CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities catalog this week, confirming that attackers are actively exploiting a denial-of-service flaw in SolarWinds Serv-U file transfer software.

An unauthenticated attacker can crash the Serv-U service with a single crafted HTTP request, taking file transfer operations offline and potentially opening the door to further exploitation during the recovery window. Federal agencies have until June 19 to patch. BleepingComputer

This is the fifth SolarWinds Serv-U vulnerability to be confirmed as actively exploited since 2021. If you manage Serv-U deployments for any clients, patch today.

🟡 ShinyHunters breached the UK’s University of Nottingham. 455,000 students' data is now public

ShinyHunters has added another UK institution to its list.

The University of Nottingham confirmed that a hacking group gained access to its student records system in a breach affecting both current students and alumni. The university said the incident exposed a “significant amount of data” and that the breach has been reported to the UK’s Information Commissioner’s Office. BleepingComputer

Have I Been Pwned confirmed the breach affects 455,000 unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers, and information relating to academic enrolments and fee payments.

This attack is part of a wider campaign in which ShinyHunters has stolen data from over 100 organisations worldwide.

🟢 The money-laundering service that kept ransomware gangs paid just got shut down

Finally, a satisfying one to end the week on.

Law enforcement has dismantled AudiA6, a cryptocurrency laundering service used by ransomware actors and other cybercriminals to launder more than $380 million. The coordinated takedown was executed on Wednesday, resulting in 2 arrests, 25 domains seized, more than 30 servers taken offline, and over 80 vehicles and multiple properties confiscated. BleepingComputer

The service was linked to more than 15 international ransomware investigations. It accepted cybercrime proceeds, obscured their origins through complex transactions, and returned them cleaned within approximately one hour, charging a 3-10% commission.

Well, will you look at that? We made it to Friday 😃 Hope you have a great weekend. We’ll be back in your inbox on Monday morning.

Microsoft patched 200 vulnerabilities on Tuesday. But by Tuesday afternoon, Nightmare Eclipse had published another one.

RoguePlanet is a new Microsoft Defender race condition exploit that grants system-level privileges on fully patched Windows 10 and Windows 11 machines. It was confirmed working on systems with all June 2026 Patch Tuesday updates installed.

ThreatLocker independently reproduced it and shared a video demonstrating it. “Our initial analysis confirms that the RoguePlanet exploit is viable and performs as described,” ThreatLocker CEO Danny Jenkins told BleepingComputer. BleepingComputer

The exploit is a race condition, not guaranteed to succeed on every machine, and it doesn’t work on Windows Server in its current form. But this is the seventh Windows zero-day dropped by this researcher since April. Their “bone shattering” July 14 release remains threatened.

Microsoft, for its part, previously appeared to threaten legal action against Nightmare Eclipse before walking it back under significant community pressure. The Register

🟡 NinjaOne just went from a $5 billion to a $12.3 billion valuation in 18 months. It’s now one of the most valuable software companies on the planet

NinjaOne announced Tuesday it has raised over $400 million in a Series C extension, bringing its valuation to $12.3 billion. That’s up from $5 billion in February 2025. Channel Dive

To put that in context: NinjaOne serves nearly 40,000 customers across 140+ countries, grew nearly 70% year-on-year in 2025, and turned its first profitable quarter earlier this year.

Co-founders Sal Sferlazza and Chris Matarese remain the largest shareholders. Their message to MSPs was direct: “The channel is core to everything we do. With this funding, we will continue to prioritise delivering more partner enablement, more field resources, and expanding our investment in developing new and improved products and tools that help our partners grow.”

🟢 The World Cup kicks off tonight. Did you send that warning email to clients last week?

The 2026 FIFA World Cup opens tonight with Mexico vs USA in Mexico City. It’s the first match of a tournament that runs across the US, Canada, and Mexico for the next seven weeks.

We’ve covered the phishing threat twice. Over 4,300 fraudulent FIFA domains are live. The GHOST STADIUM campaign is running 300+ clones of the official site. And the FBI has issued formal warnings.

But today the angle is different. The MSPs who sent clients a short, practical warning email last week (verify the URL, buy only from official sources, be careful with sponsored search results) are proactively helping to protect their clients’ employees.

If you didn’t send it last week, there’s still time. The tournament runs until mid-July. FIFA

Amazing, that’s Thursday morning done, and we’ll be back in your inbox for the final time this week tomorrow morning. Have an exceptional day.

If you run Veeam Backup & Replication 12.x in a domain-joined environment, patch this today.

Veeam disclosed CVE-2026-44963 yesterday. It’s a CVSS 9.4 critical vulnerability allowing any authenticated domain user to execute arbitrary code remotely on the backup server. The bar for exploitation is remarkably low: standard Active Directory credentials, no admin rights required, and no special access needed. Any domain user can trigger it. BleepingComputer

No active exploitation has been confirmed yet. But Veeam explicitly warns that attackers typically begin developing exploits as soon as patches are disclosed.

CISA has previously flagged four separate Veeam Backup & Replication vulnerabilities as actively exploited, with ransomware groups including Akira, Fog, Frag, and FIN7 all linked to Veeam attacks.

The patch is available now. Update to Veeam Backup & Replication version 12.3.2.4854. Note: this vulnerability only affects domain-joined installations. If your Veeam servers are in a workgroup configuration rather than joined to Active Directory, you are not affected by this specific flaw… but sensible to update anyway, as Veeam patched additional high-severity flaws in the same release.

🟡 Yesterday was the biggest Patch Tuesday in Microsoft history: 200 flaws, three zero-days, and the end of the Nightmare Eclipse saga (for now)

June 2026 Patch Tuesday addressed a HUGE 200 vulnerabilities, smashing the previous record of 167 set in October last year.

33 are rated Critical, 28 of which are remote code execution flaws. The full breakdown is live and updating. BleepingComputer

The three zero-days are the ones some MSPs have been following:

• GreenPlasma, the Windows CTFMON privilege escalation exploit we first covered in May, is patched as CVE-2026-45586

• YellowKey, the BitLocker bypass that lets anyone with physical access read encrypted drives, is addressed in CVE-2026-50507.

