The ThinkOpen Brief
Five things worth knowing, every Monday.
We read the security and AI news so you don't have to. One short email, written for the people who run the business, not the people who run the servers.
- Five stories, one take each. What happened and what it means for a business your size.
- One original from our engineers, when we have one worth sending.
- Every issue is checked against its sources before it goes out. A line that doesn't match its story doesn't ship.
- One click to leave. No login, no "are you sure" maze.
We'll email you a link to confirm. We never share or sell your address, and the Brief is the only thing we send to it.
The ThinkOpen Brief · Oct 26
One vendor login, 173 Microsoft 365 tenants breached
Two unpatched critical PHP flaws allow full remote takeover of websites.Both vulnerabilities score 9.2 out of 10 and let an attacker run any code on your server without logging in.
One stolen ConnectWise login opened 173 separate Microsoft 365 accounts.Attackers used a single compromised ConnectWise credential to sign in to 173 M365 tenants, no malware required.
AI is now coaching criminals through your help desk phone calls.Fraudsters use AI tools to sound more convincing and guide them past identity questions in real time.
Windows Server 2016 loses security updates in January 2027.Microsoft has confirmed the end-of-support date, leaving any remaining Server 2016 machines without patches after that point.
AI-written phishing emails now defeat filters that look for awkward writing.Proofpoint reports that generative AI removes the grammar mistakes and odd phrasing that behavior-based filters and staff were trained to catch.