September IT Roundup: Record Patches and a Ransomware Warning Sign for Smaller Businesses
A record-breaking Patch Tuesday and new data showing ransomware increasingly hitting smaller businesses, with practical priorities for both.
Two stories worth your attention this month. Microsoft just shipped its biggest security patch batch ever, and new data shows ransomware is increasingly hitting smaller businesses, not just the big ones. Here’s what actually matters in both, and what to do about them.
Microsoft’s Record Patch Day
Microsoft released fixes for roughly 970 security problems in one update, the largest single batch in the program’s history, according to CrowdStrike and SecurityWeek. That number sounds alarming on its own, but it’s not really the story. The story is knowing which of those fixes matter most, and making sure those get applied first.
Two flaws hackers are already using. Two of the problems in this batch aren’t just theoretical risks. Attackers are actively using them right now (CVE-2026-81963 and CVE-2026-85880, for anyone who wants to look them up). In plain terms, both flaws let someone who has already gotten a small foothold on a computer, say through a phishing email or a shady download, jump from limited access to full control of that machine. That’s exactly why they get fixed first, ahead of everything else in this update.
A bigger risk hiding in plain sight. At least 17 of the fixes are for basic background services that a lot of business networks run without thinking twice about, things like DNS (which turns website names into addresses computers can use) and DHCP (which hands out network addresses to devices). The problem here is that an attacker doesn’t need a stolen password or a click from anyone to use these, just the ability to reach the service over the network. If any of those services on your network are reachable from outside, this is worth asking your IT team or provider about directly.
One “click” you don’t even have to make. Twelve fixes are for Microsoft Office, and what makes these different is that a person doesn’t have to open a suspicious file to get infected. Just previewing it in Outlook or File Explorer is enough to trigger it.
Ransomware Is Creeping Down Market
New data reinforces why the patching story above matters. According to risk firm Black Kite, ransomware disclosures hit 7,551 victims in 2026, up nearly 25% from the year before, the fourth straight year of record numbers.
The bigger shift is who’s getting hit. Companies with $1 million to $5 million in revenue nearly doubled their share of reported victims this year. For years, the assumption was that ransomware groups mostly went after big companies with big budgets. That’s changing, likely because smaller organizations are often easier targets: fewer defenses, smaller IT teams, and less pressure from cyber insurers or regulators to prove things are locked down.
One stat from the report stands out. 43.5% of ransomware victims still had critical, unpatched vulnerabilities even after their incident was considered resolved. In plain terms, a lot of businesses fix the immediate emergency (systems back up, backups restored) without actually closing the hole that let the attacker in in the first place. Same lesson as the patch numbers above: this isn’t a one-time task, it’s an ongoing habit.
What This Actually Means for You
A few practical takeaways, whether you manage your own IT or work with an outside provider:
- Confirm this month’s Microsoft updates are actually installed.
- Ask specifically whether your network’s background services (DNS, DHCP, and similar) are reachable from outside your network. If so, those updates deserve priority.
- It’s smart to be cautious with unexpected files, but caution alone won’t fully protect against this month’s Office issue. The patch does the real work.
- If your business (or a client’s) has ever had a security incident, don’t treat it as closed once the immediate fire is out. Go back and confirm the original vulnerability was actually fixed, not just the symptom.
- Nobody should be reading through 970 individual fixes by hand. Good patch management tools exist specifically to sort out what applies to your systems.
Patch batches and ransomware numbers both keep climbing every year. The response that still works is the same one that’s always worked: fix what’s already being exploited first, fix what’s exposed second, and treat “resolved” as a checkpoint, not a finish line.