Resources
Recent public security alerts, in plain language, plus guidance on the technology decisions that matter for mission-driven organizations.
Recent public security alerts worth knowing about
A plain-language roundup of alerts from the FBI/IC3 and CISA over the last several months. We track these so the organizations we serve don’t have to. Each card links to the official source.
September 25, 2026
Another SharePoint flaw, plus MikroTik routers
CISA added a code-injection bug in on-premises Microsoft SharePoint and a flaw in MikroTik RouterOS, both under active attack. This is the third exploited SharePoint hole since July; if you still run it on-site, patch now and consider moving to the hosted version. Small offices with MikroTik routers should update firmware.
Read the alert FBI / IC3September 17, 2026
Fake government officials, now on video calls
The FBI reports nearly 61,000 complaints and $1.6 billion lost to criminals posing as police, courts, and licensing boards, some now using AI on video calls with a staged office behind them. Medical practices are a named target. No agency demands payment or personal details by phone or text; hang up and call the office directly.
Read the alert CISASeptember 11, 2026
Remote-support tool used by IT providers under attack
A privilege flaw in ConnectWise ScreenConnect, the remote-access software many IT providers use to work on client computers, is being exploited. If an outside company supports your machines, ask whether they use ScreenConnect and confirm it is patched. Two JFrog Artifactory flaws were added in the same notice.
Read the alert CISASeptember 8, 2026
Two Windows zero-days from the September updates
Microsoft’s September patches close two Windows flaws already being used to gain full control of a PC after a foothold. Install the updates and reboot. The same notice lists N-able N-central, another IT-provider tool, and Adobe Commerce/Magento, so patch if your online store runs on Magento.
Read the alert CISASeptember 2, 2026
Office phone systems and SonicWall VPN appliances
Seven exploited vulnerabilities were added, including two in SonicWall SMA1000 remote-access appliances and a SQL-injection flaw in Sangoma Switchvox, a phone system common in small offices. Both sit at the network edge. Check firmware on your firewall, VPN, and phone system this week.
Read the alert FBI / IC3September 1, 2026
Consent phishing: no password stolen, mailbox still taken
Criminals send a link that opens a real Microsoft or Google sign-in page, then ask you to approve an app. Approve it and they can read and send your email indefinitely, and changing your password does not remove them. In Microsoft 365, restrict which apps users can consent to and review the apps already approved.
Read the alert CISAAugust 26, 2026
Old bugs do not retire: 2019 SQL Server flaw still being exploited
Six additions, including Citrix NetScaler and a Microsoft SQL Server remote-code flaw from 2019 that attackers are still using. If a line-of-business app on your network runs on an older SQL Server, confirm it is patched or isolated. Three of the six are Linux and Red Hat issues from 2015 and 2022.
Read the alert CISAAugust 18, 2026
Windows, SharePoint, and Mac flaws all under attack at once
Four exploited vulnerabilities in one notice: a Windows IKE flaw that needs no login, a SharePoint authentication bypass, a macOS Screen Sharing bug that lets someone on your network connect without a password, and VMware vCenter. Patch Windows and macOS on every machine, not just servers.
Read the alert CISAJuly 29, 2026
Hard-coded password in Cisco firewall management software
CISA confirmed active exploitation of a hard-coded password in Cisco Secure Firewall Management Center. If you run it, patch and rotate credentials right away.
Read the alert CISAJuly 27, 2026
Fortinet and Arista flaws under active attack
Two more exploited vulnerabilities added, in Fortinet FortiOS and Arista VeloCloud Orchestrator. Both sit at the network edge, so patch promptly if you run either.
Read the alert FBI / IC3July 20, 2026
Scammers are impersonating the FBI’s own fraud reporting center
Criminals are running fake IC3 pages and AI-generated deepfake videos to re-target people who have already lost money. IC3 keeps no social media presence and never asks for payment to recover funds.
Read the alert CISAJuly 14, 2026
On-premises SharePoint servers under active attack
CISA reports five vulnerabilities being used to break into on-premises SharePoint Server, including stealing IIS machine keys to hold on to access. Patch, switch on AMSI, and rotate those keys.
Read the alert FBI / IC3June 18, 2026
Hijacked websites are quietly funneling visitors to scam pages
Criminals take over legitimate sites through weak passwords and outdated plugins, then redirect visitors to phishing and malware. That access is often resold to ransomware crews. Audit your CMS logins and keep plugins patched.
Read the alert FBI / IC3May 2026
“Kali365” phishing kit hijacks Microsoft 365, no password needed
A phishing-as-a-service kit abuses Microsoft’s device-code sign-in to steal access tokens and walk past MFA. The FBI urges blocking device-code flow in Entra ID and using phishing-resistant MFA.
Read the alert CISAApril 20, 2026
Eight actively-exploited vulnerabilities added to CISA’s catalog
CISA flagged eight vulnerabilities being exploited in the wild. If any of your software is on the list, patch it promptly.
Read the alert CISAApril 6, 2026
New actively-exploited vulnerability flagged by CISA
CISA added a vulnerability with confirmed active exploitation to its Known Exploited Vulnerabilities catalog.
Read the alert CISAMarch 20, 2026
Five actively-exploited vulnerabilities added to CISA’s catalog
Five more flaws confirmed as exploited in the wild. Worth checking your systems and updates against the list.
Read the alert CISAFebruary 3, 2026
SolarWinds, GitLab, and FreePBX flaws under active attack
CISA added four exploited vulnerabilities, including issues in SolarWinds Web Help Desk, GitLab, and Sangoma FreePBX. Patch promptly if you run these.
Read the alert CISAJanuary 7, 2026
Two actively-exploited vulnerabilities added to CISA’s catalog
CISA confirmed two more vulnerabilities being exploited in the wild and added them to its catalog.
Read the alertSources: FBI IC3 and the CISA Known Exploited Vulnerabilities catalog. This roundup is updated periodically; it is not a complete list of every advisory.