Cybersecurity Archives - World Technology: Managed IT, Cybersecurity & AI Consulting

Using AI at Work? Be Prepared

Starting Monday, Oct 26, Regeringskansliet, the office that serves Sweden’s prime minister and ministries, blocks ChatGPT and Claude on staff work computers and points staff to the AI services it has approved, including Microsoft’s Copilot. Swedish Radio’s news program Ekot reported the change on Oct 23 (Sveriges Radio, in Swedish).

What Ekot reported

The block: from Monday, ChatGPT and Claude can no longer be reached from staff work computers.
Approved tools: staff are pointed to the AI services Regeringskansliet has approved, including Microsoft’s Copilot.
Copilot security: after a review, Regeringskansliet also raised security in Copilot. The press office won’t share details, citing security.
In-house platform: some staff keep access to ChatGPT and Claude through an AI assistant platform Regeringskansliet developed itself.

Digitalization director Mikael Wettercrantz declined an interview, but wrote on the staff intranet that using AI services without an agreement can have “consequences for our information security” (our translation).

What this means for your business

Whatever AI tools your team uses, being prepared starts with three things:

Know which AI tools your team uses, including free apps and browser add-ons.
Know what data goes into them, such as customer details, contracts or financial files.
Know whether each tool is under a business agreement, or sits on a personal account.

Personal accounts vs. business plans

A free or personal AI account and a business plan tied to work accounts aren’t the same thing:

Personal or free accounts sit under consumer terms, are controlled by the employee, and your business has no view of what goes in.
Business plans come with business terms, admin controls over who uses what, and clear rules about your data. Each major vendor says it doesn’t train its models on business data from these plans by default:
- Microsoft 365 Copilot: prompts, responses and data accessed through Microsoft Graph aren’t used to train foundation models, and Copilot Chat includes enterprise data protection for eligible work accounts (Microsoft).
- ChatGPT Business: follows OpenAI’s Business Terms, and “OpenAI won’t train on your workspace’s data” (OpenAI Help Center).
- Claude Team and Enterprise: model training is listed as “none by default” (Anthropic).
- SpaceXSI’s Grok Business: lists “no training,” and SpaceXSI says it doesn’t use business prompts or answers to train its models unless you agree to it (SpaceXSI, Enterprise FAQ).

Which plan fits depends on the tools your team already uses. If your business runs on Microsoft 365, it’s also worth knowing which apps, AI tools included, are connected to your account. Our post Which Apps Can Get Into Your Microsoft 365? explains why.

Free Shadow-AI Assessment

“Shadow AI” means AI tools staff use without the business knowing or approving them. Our free Shadow-AI Assessment for small and mid-size businesses starts with three questions:

Which AI tools are your staff using?
What data goes into them?
Which ones have a business agreement?

We’ll help you answer them and decide which tools to keep, which to move to a business plan and which to stop using.

World Technology started in Lawrenceville and Gwinnett County in 2005 and now supports businesses across the US, in Europe and globally. Call 678-985-8222, email contact@wtcomputers.com, or reach us through our contact page.

— WT Team

Sources: Sveriges Radio / Ekot, Oct 23, 2026 (Swedish; translations ours), Microsoft, OpenAI, Anthropic, SpaceXSI, SpaceXSI Enterprise FAQ.

SafePay Ransomware: 5 Things CISA and the FBI Say to Check

On Oct 21, 2026, CISA, the FBI, the U.S. Secret Service and international partners put out a joint warning about the SafePay ransomware group (CISA news release). The full advisory, #StopRansomware: SafePay Ransomware (AA26-293A), says SafePay was among the most active ransomware groups in 2026 and has hit at least 600 victims across North America, South America, Europe and Australia (CISA advisory AA26-293A).

How SafePay gets in

According to the advisory, SafePay actors usually get in by stealing or guessing passwords, by phishing, and by exploiting known holes in firewalls, VPNs and other internet-facing systems.

Once inside, they create or take over accounts, use normal IT tools to move around, and turn off security tools. They go after backups too: the agencies saw them reset network storage that held backups, and in some cases delete all network-attached backups. Then they steal data, lock files and demand payment, with phone calls and threats to publish the stolen data (CISA advisory AA26-293A).

5 things to check

The agencies list many steps. These five are the ones that matter most for small and mid-size businesses:

Patch internet-facing devices first. Firewalls, VPNs and anything else reachable from the internet. CISA calls timely patching one of the most efficient and cost-effective steps you can take.
Require multifactor sign-in. Especially for webmail, VPNs and admin accounts.
Keep offline backups, and test them. Backups should be encrypted, can’t be changed or deleted, and should actually restore.
Separate your network. Segmenting limits how far ransomware can spread.
Watch your accounts. Look for new, unused or unknown accounts, and keep admin rights to the people who need them.

Get a free ransomware readiness check

World Technology started in Lawrenceville and Gwinnett County in 2005 and now supports businesses across the US, in Europe and globally, with network and server monitoring, security and backups. Not sure where your business stands on these five? Get a free WT ransomware readiness check.

Call 678-985-8222, email contact@wtcomputers.com, or reach us through our contact page.

