This week in IT & security
The NCSC and NZ Police warn that North Korean IT workers are landing remote jobs with New Zealand organisations, and list the red flags. Ten cyber agencies detail China-linked break-ins that began with flaws up to twelve years old. Microsoft has started switching off Exchange Web Services in Microsoft 365, and Copilot is getting usage-based billing that stays off until an administrator sets a spending policy.
This week in IT & security
Cyber Smart Week starts with a push to find the scam before it finds you. Microsoft’s 2026 Digital Defense Report finds phishing now opens nearly a quarter of intrusions. Outside guests are about to lose access to files shared through SharePoint’s old one-time codes, on a date Microsoft has just moved, and Office 2021 loses support on 13 October.
This week in IT & security
The NCSC’s Cyber Threat Report 2026 logs 369 serious incidents, names China the most persistent state actor and tells leaders to prepare for AI now. Three in four NZ businesses with 20–49 staff were hit in six months. A critical WordPress flaw is exploited within hours of its fix, and Microsoft relaunches Copilot around agents that work on their own.
This week in IT & security
Three New Zealand organisations disclose breaches in a fortnight, two of them through a supplier’s software. Microsoft ships its largest Patch Tuesday ever with two zero-days already in use. A swarm of AI agents compromises 440 PaperCut print servers in 48 countries, and Microsoft puts a 1 February 2027 retirement date on text-message MFA codes.
This week in IT & security
NCSC NZ warns that hacked websites are serving fake CAPTCHA pages which talk visitors into running malware themselves. Google ships an emergency Chrome fix for a zero-day already being exploited. Unit 42 details a Teams “help desk” vishing campaign that reached a domain controller, and Microsoft moves its Entra password-reset deadline to November.
This week in IT & security
PaperCut ships two emergency patches in eighteen hours after its print servers come under live attack. Commvault finds a third of ANZ ransomware victims paid and a third of those got nothing back. Windows 11 24H2 Home and Pro has six weeks of security updates left, and One NZ and 2degrees propose merging their mobile towers.
This week in IT & security
The NCSC's Q2 report shows losses down 52% but the hard incidents climbing. CISA confirms four flaws are already being exploited, including a critical SharePoint bypass, Microsoft's Exchange Web Services opt-out closes at the end of August, and a one-click Copilot flaw is patched after the AI was talked into explaining it.
This week in IT & security
Microsoft's August update fixes around 400 flaws, one of them a Windows zero-day already used by North Korean hackers. The NZSIS names espionage against Kiwi companies as a growing threat, Copilot changes web address on 18 August, and the NCSC tells businesses to vet the suppliers holding their data.
This week in IT & security
Attackers are taking over the remote-management software that runs business PCs — and the first patch didn't hold. Microsoft starts rolling out cross-tenant email recall, the Biometric Privacy Code grace period closes, and scammers begin cold-calling New Zealanders as the NCSC.
This week in IT & security
Attackers are stealing Microsoft 365 accounts through Microsoft's own real login page, passkeys become the default sign-in on 1 September as SMS codes head for retirement, NZ scam numbers jump again, and 85% of Kiwi firms back themselves to survive an outage while only 39% have tested it.
This week in IT & security
A pre-auth WordPress Core flaw chain is already being exploited, ransomware groups multiply to 146 with mid-sized firms most targeted, two Microsoft 365 deadlines quietly break old scripts and office scanners, and NZ's biometric privacy rules stop being optional on 3 August.
This week in IT & security
NZ scams keep climbing through 2026 (fake shops, tech-support cons and "scam-yourself" tricks), a perfect-10 zero-day hits SonicWall remote-access boxes under active attack, Microsoft makes Copilot a permanent part of its business plans, and the Privacy Commissioner's verdict on our health-data breaches lands.
This week in IT & security
Netsafe turns AI on the scammers with a platform that wastes their time, three web-app flaws (one in an AI tool) come under active attack, Microsoft 365 starts watermarking AI-generated video and audio, and why NZ's cyber laws are about to grow real teeth.
This week in IT & security
Tax-refund scams jump 44% as refund season peaks, an actively-exploited SharePoint Server flaw to patch now, Microsoft 365 adds built-in email security (and a price rise) from 1 July, and why infostealers now walk straight past MFA.
This week in IT & security
Microsoft warns of a hotel-phishing scam that slips past email filters, unveils its always-on "Scout" AI agent, NZ's cyber agency reports losses up 76%, and the government signals tougher cyber rules with director liability.
This week in IT & security
Google's scam advisory warns QR-code "quishing" is bypassing MFA, Copilot Cowork goes live on Anthropic's Claude, NZ widens its anti-scam net, and a new Privacy Act rule on indirect data collection.
This week in IT & security
Microsoft's biggest-ever Patch Tuesday, FIFA-themed fake-job phishing, a 1 July Microsoft 365 price rise, and a Deloitte study showing AI is paying off for Kiwi business.
This week in IT & security
The Canvas breach hits NZ universities, Microsoft prices AI for small business, the NCSC warns of an AI “vulnerability storm”, and the Privacy Commissioner pushes for big fines.
This week in IT & security
QR-code scams surge in NZ, CERT NZ joins the NCSC, Microsoft 365 security & price changes, and a new Privacy Act rule.
A new issue every week. Want it in your inbox?