• And RedSun, the Defender exploit, was quietly patched without a CVE or public advisory

All three stem from Nightmare Eclipse, the anonymous disgruntled researcher who has been dropping unpatched Windows exploits since April. Krebs on Security

Also in today’s release: the permanent fix for Exchange Server CVE-2026-42897, the actively exploited cross-site scripting flaw. And the Secure Boot certificate update, the last comfortable window before the June 26 deadline. Windows Server needs manual deployment via Group Policy or WSUS.

Side note: Nightmare Eclipse dropped a fresh exploit within hours of today’s patches publishing and has promised a “bone shattering” release on July 14, exactly when next month’s Patch Tuesday lands.

🟢 For the first time ever, Microsoft credited an AI for finding a vulnerability in Patch Tuesday

Buried inside yesterday’s record-breaking release is an AI footnote.

CVE-2026-49160, a denial-of-service flaw affecting Microsoft IIS web servers, was discovered and reported not by a human security researcher, but by OpenAI’s Codex AI.

Microsoft explicitly credited it in the advisory. It’s the first time a major vendor has publicly acknowledged an AI system as the discoverer of a real-world vulnerability in a Patch Tuesday release. Krebs on Security

Right, that's your update for Hump Day. We said it was a big one, didn't we? We'll be back in your inbox tomorrow morning. Have a good one.

This is the story that should make every MSP think carefully about AI-powered support tools.

Meta’s High Touch Support system, an AI-assisted tool designed to help users recover locked Instagram accounts, had a flaw that attackers exploited between April and May.

The system sent password reset links without verifying whether the email address matched the account being recovered. Attackers simply requested resets for accounts they didn’t own, received the links, and walked straight in. BleepingComputer

This was a hacker social-engineering an AI system… finding the gap between what the AI was supposed to check and what it actually checked. As AI tools get deployed across more client environments for support, authentication, and access management, this category of risk is going to grow.

🟡 June Patch Tuesday is live. Check BleepingComputer today for the full breakdown as it drops

Updates are dropping from Microsoft this morning. Key things expected in today’s release:

• The permanent fix for Exchange Server CVE-2026-42897, the actively exploited cross-site scripting flaw we flagged last week

• And the Secure Boot certificate update, which is the last comfortable window before the June 26 deadline. Help Net Security

Windows Server does not auto-apply the Secure Boot certificate update, it needs manual deployment via Group Policy or WSUS. After June 26, unpatched devices enter a degraded security state.

BleepingComputer will have the full breakdown live throughout the morning as CVEs are confirmed… worth keeping an eye on today: BleepingComputer

🟢 Companies that fired people to make room for AI are finding it isn't working

Fresh research published today makes for interesting reading, especially if your clients have been asking whether they should be replacing staff with AI tools.

Gartner surveyed organisations across multiple sectors on their AI deployment strategies and found a clear pattern: companies that used AI to replace workers outright are not seeing the productivity gains they expected. The ones reporting the strongest returns are the ones using what Gartner calls “people amplification”: giving existing staff AI tools that make them faster, better, and more capable, rather than eliminating the humans entirely. Tom’s Hardware

The data is still murky. Gartner is careful to say neither the success nor the failure of AI replacement is conclusively proven yet. But the direction of the early evidence is clear enough: AI as a tool in human hands is outperforming AI as a replacement for human hands.

Your clients are going to read stories like this and ask what it means for their business. This could be a good opportunity for you to offer AI consulting services.

Yay, that’s Tuesday done. We’ll be back in your inbox tomorrow morning. Have a great day!

The tournament might not start until Thursday, but the scammers have been ready since August.

Group-IB has tracked over 4,300 fraudulent FIFA-related domains registered since August 2025. At the centre is a campaign called GHOST STADIUM, a Chinese-speaking criminal operation. It’s running 300+ pixel-perfect clones of the official FIFA portal, complete with fake single sign-on flows, in 11 languages. The FBI confirmed last week that hundreds of these sites are actively harvesting credentials and payment details from fans buying tickets, merchandise, and streaming packages. The Hacker News

The attack surface is enormous: FIFA said it received 150 million ticket requests in the first 15 days of sales (30 times oversubscribed) leaving millions of fans anxious, desperate, and clicking fast.

Your clients’ employees are football fans. Some of them are going to be searching for tickets, streams, and merchandise over the next seven weeks. How about sending a one paragraph warning email this week?

• Verify the URL

• Buy only from official sources

• Be extra careful when entering card details on a page you reached via a search ad

Have you seen any impact from this? Hit reply and let us know.

🟡 June Patch Tuesday is tomorrow. And it's probably bringing the Exchange Server zero-day fix we've been waiting for

Two things to know before tomorrow’s updates drop.

First: the Exchange Server zero-day CVE-2026-42897, the actively exploited cross-site scripting flaw, is expected to finally receive its permanent patch on Wednesday (although that hasn’t yet been confirmed). Microsoft has had a temporary EEMS mitigation in place since disclosure. Apply it across all on-prem Exchange estates as soon as it’s available. Help Net Security

Second: this is the last comfortable Patch Tuesday before the Secure Boot certificate deadline on June 26. Devices that receive the update are covered. Devices that miss it have no further comfortable window before the deadline. After June 26 unpatched devices enter a degraded security state. Windows Server does not auto-update this certificate. It requires manual deployment via Group Policy or WSUS. Check your Server estates today before tomorrow’s updates drop.

🟢 The IT support call that ended with tactical vehicles

The Register’s On Call column published last week with one of the best reader submissions in recent memory.

Solomon was working IT support for a Scottish courts organisation when he got an urgent callout. He arrived to find several police patrol cars. Then more arrived and the radio chatter intensified. Then two tactical vehicles came roaring around the corner.

