The Rnits Company

Home
United States
Tyngsboro, MA
The Rnits Company

Enterprise cybersecurity experts: cloud, endpoint, IAM, GRC, CI/CD AppSec—cut risk ensure compliance.

10/25/2026

If your web designer told you "I updated all the plugins, you're good" this week, they may be wrong. It isn't their fault.

On October 21, PHP released emergency fixes for two flaws called PHP2Shell. PHP is the engine underneath WordPress and roughly 70% of all websites. The flaws let anyone on the internet take over a web server without a password, and attackers were already using them before the fix came out.

The catch is that updating WordPress doesn't touch PHP. Whoever runs your server has to install the fix. On most shared hosting plans that's the host. On a VPS or a cloud server, it's probably you, and nobody may have told you.

We wrote up how to tell which kind of hosting you have, how to check your PHP version in two minutes, and a copy-and-paste email to send your host today:

https://www.rnits.com/blog/php2shell-php-vulnerability-small-business-website/

PHP2Shell lets attackers take over web servers with no password, and updating WordPress does not fix it. Who has to patch your site, and what to ask them.

10/17/2026

If you share SharePoint or OneDrive folders with clients, vendors or your outside accountant, some of those links are about to stop working.

Microsoft is retiring the old SharePoint one-time passcode, the six-digit code outside people typed in to open a shared file. The retirement started rolling out in mid-October and should finish by the end of November. Anyone who opened an older "Specific people" link that way, and never got a guest account in your Microsoft 365, will get an "access denied" page on that same link.

The annoying part is who finds out first: your client, not you, usually right when they need last year's tax folder or a set of drawings.

The fix is easy. Re-share one file with that person and access comes back. We wrote up the 30-minute check to run now, plus the side effect nobody mentions: every outside person you share with now lives in your directory.

https://www.rnits.com/blog/sharepoint-one-time-passcode-retirement-external-sharing/

Microsoft is retiring SharePoint one-time passcodes through November 2026. Older links to clients and vendors will start failing. Here is the 30-minute fix.

10/17/2026

For years, Microsoft's monthly security update fixed about 100 problems. On October 13 it fixed roughly 1,400.

That's a record, and it won't be the last one. Microsoft says AI is now finding bugs in Windows and Office faster than people ever could. July was about 570, September about 1,000, October about 1,400.

That's good news in the long run. Here's the catch for small businesses: you can't install only the important fixes. Windows updates arrive as one bundle, and one of October's fixes closes a hole attackers were already using. A laptop that hasn't rebooted in three weeks, or a PC someone paused updates on, is quietly missing all of it.

"Automatic updates are on" and "we're patched" aren't the same thing anymore. We wrote up what changed, what to ask whoever handles your IT, and the simple monthly process that actually keeps up:

https://www.rnits.com/blog/microsoft-patch-tuesday-1400-fixes-ai-small-business/

Microsoft fixed about 1,400 flaws in October, a record driven by AI bug hunting. What it means for small business patching and what to do first.

10/11/2026

For $500 a month, a criminal could rent an AI that read a stolen Microsoft 365 inbox and told them who pays the invoices.

The service was called EvilTokens. Microsoft took it down on September 22, but by then it had broken into more than 12,000 business inboxes. Construction, healthcare, financial and real estate firms were among the victims. It never needed anyone's password. It tricked people into approving a real Microsoft login, MFA included, and then its AI combed through the mail for wire transfers and pending invoices and wrote the fake "we changed banks" email for the crook.

Two things worth knowing. First, copycats already exist. Second, changing your password does NOT kick them out. The stolen sessions have to be revoked too.

We wrote up what happened, plus a one-hour checklist for your own Microsoft 365 tenant: https://www.rnits.com/blog/eviltokens-ai-phishing-microsoft-365-stolen-inboxes

Microsoft dismantled EvilTokens, a $500/month phishing service whose AI read 12,000 stolen M365 inboxes to plan invoice fraud. What it did and what to check now.

09/26/2026

If you supply parts or engineering up the defense chain, you probably heard CMMC got suspended this summer — and you may have gotten a follow-up email telling you to book a certification assessment before the rush anyway. One of those is honest. The other is a sales pitch.

Here's the plain version: the Pentagon suspended the third-party CMMC audits in July, and in September started stripping them out of contracts. But NIST 800-171, the DFARS 7012 clause, and your SPRS score are all still fully required. The audit got paused. The homework did not.

So don't pay a consultant to prep you for an assessment that has no date and no final rules. Spend that budget getting genuinely compliant with 800-171 instead — it pays off no matter what the review decides.

