ITGuys Team

10/26/2026

Updating WordPress will not fix this week's PHP vulnerability.

That surprises a lot of people. The two flaws, nicknamed PHP2Shell, sit in PHP itself, the engine underneath WordPress, Drupal, Joomla and most of the web. Your plugins, your theme and your security plugin all run on top of it. The patch has to come from whoever runs your server.

Here is the one move that matters: ask your hosting company or IT provider to confirm in writing that the October 21 PHP fixes are applied and that PHP was restarted afterward. Hosts patched at very different speeds, and "managed" doesn't always mean "done."

Two things worth knowing. Attack attempts are in the millions, but no successful compromise had been confirmed as of today. And if you're on PHP 8.1 or older, no official fix is coming, so that site needs an upgrade plan.

https://mynewitguys.com/php2shell-explained-what-happened-and-what-to-do-now/

10/21/2026

In Colorado, the 30-day breach notification clock does not start when you first notice something odd.

It starts at "determination," the point where there is sufficient evidence to conclude a breach actually took place. Before that, the law expects a prompt, good-faith investigation. After it, you have no more than 30 days to notify affected Colorado residents.

Two details worth knowing:
A leaked username or email plus a password can count as personal information on its own. No Social Security number needed.

If a breach is reasonably believed to have affected 500 or more Colorado residents, the Attorney General has to be told inside that same 30 days. If more than 1,000 residents must be notified, the nationwide credit bureaus are notified too. Knowing where the clock starts is the part worth settling before an incident, not during one.

We put the Colorado rules together with the statute and Attorney General sources linked, if you want to read further: https://mynewitguys.com/colorado-data-breach-notification-law/

10/13/2026

Windows Server 2016 reaches end of support on January 12, 2027.

Your servers won't stop working that day. They just stop receiving security updates, so every newly discovered vulnerability stays open.

You have three realistic paths:
- Upgrade to Windows Server 2025
- Buy Extended Security Updates (ESU) as a bridge, available for up to three years through 2030 (on-premises servers need Software Assurance or an equivalent server subscription)
- Move the workload to the cloud

Our new guide compares all three, explains who qualifies for ESU, and lays out a six-step plan you can start this week.

Read it here: https://mynewitguys.com/windows-server-2016-end-of-support/

Not sure what is still running in your office? ITGuys can inventory your servers and help you choose a path before the deadline.

09/30/2026

On October 13, Microsoft stops issuing security updates for several products at once:

• Office 2021 and Office LTSC 2021 (no extension, no paid extended updates)
• Windows Server 2012 and 2012 R2 (final year of Extended Security Updates ends)
• Windows 11 24H2 Home and Pro

Everything will still open on October 14. It just stops being patched, and that is how most ransomware finds its way in.

Of the three, the servers are the highest risk, and they take the longest to migrate. If you have any 2012 servers, the time to start is now.

09/22/2026

Most ransomware attacks don't start with a hacker breaking through a firewall. They start with an invoice email that looks completely normal.

We built an interactive breakdown of a realistic small business ransomware attack — a fictional 32-person firm, a phishing email, and 9 days from click to crisis. Toggle the story between "Unprepared" and "Protected" and watch the same attack hit a wall at 7 different points.

If you want to see where your own business would stand in that timeline, this is worth 7 minutes.

https://mynewitguys.com/ransomware-attack-timeline-small-business/

09/18/2026

A Colorado town lost over $1 million a few years back because of one skipped phone call.

Someone filled out a form on the town's own website asking to change how a contractor got paid. Nothing about it looked unusual. Staff checked some of the details, but nobody picked up the phone to confirm it with the actual contractor. By the time the bank flagged it as fraud, the money was already gone.

No hacking. No malware. Just a normal-looking request that nobody verified.

That's still how most of these scams work, and it's a big part of why Colorado businesses lost over $355 million to internet crime last year. We pulled the FBI's latest Colorado numbers and broke down what small businesses here can actually do about it:

Colorado ranks 7th nationally per capita for cybercrime. See what the FBI's latest data means for local small businesses, plus the state's breach notification rules.