There was a lot of shouting. Solomon’s exact thought at this point: “I need a bulletproof vest and a fully automatic rifle. I haven’t been to church for years.” The Register

About 20 minutes later, the officer in charge returned to Solomon and told him he wasn’t needed. “No computers here,” he said, adding the cryptic explanation: “Things moved faster than expected.”

Ok, that’s Monday done. It’s gonna be a busy week, we feel. Don’t you? We’ll be back in your inbox tomorrow morning.

If your clients had email delays or failures earlier this week, here’s what happened.

Starting Tuesday, Microsoft’s Exchange Online suffered a serious mail flow failure, tracked as incident EX1331830. It blocked or severely delayed email delivery for enterprise users across North America, Asia-Pacific, and Europe.

Emails were stuck in transit for anywhere between 30 minutes and six hours. Engineers deployed a mitigation at 02:00 UTC on Wednesday, found it was making things worse, and had to roll it back. BleepingComputer

Microsoft traced the root cause to a subset of mail transport infrastructure that stopped processing messages as expected. Service was gradually restored, but the mail queue backlog meant some messages continued to arrive late well into the following day.

Did you see any impact from this? Hit reply and let us know.

🟡 Microsoft's MFA registration portal also went down this week…

Slightly different issue. On Monday, Microsoft’s My Sign-Ins portal (the page where users set up and manage their MFA methods) went down with 504 Gateway Timeout errors.

Users who needed to register MFA for the first time, reconfigure an existing method, or recover a lost authenticator couldn’t do any of it. New starters couldn’t complete onboarding and anyone locked out of their account couldn’t get back in. BleepingComputer

Microsoft blamed a cache configuration change and restored the service the same day after rolling back to the original infrastructure.

🟢 Do you believe this stat? 75% of MSPs were breached at least once last year

CyberSmart’s 2026 MSP Survey, based on 350 MSP leaders across the UK and Ireland, published last month with a finding that deserves more attention than it got. CyberSmart

• Three quarters of MSPs reported at least one breach in the past 12 months

• 54% were breached two or more times

• Nearly a third experienced three or more incidents

• And 59% of MSPs believe their clients are more at risk now than they were a year ago.

Of course, we know why attackers are targeting MSPs, because they want to access multiple organisations from one breach.

The good news in the same report: customer scrutiny of MSP security is stabilising as a baseline expectation. Investing in your own security is good for business in every way.

Right, that’s this week done. I don’t know about you, but we’re exhausted and need a beer tonight and a long sleep this weekend. Have a good one. We’ll be back in your inbox on Monday morning.

Sophos published some scary research on Tuesday.

A threat actor linked to ransomware and data theft operations, built a complete AI-orchestrated malware development and testing framework. Using AI agents including Claude Opus and Cursor, they generated Python shellcode injection scripts, automated Active Directory discovery, and systematically refined EDR evasion techniques across 80+ modules and 70+ bypass methods.

All of it’s been tested against dedicated virtual machines running Sophos, CrowdStrike, and Microsoft Defender… the exact tools MSPs deploy for clients. BleepingComputer

The toolkit also includes Cobalt Strike profiles disguising beacon traffic as legitimate web requests, a Telegram bot for command and control, and a Cloudflare Worker concealing backend infrastructure. This is a sophisticated, layered setup that took significant effort to build and is being used operationally. Help Net Security

Two things worth understanding.

• First: this is AI being used to accelerate attack development, not replace the attacker. The workflow is entirely human-driven. AI just makes it dramatically faster.

• Second: the specific EDR tools tested were Sophos, CrowdStrike, and Defender. We don’t yet know how successful the evasion was. Sophos notes the attacker’s claimed success rate appears to include AI hallucination. But the direction this is going is clear.

🟡 The World Cup starts in a week. The scammers have been ready for months

The 2026 FIFA World Cup kicks off a week today across the US, Canada, and Mexico. The FBI issued a formal warning last week: hundreds of fake FIFA websites are already live, designed to steal credentials, payment details, and personal information from fans buying tickets, merch, and streaming packages. BleepingComputer

The most sophisticated campaign runs across 300+ domains and includes a pixel-perfect replica of the official FIFA website, complete with a fake single sign-on flow and support in 11 languages. Typosquatted domains include fiffa[.]com, vww-fifa[.]com, and fake employment portals like jobs-fifa[.]com. Cybernews

The practical angle for MSPs: your clients’ employees are football fans. Some of them will be buying related stuff over the next seven weeks. A short, timely reminder about verifying URLs before entering payment details is worth sending this week… it’s the kind of proactive communication that shows you have their back.

🟢 Pax8 Beyond opens this Sunday in Salt Lake City

Pax8 Beyond 2026 opens Sunday at the Salt Palace Convention Center in Salt Lake City. Three days of sessions, vendors, and announcements covering Microsoft licensing, AI tools, cybersecurity stack consolidation, and MSP business growth. Pax8 Beyond

If you’re going, hit reply to let us know. It’s worth knowing that announcements from the show floor this weekend could affect Microsoft licensing pricing and AI product availability for MSPs. We’ll keep an eye on what comes out of it and cover anything significant early next week.

Great, that’s Thursday done. We’ll be back in your inbox in the morning, for the final time this week. Have a good one.

If you deploy Dashlane for clients, check your inboxes this morning.

Between May 31 and June 2, attackers ran a sustained brute-force campaign against Dashlane’s two-factor authentication, exploiting a fundamental limitation of TOTP codes.

A six-digit code gives only one million possible combinations per 30 second window. With enough automated attempts, that window is crackable. Dashlane’s security systems detected the attack and suspended affected accounts. But not before attackers successfully registered unauthorised devices on a small number of accounts and downloaded their encrypted vaults. BleepingComputer

Fewer than 20 personal plan users had vaults downloaded. Dashlane’s zero-knowledge architecture means those vaults remain unreadable without each user’s master password… so users with strong, unique master passwords are safe. Users with weak or reused master passwords are at risk of offline cracking attempts. Dashlane confirmed no breach of internal systems and says all affected accounts have been unsuspended. The incident status is currently “monitoring.” The Register

Two things worth doing today.