PHP2Shell: Ask Your Web Host If You’re Patched

If your business website runs on PHP or WordPress, there’s one simple question worth asking your web host or IT provider today: “Have you applied the latest PHP security update?”

Here’s what happened and what to ask, in plain words.

What happened

On October 21, 2026, the PHP project released security updates for two critical flaws, nicknamed “PHP2Shell”:

CVE-2026-109618, a flaw in how PHP handles running out of memory
CVE-2026-109619, a flaw where leftover data from one web request can be reused by a later one

According to the PHP security advisory, both can allow an attacker to run code on a web server without logging in. PHP says all installations serving web requests are at risk, including common setups like PHP-FPM, Apache with mod_php and LiteSpeed. PHP rates both critical, 9.2 out of 10 (see the NVD records for CVE-2026-109618 and CVE-2026-109619).

The same day, CISA, the U.S. cybersecurity agency, urged organizations to patch right away, starting with internet-facing systems.

Why it matters for your business

PHP runs many business websites, and WordPress is built on it. You usually can’t tell which PHP version your site uses just by looking at it. CISA also notes that PHP is often built into other software, so it may be running in places you would not expect.

AI is speeding this up

OpenAI says AI helped find these flaws, and it expects similar findings “to increase sharply in the coming months” (OpenAI). The takeaway: updates need to go on fast, and someone needs to keep watching your servers.

The good news: the fix is a standard update. Most of the work sits with whoever hosts or manages your site. Your part is making sure they’ve done it.

The fixed versions

PHP’s fixed versions are:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

Linux distributions and long-term support vendors also ship their own patched packages, so a host may show a different version number that still includes the fix. PHP 8.1 and older no longer get updates from the PHP project.

What to ask your web host or IT provider

Copy this list into an email:

Which PHP version are our websites running?
Has it been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor package that includes the PHP2Shell fixes?
Do any other systems we use run PHP, such as portals, forms or booking tools? Are those updated too?
If we’re on PHP 8.1 or older, what’s the plan to upgrade?
Are you watching for unusual activity on our server? CISA recommends monitoring for suspicious activity.

If the answers are clear and confirmed, you’re in good shape. If you’re unsure who manages your site, that’s worth sorting out now.

How World Technology helps

World Technology started in Lawrenceville and Gwinnett County in 2005 and now supports small and mid-size businesses across the US, in Europe and globally, helping them keep their systems updated and secure. If you’d like help checking your website or asking the right questions, we’re glad to help.

Free website check: we’ll confirm which PHP version your site runs and whether it has the fixes.

Call us at 678-985-8222 or email contact@wtcomputers.com.

Sources: PHP security advisory, CISA alert, OpenAI, NVD CVE-2026-109618 and CVE-2026-109619.

— WT Team

Which Apps Can Get Into Your Microsoft 365?

Most small businesses think about passwords and who on staff can log in. But people aren’t the only ones with access to your Microsoft 365. Apps have access too.

Backup tools, management tools, and security tools often connect straight to your email, files, and Teams. That’s how they do their jobs. It also means that if one of those apps is misused, someone could get in without ever touching a password.

What Happened

This month, the security company Huntress reported that a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised. Huntress confirmed it was being used to get into customers’ Microsoft 365 environments without permission.

A backup service needs broad access. It reads mail, files, Teams, and directory data so it can copy them. Anyone holding that app’s credential gets the same access. And because it’s an app signing in, not a person, there’s no user and no multi-factor prompt to stop it.

Huntress also saw an attacker use one of these apps to give itself admin rights. It then added new credentials to other apps in the same account to keep a way back in.

Check Your Own Account

You don’t have to use this product to learn from it. Every business on Microsoft 365 should know which apps are connected. Here’s how to look:

Sign in to the Microsoft Entra admin center with an admin account.
Go to Enterprise applications.
Look through the list. Ask yourself: do we know this app? Do we still use it?
If you use ConnectWise or SkyKick tools, search for “SkyKick” and “ConnectWise.” In older accounts, they may show up as “SkyKick Cloud Manager.”
For an app you need to stop, open Properties and set “Enabled for users to sign-in” to No.

Huntress advises disabling these apps, not deleting them. Deleting removes the consent, and you’d have to set it up again to restore service. Disabling a backup app pauses new backups, but your email, files, and sign-ins keep working.

Huntress also notes that disabling an app does not remove credentials an attacker may have already added. So it suggests a few more checks:

Review the client secrets and certificates on your Enterprise applications and App registrations. Remove anything you didn’t create.
If one of these apps holds an admin role you never gave it, remove that role after the app is disabled.
In the sign-in logs, check the Service principal sign-ins tab. The default tab only shows user sign-ins.

Not Sure Where to Start?

This can feel like a lot. That’s okay. Many Lawrenceville and Gwinnett businesses set up Microsoft 365 years ago and never looked at the app list again.

We help local businesses with managed IT and Microsoft 365 every day. Call us at 678-985-8222, or stop by 561 West Pike Street, Suite 100A, Lawrenceville, GA 30046. We’ll help you see what’s connected and what isn’t needed anymore. Learn more at wtcomputers.com.