The biggest cybersecurity lesson from the past week is simple: installing security updates quickly matters more than ever.
Between September 10 and September 17, several serious vulnerabilities moved from being technical warnings to vulnerabilities actively used by attackers. Remote-access software, development platforms, virtual infrastructure and smartphones were all affected.
For individuals and small businesses, there is no reason to panic. But there are several practical lessons worth acting on.
Remote-Access Software Is a Valuable Target
One of the most important warnings involves ConnectWise ScreenConnect.
Attackers are actively exploiting CVE-2026-84869, a critical ScreenConnect vulnerability. The weakness can allow an attacker with basic privileges to transfer or execute files through an active remote session without proper authorization. The vulnerability is fixed in ScreenConnect 26.6.5 and later. More than 1,000 vulnerable ScreenConnect systems were still reportedly exposed to the internet when the warning was issued.
This is particularly important because remote-support software is intentionally designed to control computers. If attackers compromise that software, they may gain an extremely powerful position.
Lesson: If your business uses remote-management software, treat its security updates as urgent. Do not expose management systems directly to the internet unless necessary, use MFA for administrator accounts, and regularly remove accounts that are no longer needed.
Ransomware Is Exploiting VMware Infrastructure
Another serious development concerns VMware vCenter Server.
CISA says ransomware groups are now exploiting CVE-2026-59310, a critical vulnerability affecting vCenter. The vulnerability was actually patched in July, demonstrating an important cybersecurity problem: releasing a patch does not protect organisations that never install it.
Virtualization infrastructure can be especially valuable to criminals because one physical server may host many virtual servers. Compromising the management layer can therefore create a much larger problem than compromising one employee laptop.
Small businesses using managed IT providers should consider asking a simple question: Are our internet-facing servers and virtualization systems fully patched?
You do not need to understand every CVE yourself. Your IT provider should be able to answer.
GitLab Vulnerability Shows Why Secrets Need Protection
Attackers are also exploiting a maximum-severity vulnerability in GitLab.
CVE-2026-85706 can allow an unauthenticated attacker to read sensitive files from vulnerable GitLab servers. That could potentially expose credentials, configuration information and other secrets. GitLab released patched versions, and CISA subsequently classified the vulnerability as actively exploited.
This connects to another campaign reported this week: attackers have been scanning internet-exposed Vite development servers looking for cloud credentials and configuration information associated with services such as AWS and Azure.
The broader lesson is extremely useful for developers and businesses:
A password or API key stored inside the wrong file can become the beginning of a much larger attack.
Developers should avoid putting passwords, API keys and cloud credentials directly into source code. Development servers should also not be publicly exposed unless there is a genuine reason.
Android and Pixel Users Should Update
Cybersecurity is not only a business-server problem.
Google released its September Pixel security update after identifying numerous vulnerabilities. Google says CVE-2026-58704 may already be experiencing limited targeted exploitation. The bulletin also includes critical remote-code-execution vulnerabilities affecting Pixel components.
The wider September Android security bulletin also addresses a critical System vulnerability that could potentially enable remote code execution without requiring user interaction. Devices with a security patch level of September 5, 2026 or later address the bulletin’s issues.
For Android users, check:
Settings → Security/Privacy → System & updates
The exact wording varies between manufacturers.
What Should You Do This Week?
You do not need expensive cybersecurity software to respond to most of these lessons.
Start by updating Windows, macOS, Android, iPhone applications, browsers and other software. Businesses should give much higher priority to systems exposed directly to the internet, including VPNs, firewalls, remote-access platforms, web servers and administration systems.
Use MFA wherever possible, particularly for email, cloud services and administrator accounts.
Businesses should also maintain protected backups. A backup permanently connected to the same network may itself become encrypted during a ransomware attack.
Finally, remove services you no longer need. Every forgotten server, old account or exposed development system creates another possible entrance.
The Bigger Lesson
This week’s incidents demonstrate an important change in cybersecurity.
The time between vulnerability disclosure and real-world attacks can be extremely short. Waiting several weeks to install a critical security update may therefore be much riskier than it once was.
Cybersecurity does not require knowing about every new hacker group or vulnerability.
For most people and small businesses, the strongest strategy remains surprisingly simple:
Update quickly. Use MFA. Protect credentials. Reduce internet exposure. Keep reliable backups.
Attackers continue developing new techniques, but consistently applying these basic protections can close many of the doors they depend on.