09/09/2026

Most business email compromise cases don't involve a hack. No malware, no breached network, no stolen password. Someone just forges the "From" field on an email and asks for something normal: an updated invoice, a routine banking change, a wire before end of day.

Email was built in the early 1980s with no way to verify who actually sent a message. That gap is still open at a lot of companies, and attackers know it. In 2025 alone, the FBI logged nearly $3.1 billion in reported BEC losses, most of it moved by wire before anyone caught it.

The fix isn't one thing. It's DNS-level authentication (SPF, DKIM, DMARC) closing the technical gap, paired with a simple habit: verify any payment change through a second channel before you act on it. Neither one alone is enough.

We wrote up how this plays out in practice, including a case where a spoofed vendor email cost a city government $6 million: https://mynewitguys.com/email-spoofing-business-email-compromise-guide/

09/03/2026

Try this experiment: open ChatGPT or Perplexity and ask it to recommend a business like yours. See if you actually get named.

For a lot of small businesses, the answer is no, even ones that rank well on Google. A recent benchmark study of 200+ U.S. service businesses found the average company scores just 30 out of 100 on AI visibility. Ranking on page one of Google only translates to a ChatGPT mention about 6 times out of 10.

Here's the part worth knowing before you spend a weekend "fixing" it: a rigorous 2026 study from Ahrefs tracked nearly 1,900 pages that added schema markup, the technical fix most commonly pitched as the AI citation shortcut, and found it produced no meaningful increase in AI citations on any platform. Google's own documentation backs this up, stating plainly that no special markup is required to appear in AI Overviews.

What actually seems to move the needle is less technical and more fundamental: stating your answer plainly and specifically near the top of the page, staying consistent across every listing of your business, and earning genuine third-party mentions instead of just describing yourself well on your own site.

We broke down what the current research actually shows, including a quick self-check to see where your own business stands. Further reading: https://mynewitguys.com/ai-search-visibility-small-business-guide/

08/26/2026

Quick gut check for business owners: could you list every piece of software your company currently pays for, right now, off the top of your head?

Most owners can't get past the tools they personally use. Marketing has its own subscriptions. Sales has its own. Ops has its own. Someone signed up for a free trial eight months ago that became load-bearing infrastructure and nobody ever told finance.

None of that happens because anyone is careless. It happens because buying software got so easy that it stopped feeling like a decision. A credit card and an email address is all it takes now, and that convenience is exactly what makes it invisible.

The part that actually costs businesses money and exposure isn't the sprawl itself, it's what the sprawl hides. Duplicate tools nobody remembers to cancel. Access nobody remembers to revoke when someone leaves. Vendor relationships nobody in the building could describe if asked.

The fix isn't a lockdown. It's a habit: know what you're running, know who owns each tool, and build offboarding around a real list instead of a memory exercise. That one habit closes more risk than most security spending does.

We put together a deeper look at where this goes wrong and how to get ahead of it: https://mynewitguys.com/blog/saas-sprawl-small-business-risks

08/17/2026

Most offboarding checklists cover the visible stuff: collect the laptop, disable the email account, done.

But access doesn't live in one place anymore. It's spread across a dozen SaaS logins, shared credentials, forwarding rules, and sessions that never got logged out. Unless someone kept a running inventory of every account a person was ever given, IT is stuck trying to reconstruct it from memory when that person leaves.

That's usually the actual failure point, not carelessness, just structure. Access gets granted incrementally over months or years. It should get revoked the same way, deliberately and all at once, not reassembled after the fact.

The fix isn't complicated: log access as it's granted, cut it off at the identity layer first (this is where single sign-on earns its keep), and do a short follow-up review a few weeks after someone leaves to catch what slipped through.

https://mynewitguys.com/employee-offboarding-security-checklist-small-business/