We wrote the whole thing up for small MA/NH manufacturers and defense subs: https://www.rnits.com/blog/cmmc-phase-2-suspended-nist-800-171-still-required/

CMMC third-party assessments are suspended — but NIST 800-171, DFARS 7012, and your SPRS score still apply. What MA/NH defense subcontractors should do now.

09/16/2026

A 30-person accounting firm turned on Microsoft Copilot and asked it a simple question: "Summarize our staff compensation structure." It answered in four seconds — names, numbers, all of it — from a payroll spreadsheet someone had shared with "Everyone" back in 2021 and forgotten.

Here's the thing: Copilot did nothing wrong. The person asking already had access to that file. Copilot didn't leak it. It just made a file nobody remembered existed instantly findable.

That's the whole "Copilot oversharing" problem. It's not a hole in Copilot — it's a spotlight on a decade of clicking "Share" to make life easier. The good news: it's a few hours of permissions cleanup, not a canceled rollout or six new tools on your IT bill.

We wrote up the exact pre-Copilot cleanup checklist for NH and MA small businesses: https://www.rnits.com/blog/copilot-oversharing-sharepoint-permissions-smb/

Copilot creates no new access. It just makes everything a user can already reach instantly searchable. The oversharing was there for years — Copilot is the flashlight.

08/11/2026

If your practice turned on an AI scribe this year, here is a question nobody in the building may have asked: did anyone ask the patient?

HIPAA covers what happens to the health information in that recording. It says almost nothing about whether you were allowed to record in the first place. That is state wiretap law, and it carries criminal penalties HIPAA does not.

Most articles about AI scribes lump Massachusetts and New Hampshire together as "all-party consent" states. That is wrong about one of them. Massachusetts prohibits secret recording, where actual knowledge is the test rather than permission. New Hampshire requires consent from everyone. New Hampshire is the stricter of the two, which surprises most people.

In April, patients filed a class action against two health systems over exactly this. The AI vendor was not named as a defendant. The providers were.

We wrote up what compliance actually looks like, including the consent sentence to say out loud and why the "mandatory 2026 HIPAA requirements" you are being sold are not law yet.

https://www.rnits.com/blog/hipaa-compliant-ai-medical-practice-scribes-consent/

HIPAA is only half the problem when AI listens to a patient visit. Massachusetts and New Hampshire recording law is the other half, and the rules differ.

08/07/2026

A client got their customer's annual vendor security questionnaire last month. Same packet as always, except it was four pages longer, and the new pages were all about AI.

His first instinct was to write "we don't use AI." He knew that was false while he was thinking it. His office manager had been drafting proposals in ChatGPT since March, and his bookkeeper was using Copilot in Excel because it came with a license they already paid for.

Here's the part almost nobody gets right. If you bought an enterprise AI plan with a HIPAA BAA, you are probably not as covered as you think. Anthropic publishes exactly which parts of Claude the BAA covers, and the excluded list includes connectors, enterprise search, and the browser extension. In other words, the integrations that make the tool useful in the first place. "We have a BAA" is not an answer. Which surfaces you turned on is the answer.

We wrote up what those questionnaires actually ask now, and the four things you need in place before you can answer honestly. None of them require buying anything new.

https://www.rnits.com/blog/ai-security-questionnaire-guardrails-smb

Vendor security questionnaires now have an AI section. Here is what it asks, why "we have a BAA" fails it, and the four things you need in place first.

08/01/2026

Last month we wrote about the five kinds of work that eat a small business week — proposals, repetitive forms, email, intake, and the marketing that quietly stopped happening. The follow-up question everybody asked was the same: fine, but where do I start?

The answer depends entirely on what business you're in, so we wrote it out industry by industry. Contractors, medical and dental practices, law firms, accounting firms, machine shops, property managers. What the paperwork actually is in each one, what the credible data says (and which numbers came from companies selling the fix), and the single workflow we'd build first.

Here's the part that surprises people: in every one of these, the first workflow is not the famous one. We would not start a medical practice on prior authorization, even though that's a 13-hour-a-week problem. We would not start a law firm on document drafting. The right first project is high-volume, low-judgment, and cheap to check — because that's the one that earns enough trust to make the second one possible.

Read it here: https://www.rnits.com/blog/ai-automation-by-industry-where-to-start/

Contractors, medical practices, law firms, accountants, manufacturers, property managers. Six industries, six different piles of paperwork, and where each one should actually begin.

Address

404 Middlesex Road, Suite 9
Tyngsboro, MA
01879

Website

https://www.rnits.com/

Alerts

Be the first to know and let us send you an email when The Rnits Company posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.