• First, if any of your clients use Dashlane and received a vault-risk email from Dashlane directly, treat that account as compromised and rotate the master password immediately

• Second, and more broadly, this incident is a useful reminder that TOTP 2FA is significantly weaker than most people assume. Where possible, push clients toward phishing-resistant authentication: passkeys, hardware security keys, or number-matching MFA rather than six-digit codes.

🟡 The 20 MSP just completed its 48th acquisition

The 20 MSP announced yesterday it has acquired four more managed service providers, bringing its total acquisition count to 48 since the company began its aggressive roll-up strategy. The 20 MSP

To put that number in perspective: last year, 466 separate MSP businesses were acquired worldwide: one every 19 hours, on average. The total value of those deals was $4.3 billion. And 2026 is on track to beat that.

The reason is straightforward. There’s a lot of money sitting in private equity funds that needs to be deployed, and MSPs with recurring revenue, happy clients, and clean books are exactly what those investors are looking for. Businesses that have been around for ten or fifteen years, built by founders who are starting to think about what comes next, are particularly attractive.

🟢 UK small businesses are taking their time with AI. That's not a problem… it's your opportunity.

MSP Channel Insights published a fresh piece yesterday on UK SMB AI adoption trends… and the headline finding is “cautious optimism”. MSP Channel Insights

Among small businesses with 50-99 employees, 37% have fully embraced AI and almost half are using it selectively for high-impact tasks. But below that, in the 1-49 employee range that makes up the bulk of most MSPs’ client bases, adoption drops sharply.

The gap between those two groups is almost entirely explained by one thing: access to someone who can help. Larger businesses have internal IT capacity. The smaller ones are luckier… they have you 😃

That’s hump day done. We’ll be back in your inbox tomorrow morning.

If you manage Windows Server domain controllers for clients, this needs attention today.

CVE-2026-41089 is a CVSS 9.8 stack-based buffer overflow in Windows Netlogon, the service that handles authentication across every Windows domain environment. Belgium’s national cybersecurity authority confirmed active exploitation on Friday. An attacker sends a specially created network request to a domain controller and can execute arbitrary code remotely without authentication. BleepingComputer

Security researchers say this flaw is a fast path to forest-wide takeover. Every domain controller, every account, and every client site that shares the same domain.

Microsoft disclosed the vulnerability on May 12 and originally rated exploitation as “less likely.” Active exploitation has now been confirmed. The official fix arrives with June Patch Tuesday on June 10 (eight days away).

Given what’s at stake, waiting is not recommended. Acros Security has released micropatches for legacy Windows Server versions (2008 R2, 2012, 2012 R2) for environments that can’t wait. Watch for unusual Netlogon service crashes, unexpected authentication failures, and anomalous domain trust errors as potential signs of exploitation. Help Net Security

🟡 Dutch police just took a 17 million-device botnet offline… did some of those devices belong to your clients' employees?

The Dutch National Police and NCSC announced last week they had dismantled Asocks, a massive residential proxy botnet running across 17 million compromised consumer devices globally. BleepingComputer

A residential proxy botnet works by silently enslaving ordinary consumer devices such as home routers, smartphones, IoT equipment. And then routing criminal traffic through them. The result: cyberattacks appear to originate from legitimate residential IP addresses, bypassing IP reputation filters and making detection significantly harder.

🟢 MSP Global is heading back to Barcelona in October… and it's taking over a theme park again

MSP Global 2026 returns to PortAventura theme park near Barcelona on October 21-22. 3,000+ MSPs and MSSPs will be there, for what the organisers describe as “the best parties the industry has ever seen.”

This year’s theme is “Serve Your Ecosystem”, focused on how MSPs can actively support and strengthen their wider partner and client ecosystems through AI, cybersecurity, compliance, and growth strategies. MSP Global

If you subscribe to their newsletter you can get a free registration code, saving €399 on the standard attendee pass.

Rollercoasters and business growth. There are worse ways to spend two days.

That’s your lot for Tuesday. We’ll be back in your inbox tomorrow morning.

A hacking group has accessed 4.9 million customer records with a well used playbook.

ShinyHunters breached Charter Communications (which operates Spectrum, the second largest cable and broadband provider in the US) by vishing a single employee and compromising their Microsoft Entra SSO account. From there, they pivoted straight into Salesforce and exported customer records. Charter refused to pay and some data is now publicly leaked. The Register

This is the same SSO-to-Salesforce attack chain used against ADT, Canvas, Carnival, and 7-Eleven this year. The pattern is now so established and so repeatable that ShinyHunters appear to have industrialised it.

If any of your clients use Microsoft Entra and Salesforce together, the conversation to have today is about whether an SSO account compromise would give an attacker direct access to their CRM.

🟡 Windows 11 26H1 drops on Friday… and your clients absolutely should not install it

Microsoft confirmed last week that Windows 11 version 26H1 begins rolling out on June 5 (this Friday). Before that notification lands on any client machine, here’s what you need to know. Windows Insider Blog

26H1 is not a standard feature update. It’s a hardware-optimised release built specifically for new devices launching in 2026 with next-generation silicon… think Qualcomm Snapdragon X2 Series and similar. It is explicitly not designed for existing devices and will not be offered through Windows Update to standard machines.

The problem is that any device that accidentally enrolls in 26H1, through Windows Insider settings or manual selection, cannot update to the next annual feature update later this year. Getting back to 25H2 requires a full reinstall.

For existing client devices, 25H2 and 24H2 remain the recommended versions and will continue receiving monthly security updates as normal. Worth checking that no client machines are enrolled in the Windows Insider Release Preview channel before Friday.

