Each week, we rank verified developments affecting small businesses, explain why they matter, and connect practical next steps to the services we provide.
A critical WordPress core flaw drew exploitation attempts within hours of its September 22 fix and is now confirmed exploited, Check Point confirmed attacks on firewall VPNs and management servers, and Microsoft confirmed exploitation of a SharePoint Server flaw it patched in August. Here are the top five verified developments for small and mid-size businesses, ranked by relevance, exploitation evidence, and urgency.
Cisco disclosed a maximum-severity authentication bypass in Identity Services Engine and a critical SQL injection in Secure Email Gateway, both under confirmed active exploitation in the same week, while CISA added a year-old Linux kernel flaw and a backup-software privilege escalation to its Known Exploited Vulnerabilities catalog. Here are the top five verified developments for small and mid-size businesses, ranked by severity, exploitation evidence, and urgency.
CISA added six newly exploited vulnerabilities across Cisco, Fortinet, Citrix, and MikroTik to its Known Exploited Vulnerabilities catalog this week, while Microsoft shipped its largest Patch Tuesday on record with two actively exploited Windows zero-days. Here are the top five verified developments for small and mid-size businesses, ranked by severity, exploitation evidence, and urgency.
CISA added CVE-2026-85046, a high-severity type confusion flaw in the V8 engine behind Chrome and every other Chromium-based browser, to its Known Exploited Vulnerabilities catalog on September 4, 2026, after Google confirmed active exploitation. It is the sixth actively exploited Chrome zero-day patched in 2026.
CISA added CVE-2026-9586, an unauthenticated SQL injection flaw in the Sangoma Switchvox business phone system, to its Known Exploited Vulnerabilities catalog on September 2, 2026, after honeypots caught attackers deploying reverse shells. Roughly 4,000 Switchvox systems are reachable from the open internet, according to Shodan.
CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog on August 26, 2026, confirming active exploitation of a Citrix NetScaler root RCE flaw.
The Pentagon paused CMMC Phase 2 certification on July 13, 2026, and comment on its reform review closed August 14. Phase 1 and DFARS duties never stopped.
The Texas Responsible AI Governance Act took effect January 1, 2026, giving the Attorney General a second privacy statute to enforce against Texas businesses that develop or deploy AI systems.
Attackers exploited an authentication bypass in the N-able N-central remote monitoring platform to seize admin control of MSP servers and reach client networks. For SOC 2-scoped service organizations, and the businesses that rely on them, it is a live test of vendor and subservice oversight.
PCI DSS Requirements 6.4.3 and 11.6.1 for payment page scripts are in effect, and a real WooCommerce skimming attack shows exactly why they exist.
A critical Check Point SmartConsole flaw under active exploitation lets attackers seize firewall admin control. Patch now and review HIPAA access controls.
Two actively exploited SonicWall SMA 1000 flaws can expose credentials and MFA secrets. Businesses using the appliance should confirm exposure, patch quickly, review logs, and keep proof for cyber-insurance reviews.
CISA, the NSA, and the FBI urged businesses to harden their routers against Russian state actors. The fixes they name are controls that FTC Safeguards and HIPAA already require you to have and document.
Update, August 23, 2026: The Department of Defense suspended this Phase 2 start date on July 13, 2026. Phase 1 self-assessment and DFARS obligations described below remain active regardless.
CISA added an actively exploited SharePoint Server flaw to its Known Exploited Vulnerabilities catalog on July 1, 2026. For HIPAA-covered and FTC Safeguards-covered businesses, the real story is what unpatched, internet-facing software says about your documented vulnerability management program.
Four ransomware settlements totaling $1.165 million, and every one cites the same missing document: an accurate and thorough risk analysis. While the proposed HIPAA Security Rule update sits unfinalized, OCR is enforcing the current rule, and mid-size healthcare businesses and their vendors are the ones paying.
This section is original analysis, not a news rewrite. Each week we rank the most significant verified developments in the security and compliance landscape and explain what they mean for the obligations that drive managed IT and cybersecurity decisions.
Every Sunday we rank the three to ten most significant verified developments of the past week, drawn from sources such as CISA, HHS OCR, the FTC, and
NIST and cross-checked across independent reporting, by relevance, evidence of exploitation, business impact, and urgency.
Every brief ties back to a specific obligation: the FTC Safeguards Rule, HIPAA Security Rule, CMMC, PCI DSS, SOC 2, the Texas Data Privacy and Security Act, or cyber-insurance underwriting requirements.
The goal is practical guidance you can act on, not alarmist headlines.
This is written for owners and operators evaluating their own compliance exposure, not for a security operations audience. If you want deeper technical guidance, visit our main blog; if you want a quick, current compliance angle, this is the place to start.
How often is the Security & Compliance Brief published?
We publish every Sunday, ranking the three to ten most significant verified developments in the security and compliance landscape from the preceding week rather than covering just one story.
How is this different from the Blog and News pages?
The Blog covers long-form guides and best practices, and News covers company updates and individual advisories.
The Security & Compliance Brief is a weekly ranked digest: the most significant verified developments from the past week, each tied to an obligation such as HIPAA, the FTC Safeguards Rule, or CMMC.
Does this apply to my business if I am not in a regulated industry?
Most of our commercial clients are covered by at least one framework in this series, whether through HIPAA, the FTC Safeguards Rule, a cyber-insurance policy, or a client contract that requires SOC 2 or CMMC.
If you are unsure which obligations apply to you, contact our team for a review.
