6 min read
Ubiquiti Bulletin 067: patch UniFi OS, Protect, Access, and Talk now
Ubiquiti's August 2026 advisory covers 22 UniFi vulnerabilities. Here are the affected products, fixed versions, real risks, and a practical update checklist.
Security
26 articles
5 min read
Browser-saved passwords are not a business control
Chrome, Edge, and Apple Passwords are useful autofill stores, but they are not a shared business vault for payroll, banking, or infrastructure logins.
9 min read
1Password is (probably) the best password manager for home and work
An operator’s opinion: why 1Password is my default for personal use and small businesses, including the isolated Families account that comes with Business and MSP-provisioned seats.
4 min read
OVSwrap (CVE-2026-64531): patch Linux for this local root
CVE-2026-64531 is a local privilege escalation in the Linux Open vSwitch datapath with a public PoC. Who is exposed, which stables are fixed, and what to do today.
7 min read
Hugging Face's July 2026 incident: when an AI evaluation escaped its boundaries
Hugging Face and OpenAI documented an autonomous model crossing evaluation and production boundaries. Lessons on sandboxing, local forensics, and data-processing attack surface.
3 min read
What “good enough” endpoint security looks like for an SMB
A realistic endpoint baseline for small businesses: patching, MFA, EDR, backups, and least privilege, without pretending you need a Fortune 500 stack.
6 min read
July 2026 Patch Tuesday: when AI discovery floods the CVE queue
Microsoft's 663-CVE July 2026 release reflects AI-assisted vulnerability discovery. What MSPs and SMBs should change in triage without freezing from volume anxiety.
6 min read
How we triage critical CVEs for clients
A practical way to rank vulnerability work using exposure, exploitation evidence, business impact, and change risk instead of CVSS alone.
6 min readTutorial
Incident first-hour checklist
A practical first sixty minutes for scoping an incident, stopping active harm, preserving evidence, securing identity, and giving leadership facts instead of guesses.
3 min readTutorial
Shared admin secrets in a team vault
How small IT teams store shared admin passwords and API keys in a password manager without Spreadsheet-of-Doom habits.
3 min read
Spam filter tuning without blind spots
Aggressive block lists feel productive until legitimate mail vanishes. How to tighten filtering without losing invoices, MFA codes, and vendor threads.
3 min read
JIT vendor access instead of standing VPN
Standing VPN accounts for vendors age badly. Just-in-time access with time bounds and approval beats a shared tunnel nobody reviews.
6 min read
Time to rotate service account passwords
Inventory service identities, replace passwords where possible, and rotate remaining secrets without breaking the workloads that depend on them.
5 min read
Project Glasswing and the patch queue your business will feel anyway
Anthropic's April 2026 Project Glasswing put Claude Mythos Preview to work finding critical flaws with major vendors. What that means for downstream patching at ordinary SMBs.
3 min read
Phishing-resistant MFA for executives first
Why the CEO's mailbox is the first account that deserves FIDO2 or passkeys, not another SMS code.
6 min read
VoIP toll fraud: what to lock down
A vendor-neutral VoIP toll-fraud baseline covering dial permissions, admin access, SIP exposure, alerts, logs, and incident response.
6 min read
Offboarding: make the access cut the same day
A practical same-day IT offboarding runbook for identity, sessions, SaaS, devices, shared secrets, and company data without deleting first and asking later.
6 min read
Business email compromise: red flags worth a phone call
How small businesses can recognize payment fraud, verify a request outside email, and respond quickly when money or a mailbox may be at risk.
3 min read
When to force SSO for business SaaS
Single sign-on is not free to roll out — but neither is password sprawl. How SMBs decide which apps get SSO enforced and which can wait.
6 min read
Google Workspace security baseline for small teams
A practical Google Workspace baseline for 10-50 users: enforced 2-Step Verification, safer administrators, controlled sharing, OAuth review, devices, and alerts.
3 min read
RMM alert fatigue: what to silence
When your PSA is full of noise, operators stop seeing real incidents. A practical filter list for SMB RMM alerting.
3 min readTutorial
BitLocker recovery keys: where they should live
A practical escrow plan for BitLocker recovery keys in small businesses — so a lost PIN does not become a full disk wipe.
3 min readTutorial
Break-glass admin accounts that actually work
How to create and maintain emergency Microsoft 365 admin accounts so you can recover the tenant without leaving a permanent backdoor.
5 min read
Chrome zero-day patch habits for small offices
Emergency browser updates do not wait for Patch Tuesday. How SMBs should force Chrome updates, control extensions, and close the relaunch gap before attackers do.
4 min read
CrowdStrike July 2024 outage: lessons for SMBs
A bad Falcon content update crashed millions of Windows systems. Here is what small IT teams should change without turning it into blame theater.
4 min read
XZ Utils backdoor: what ops should check
CVE-2024-3094 hit rolling Linux distros hard. Here is what happened, who was exposed, and the checks SMB teams should run.