🟢 Two of the biggest events in the MSP calendar open this week: one in London, one in Salt Lake City

Infosecurity Europe opens tomorrow at ExCeL London (June 2-4) with the Channel Zone returning for its second year. Dedicated sessions for MSPs, MSSPs, and resellers covering regulatory pressure, skills shortages, and the expanding attack surface. If you’re in London this week, it’s worth a visit. Microscope

Then on Sunday, Pax8 Beyond 2026 opens in Salt Lake City (June 7-9) at the Salt Palace Convention Center. Three days of cybersecurity, AI, and business growth sessions alongside thousands of MSPs and vendors. Past attendees have described it as “the Super Bowl of user conferences.” Pax8 Beyond

If you’re heading to either, enjoy!

That’s your Monday. We’ll be back in your inbox tomorrow morning.

Kali365 is a phishing-as-a-service platform sold on Telegram for as little as $250 for 30 days. First seen last month, it’s already been used in hundreds of confirmed attacks across manufacturing, education, government, financial services, and healthcare. Every single victim was using MFA. Malwarebytes

The attack doesn’t steal passwords or intercept MFA codes. Instead it abuses Microsoft’s legitimate device code login flow… a real authentication feature designed for devices without keyboards, like smart TVs and printers.

The victim receives a convincing phishing email, is directed to a genuine Microsoft page, and enters a short device code. That single action hands the attacker a persistent OAuth token tied to the victim’s account. From that point, the attacker has ongoing access to Outlook, Teams, and OneDrive without ever needing to log in again… even if the victim changes their password.

The FBI’s IC3 published a formal advisory on May 21. The recommended mitigation: restrict or disable device code flow in your Microsoft 365 tenant unless it’s genuinely needed. For most SMB clients, it isn’t. Conditional Access policies blocking device code authentication are available in Entra ID. FBI IC3

🟡 The Secure Boot certificate deadline is now less than four weeks away (and you have to manually update Windows Server)

We featured this a few weeks ago when Patch Tuesday first included the certificate update. It’s worth a reminder today because the deadline hasn’t moved and many estates still haven’t applied it properly.

The original Secure Boot certificates, issued in 2011, expire on June 26. Devices that received the May or June Patch Tuesday updates are covered automatically. Devices that aren’t patched enter a degraded security state after June 26 and cannot receive future boot-level protections. 4sysops

Heads up: Windows Server does not apply this update automatically. Unlike desktop Windows, Server estates require manual deployment of the certificate rollout via Group Policy or WSUS.

🟢 The MSP 501 results are coming in June (which is coming on Monday)

The 2026 MSP 501 application window closed three weeks ago. As you read this, the results are being scored and verified, with winners set to be announced in June via a reveal webcast. All 501 winners will then be celebrated at the MSP 501 Awards Gala at MSP Summit in Orlando on September 30. MSP Summit

Now in its 19th year, the MSP 501 is the only industry ranking based on actual financial data (managed services revenue, recurring revenue percentage, year-on-year growth) rather than votes or nominations. If you applied this year, the wait is almost over. Hit reply and let us know, would you?

Right, we’re through another week. We’ll be back in your inbox on Monday morning when it will be JUNE. The year’s going so fast 🙁 Have a great weekend.

This is a scary one.

The Silent Ransom Group has been targeting US law firms since 2023 using phone-based social engineering. So, calling employees, impersonating IT support, and convincing them to open a remote desktop session. What’s new is when the phone call doesn’t work, they now send a person to visit. BleepingComputer

The FBI issued a Flash Alert on Tuesday, its highest severity designation, confirming active in-person intrusions as of Spring 2026. The operative walks into reception posing as an IT technician, talks their way to a workstation, plugs in a USB drive, copies the data, and leaves.

Over 100 attacks confirmed. 38 firms have already had their data leaked publicly after refusing to pay. The most high-profile victim is a firm with over $1.5 billion in annual revenue. The Register

Time to disable your clients’ exposed USB ports on workstations in reception areas or open-plan offices??

🟡 Microsoft's May patch broke domain controller lookups… but only if your server hostname is exactly 15 characters long

This is the most comically specific Windows bug in recent memory.

Microsoft confirmed on May 26 that KB5087537, part of this month’s Patch Tuesday, causes domain controller lookup failures on Windows Server 2016 systems… but only where the server hostname is exactly 15 characters long. BleepingComputer

When affected, DCLocator calls return ERROR_INVALID_PARAMETER, meaning applications, scripts, and administrative tools can’t locate a domain controller at all. It looks like a DNS problem, or a firewall problem, or a replication problem… until someone checks the hostname length.

No fix timeline from Microsoft yet. The suggested workaround is to rename the server to a hostname of a different length.

🟢 CrowdStrike and Google dismantled a botnet that was hiding inside a blockchain. Yes, really

Yesterday’s Glassworm botnet takedown is worth knowing about. Not because it directly affects most MSPs, but because of how the good guys had to approach it.

Glassworm has been targeting software developers since October 2025, hiding malware inside VS Code extensions, npm packages, PyPI libraries, and GitHub repositories. The clever part: its operators built four separate command-and-control channels specifically designed to survive takedowns. Including one that encoded instructions inside Solana blockchain transactions, which are immutable and can’t be deleted or seized by anyone. BleepingComputer

CrowdStrike, Google, and the Shadowserver Foundation had to hit all four channels simultaneously on Tuesday at 14:00 UTC… because taking out three of four would have left the botnet operational.

OK, that’s Thursday done. We’ll be back in your inbox tomorrow morning for the final time this week. Have a terrific day.

MFA was supposed to close the door on account takeovers, right? But it hasn’t… because attackers stopped trying to steal the second factor and started exploiting the human approving it instead.

This technique is called MFA prompt bombing. An attacker gets hold of valid credentials, easily sourced from breached password dumps, then repeatedly triggers push notification requests to the victim’s phone.

Dozens of them, sometimes hundreds. The goal is simple: wear the person down until they approve one just to make it stop. And it works. Regularly. The Hacker News

The more sophisticated version pairs the bombing with a vishing call. Someone rings the victim pretending to be from IT support, explains there’s a system issue, and asks them to approve the next notification to resolve it.

