The official explanation? A critical component in a Central US data center "failed to scale" with traffic. Which is tech-speak for "we didn't plan for Monday."

Here's the part that gets you: GitHub is one of the most important pieces of infrastructure in modern business. Microsoft owns it. It went down because something couldn't handle the load. If it can happen to them, the rest of us can sleep a little easier about our own outages.

So if your IT person looked a little stressed this week, buy them coffee. They were probably in 14 Slack threads trying to figure out if it was "us or GitHub."

Happy Friday. May your deployments be green and your Mondays be quieter than theirs. ☕️😅

08/20/2026

Password spraying attacks surged 155x in mid-June, according to Huntress researchers. Here's what caught our attention: attackers weren't just guessing passwords. They were reusing valid credentials from old breaches and slipping through a legacy OAuth authentication flow that most businesses don't even know exists.

The really uncomfortable part? Many of the compromised organizations had multi-factor authentication turned on. But the MFA wasn't configured to cover that specific login path. So the attackers walked right past it.

This is the kind of gap that doesn't show up in a basic security audit. It lives in the configuration details — Conditional Access Policies, legacy protocol settings, coverage gaps between what you think is protected and what actually is.

For MyIT clients, this is exactly the kind of thing we catch during our regular security posture reviews. We look at how authentication is configured, not just whether MFA is enabled. Because "enabled" and "covering every path" are two very different things.

If you're managing your own Microsoft 365 or identity environment, it's worth asking: does your MFA actually cover every login method, or are there legacy doors left unlocked?

Sources:
- BleepingComputer / Huntress:

Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected.

08/17/2026

Those $30 "fully loaded" Android streaming boxes are everywhere right now. Here's what most buyers don't realize: security researchers have found these devices preloaded with malware, botnet clients, and backdoors that phone home the moment you connect them to your network.

It's not just a consumer problem. We see these plugged into office TVs, breakroom displays, and conference rooms — often on the same network as company files and email. That $30 deal suddenly gets expensive when it's tunneling data out of your business.

This is exactly the kind of unmanaged device risk MyIT is built for. We inventory what's on your network, spot the oddballs, and make sure the breakroom TV isn't talking to servers in countries it shouldn't be.

If you've got devices on your network and no idea what they're doing, that's worth a conversation.