Three practical things you can do to protect clients from this:

1. Switch push-only MFA to number matching. The user has to type a code shown on screen into their phone rather than just tapping approve, which breaks the prompt bombing technique entirely

2. Set alert thresholds for repeated failed MFA prompts. Three or more in quick succession should trigger an investigation, not just a log entry

3. Tell clients explicitly: if they receive unexpected MFA requests they didn’t initiate, the answer is always no… and they should call your team immediately.

🟡 Dutch police seized 800 servers and arrested two people for running infrastructure that enabled global cyberattacks

A coordinated operation by the Dutch National High Tech Crime Unit last week took down one of Europe’s largest bulletproof hosting operations…seizing 800 servers and arresting two people running the infrastructure. Krebs on Security

Bulletproof hosting is the engine room of cybercrime. Servers specifically configured to ignore takedown requests and abuse complaints, rented to ransomware groups, phishing operations, and DDoS-for-hire services.

The seized infrastructure was being used by multiple active threat groups to host command-and-control servers, malware distribution points, and stolen credential databases.

🟢 The Boss wrote an AI app. Management love it. Now everyone has to use it…

This week’s BOFH column from The Register is required reading if you ever deployed software you didn’t choose, to users who didn’t want it, on behalf of a decision maker who didn’t understand it. The Register

That’s it for Wednesday. We’ll be back in your inbox tomorrow morning. Have a great day.

If you manage UniFi devices for clients, this needs attention today.

On May 22, Ubiquiti released emergency patches for three CVSS 10.0 vulnerabilities in UniFi OS… the operating system powering Dream Machines, Cloud Gateways, and network appliances found extensively in MSP-managed environments. All three can be exploited remotely without authentication and without user interaction. BleepingComputer

• CVE-2026-34908 allows an unauthenticated attacker to make sweeping unauthorised changes to the entire system

• CVE-2026-34909 allows file traversal; reading sensitive files and taking over underlying accounts

• CVE-2026-34910 enables command injection once network access is established.

Two further critical flaws were patched at the same time.

Censys is tracking nearly 100,000 internet-exposed UniFi OS endpoints globally. No active exploitation has been confirmed yet. But Ubiquiti products have previously been targeted by both state-backed groups and ransomware operators to build botnets and proxy malicious traffic. The window between patch release and active exploitation is getting shorter every month.

🟡 GitHub banned Nightmare-Eclipse. They've moved to GitLab… and set a new deadline of July 14

Following on from our recent coverage, GitHub has terminated the Nightmare-Eclipse account that hosted all six unpatched Windows zero-day exploits. Cybernews

The researcher has immediately moved to GitLab, reposted all six exploits, and issued a new warning. July 14 is now being flagged as a significant date, with hints at remote code execution vulnerabilities still in reserve. The “big surprise” previously threatened for June Patch Tuesday remains on the table.

Microsoft has not commented beyond acknowledging the individual CVEs as they’ve been disclosed. The exploits remain active, some of which remain confirmed working on fully patched Windows 11 systems, and are being used in real attacks linked to Russian-geolocated infrastructure.

June 10 is the next Patch Tuesday. What do you think is going to happen in the next couple of months?

🟢 Marketing had a brilliant idea. IT looked into it… and realised it had already been implemented

The Register’s On Call column last Friday featured a reader called Hamish, who worked at a British retailer. A senior member of the marketing team had a breakthrough insight: they should add Apple Pay to the company’s website. Management approved it enthusiastically and it landed on Hamish’s desk. The Register

Spoiler alert… the website already had Apple Pay. And had done for months!!

Hamish had the satisfaction of closing a ticket for a feature he hadn’t needed to build.

That’s it for today. We’ll be back in your inbox tomorrow morning. Have a great day.

Microsoft’s Digital Crimes Unit has dismantled Fox Tempest, a criminal operation that ran as a signing-as-a-service platform for ransomware groups.

Attackers would submit their malware binaries and receive back digitally signed versions that appeared to be legitimate software. The signed malware was then distributed disguised as installers for Microsoft Teams, AnyDesk, PuTTY, and Webex… yes, the exact tools your clients trust and download regularly. The Hacker News

Microsoft seized the Fox Tempest domain, took hundreds of virtual machines offline, and revoked over 1,000 fraudulent code-signing certificates.

The practical takeaway for your clients is how important it is to verify software downloads through official sources. These fake installers reach victims when someone clicked a sponsored result that wasn’t the official software.

🟡 AI agents are changing what clients expect from their MSP

Zendesk announced at its Relate conference this week a fundamental shift: from chatbot deflection to autonomous AI agents across its entire platform. And it was explicit that channel partners are central to making it work. Channel Dive

The SVP of partner sales told Channel Dive: “This is really a move from helping customers set up simple bots to helping them rethink how service gets done. It’s less about how do we deflect this ticket, and more about how we design an AI-powered service operation that actually resolves issues end to end.”

🟢 SpaceX just filed for the biggest IPO in history. And buried inside is something relevant to MSPs

SpaceX filed its S-1 with the SEC on Wednesday. It’s the formal start of what could be the largest IPO in corporate history, targeting a Nasdaq listing under the ticker SPCX in June. Fortune

The fun bit buried in the filing: Did you know that Starlink accounts for 70% of revenue?

And SpaceX plans to begin deploying AI compute satellites into Sun-synchronous orbit as early as 2028, effectively positioning space as the next data centre frontier, powered by solar energy. They’re calling it orbital AI infrastructure. Fancy.

The MSP angle: Starlink Business is already a growing line in MSP service catalogues (especially for clients in rural or remote locations, or as a backup connectivity solution).

If SpaceX goes public at the valuations being discussed, Starlink’s investment in its business product line is only going one way. Worth knowing about before your clients ask.

That’s your lot for this week. We’re having a day off on Monday as i’s a public holiday here in the UK. So we’ll be back in your inbox on Tuesday morning. Have a great weekend.

7-Eleven, which has 86,000 stores and 100 million loyalty programme members globally, officially confirmed this week that ShinyHunters breached its systems via its Salesforce environment.

It happened on April 8. 600,000 records containing personal information and internal corporate data were stolen. The group listed them on its leak site on April 17 with a ransom deadline. 7-Eleven didn’t pay. And so ShinyHunters is now selling the data for $250,000. BleepingComputer

The attack method is the one worth noting. ShinyHunters didn't exploit a Salesforce vulnerability. The intrusion came from outside the platform itself. This is exactly the same playbook used against ADT, Instructure, Vimeo, Medtronic, and Zara this year. Every one of those organisations had Salesforce and thought they were protected.

If any of your clients use Salesforce, or any major cloud CRM, the conversation to have today is about third-party integration hygiene and OAuth app permissions. The door ShinyHunters keeps walking through isn’t a Salesforce problem. It’s a configuration problem.

🟡 A multi billion ERP vendor just restructured its entire business to run through channel partners

Infor, one of the world’s largest enterprise software companies specialising in industry-specific ERP and cloud solutions, has announced it’s going all-in on the channel. Channel Dive

The restructuring means Infor’s resellers, MSPs, and system integrators will now be the primary route to market for its cloud ERP and AI products globally.

The company has launched a new partner programme on AWS Marketplace, and simplified its commercial model specifically designed to help channel partners win mid-market manufacturing, distribution, and healthcare accounts.

ERP has historically been a hard sell for MSPs… complex, long-cycle, and dominated by vendor direct teams. Infor is explicitly changing that model. If you have clients in manufacturing, food and beverage, healthcare, or distribution who are running legacy ERP systems, this is worth a look.

🟢 An AI was put in charge of reading names at a graduation. It skipped hundreds of them…

Helping to prove that AI isn’t ready to replace everything just yet…

An Arizona college replaced its human announcer with an AI system to read student names at this year’s graduation ceremony.

The AI skipped hundreds of names entirely, leaving students to walk across the stage in complete silence while their families waited to hear their moment called out. Students and families are furious. NBC

The college said it switched to AI to save money. Sometimes the old way is just fine.

Exciting stuff. We’re into Thursday, and that’s the highway to the weekend. Enjoy yourself today. We’ll be back in your inbox tomorrow morning.

Six exploits in six weeks. This is one very determined researcher.

Nightmare-Eclipse published MiniPlasma on Monday. It’s a privilege escalation zero-day that gives any standard user full system-level access on fully patched Windows 11 machines running the latest May 2026 updates.

BleepingComputer, Will Dormann and ThreatLocker all confirmed it works. Barracuda

The flaw targets the Windows Cloud Filter driver, the component that handles OneDrive and cloud-backed file sync. It was originally reported to Microsoft by Google Project Zero researcher James Forshaw back in September 2020. Microsoft said they fixed it in December 2020. The original proof-of-concept code still works without modification.

No patch until June 10 at the earliest. In the meantime, Barracuda’s profile of this researcher, published yesterday, is worth reading.

• The exploits are linked to Russian-geolocated infrastructure

• The researcher has promised “a big surprise” for June Patch Tuesday

• And has deployed a dead man’s switch with more exploits set to release automatically if certain conditions are met

🟡 Microsoft just eliminated bulk enterprise discounts. And MSPs are losing midmarket deals because of it

Channel Dive published yesterday that Microsoft’s decision to remove bulk enterprise agreement discounts is creating significant channel conflict… and the midmarket is feeling it most. Channel Dive

Customers are shopping around. Deals that MSPs considered locked are being lost as clients find lower per-seat pricing through direct or alternative routes. The elimination of volume discounts means the price advantage that used to reward loyalty and consolidation is gone. And clients are noticing.

The practical question for MSPs with midmarket Microsoft customers: when did you last have a proactive conversation about licensing costs and value? If the answer is “at renewal,” that might be too late.

The MSPs holding those relationships through this shift are the ones having the conversation before the client starts shopping around.

🟢 A hidden 100MB partition nobody thinks about is breaking Windows updates across client estates

File this under “the most classic IT problem in existence”.

Microsoft confirmed this week that the May Windows 11 update (KB5089549) is failing to install on some machines with a cryptic error that rolls back at 35% completion.

The cause: the EFI System Partition, a tiny hidden boot partition that Windows actively conceals from users, is running out of space. OEM firmware updates and old deployment images have quietly filled it over the years on affected devices. When the partition hits 10MB or less of free space, the security update fails. BleepingComputer

The fix is already out. Microsoft pushed a Known Issue Rollback automatically to most consumer and unmanaged devices, so a restart resolves it on most affected machines. For managed enterprise fleets, there’s a Group Policy mitigation available.

But the underlying issue doesn’t go away with the rollback. Every time Microsoft does more work in the boot environment: Secure Boot certificates, BitLocker, TPM measurements… this hidden partition gets a little fuller.

Okay, that’s Wednesday done. Have a great day. We’ll be back in your inbox tomorrow morning.

The 2026 Verizon Data Breach Investigations Report confirms what’s been building for years: identity is now the dominant attack surface.

Two thirds of all breaches investigated began with an identity-related attack: stolen credentials, session hijacking, or MFA bypass. Vulnerability exploitation jumped 34% year on year. And third-party breaches now account for 30% of all incidents, double the previous year’s figure. Verizon

Let’s look at the SMB numbers. Ransomware appeared in 88% of SMB breach incidents, compared to just 39% at large organisations. Your clients are not collateral damage in attacks aimed at big companies. They’re the primary target.

The report also confirms that 64% of ransomware victims now refuse to pay, up from 50% two years ago. And median ransom payments have fallen from $150,000 to $115,000. But the volume of attacks keeps climbing regardless.

🟡 71% of organisations had at least one identity breach last year. Most didn't spot it quickly

Another report… Sophos published its State of Identity Security 2026 report last week. They surveyed 5,000 IT and cybersecurity leaders across 17 countries, and it reads as a direct companion to the Verizon DBIR. Help Net Security

• 71% of organisations suffered at least one identity-related breach in the past 12 months

• The average organisation reported three separate incidents

• And only 24% continuously monitor for unusual login attempts… meaning the majority of these breaches had a significant undetected window before anyone noticed.

The specific number to act on: only 34% of organisations regularly audit or rotate service accounts. As AI agents multiply across client environments, each one creating new credentials and demanding persistent access, that gap is going to become significantly more dangerous.

If identity monitoring and service account hygiene aren’t already in your security stack conversation with clients, both reports published this week give you everything you need to start it.

🟢 The good guys just found 47 zero-days in three days… and got paid $1.3 million for it

Pwn2Own Berlin 2026 wrapped up on Saturday and it was a good week for the white hats.

Security researchers collected $1,298,250 in rewards over three days after finding and exploiting 47 unique zero-day vulnerabilities across Windows 11, Microsoft Exchange, Microsoft Edge, VMware ESXi, Red Hat Linux, and AI coding agents. Every single one of those vulnerabilities gets reported privately to the vendor, who then has 90 days to patch before any details become public. BleepingComputer

DEVCORE took the Master of Pwn title with 50.5 points and $505,000. The standout moment was Orange Tsai’s $200,000 payday for chaining three bugs to achieve remote code execution with system privileges on Microsoft Exchange.

The whole point of Pwn2Own is easy to lose in the headline numbers: this is organised, paid, responsible disclosure. Every bug found here is a bug that gets patched rather than sold to the highest bidder on the dark web. It is, in the most literal sense, hackers making the world safer. High five to the white hats!

Right, enjoy your Tuesday. We’ll be back in your inbox tomorrow morning. See you then.

If you manage on-premises Exchange for any clients, heads up on this.

Microsoft disclosed CVE-2026-42897 on Thursday. It’s a cross-site scripting vulnerability in Exchange Server 2016, 2019, and Subscription Edition that’s being actively exploited in the wild.

An attacker sends an email; if the recipient opens it in Outlook Web Access, arbitrary JavaScript executes in their browser session. From there, an attacker can steal session cookies, spoof content, or perform actions on behalf of the user. Exchange Online is not affected. BleepingComputer

A permanent patch is still in development. In the meantime Microsoft has issued automatic mitigations via its Exchange Emergency Mitigation Service. If you have EEMS enabled, it should have applied already.

🟡 New data: 98% of companies say AI is now a core managed services requirement

KPMG’s 2026 Managed Services Outlook, published last week and based on surveys of 1,224 senior leaders involved in managed services decisions, gives one of the clearest reads yet on where the market is heading.

98% of respondents say AI implementation is now a critical managed services capability. And AI management is expected to become the single largest area of managed services investment over the next two years, say 56% of respondents. ChannelE2E

How does that change your AI plans going forward?

🟢 A small Mediterranean island just became the first country in the world to give every citizen free AI

Malta, a country smaller than most cities with a population of just 574,000, announced on Saturday that it has struck a world-first deal with OpenAI.

Every Maltese resident and citizen gets a free year of ChatGPT Plus. The catch: they have to complete a government-backed AI literacy course first, developed by the University of Malta, covering what AI is, what it can’t do, and how to use it responsibly. OpenAI

No national government has done this before. Could you imagine this happening where you live??

Hokey doke, that’s Monday done. We’ll be back in your inbox tomorrow morning. See you then.

Do you remember BlueHammer, RedSun, and UnDefend? All Windows Defender exploits dropped by an anonymous researcher called Nightmare-Eclipse earlier this year. They were exploited in real attacks within days of publication.

This week Nightmare-Eclipse dropped two more unpatched zero-days: YellowKey and GreenPlasma.

YellowKey allows an attacker with physical access to a Windows 11 or Server 2022/2025 machine to bypass BitLocker encryption entirely. Plug in a USB drive, reboot into Windows Recovery Environment, enter a key sequence, and unrestricted access to the supposedly encrypted volume is granted. Independent security researcher Kevin Beaumont confirmed the exploit works. BleepingComputer

GreenPlasma is a privilege escalation flaw that hands system-level access to unprivileged users. The PoC is incomplete but security researchers say it’s enough of a starting point for a determined attacker to finish the job.

No patches yet. The researcher has claimed a “dead man’s switch” with more exploits ready to publish. Microsoft has not yet commented on the specific exploits. The Register

For clients with laptops, BitLocker alone is no longer sufficient. A PIN requirement on top of BitLocker is the recommended mitigation for YellowKey right now.

🟡 The most comprehensive snapshot of the MSP market just dropped. And the AI revenue gap is widening

GTIA published its State of the Channel 2026 global report this week, and of course, the headline is about AI. GTIA

AI is already generating meaningful revenue for a significant portion of MSPs.

• In the UK and Ireland, over a third of providers report that between 11% and 25% of their revenue now comes from AI-related products and services

• In North America, a quarter of MSPs self-identify as AI-driven, and are already generating AI revenue.

The gap between those MSPs and the ones still figuring out where AI fits is starting to widen. The report is free to access for GTIA members.

🟢 Someone just recovered $400,000 in Bitcoin they'd locked themselves out of 11 years ago. The story involves AI, an old college computer, and a very rude password

In 2015, a college student bought Bitcoin at $250 a coin, changed their wallet password while drunk, and immediately forgot what they’d typed.

The wallet sat untouched for over eleven years while they tried approximately 7 trillion password combinations across multiple recovery tools. Nothing worked.

In a last-ditch effort recently, they dumped the entire contents of an old college computer into Claude. Which found a forgotten wallet backup file predating the password change, identified a bug in the recovery tool that had been silently blocking every previous attempt, and fixed it.

The wallet unlocked. And five Bitcoin, now worth approximately $400,000, were recovered. What a story! Tom’s Hardware (fair warning: this contains some fruity language)

Hooray! We made it through to the weekend. Have a great one. We’ll be back in your inbox on Monday morning.