Small Town Sysadmin
Free CJIS checklist

Small Office IT Watch · Sample issue

From smalltownsysadmin

Subject Run Windows Update and check your Apple devices

Plus a fake farm equipment dealer scam, and a 10-minute fix: two-step sign-in for Gmail.

Sample issue. This is what a real Monday issue of Small Office IT Watch looks like, built from the week of October 8 to 14, 2026.

Two updates matter this week. Microsoft fixed a Windows flaw that attackers are already using, and Apple devices that skipped the late-September update are still exposed to another one. Plus a fake-dealer scam and a 10-minute email fix.

Patch now

Run Windows Update on every office PC this week

Who it affects: every Windows 10 and Windows 11 computer, and any Windows server. Microsoft’s October 13 updates fix a Windows flaw it says attackers are already using. A booby-trapped file or link can slip past Mark of the Web, the “this came from the internet” tag that makes Windows warn you before opening a downloaded file. Someone still has to open the file or click the link, so think email and chat messages. CISA, the federal cybersecurity agency, added it to its list of actively exploited flaws the same day.

What to do:

  1. On Windows 11, open Start > Settings > Windows Update and click Check for updates. On Windows 10, it’s Start > Settings > Update & Security > Windows Update.
  2. Install what it finds and restart when asked.
  3. Windows 10 stopped getting free updates on October 14, 2025. A Windows 10 PC only gets this fix if it’s enrolled in Extended Security Updates (ESU). If it isn’t, put that PC on the replacement list.

How long: a few minutes of your time per PC, plus the install and restart. Start it before a break, not before a meeting.

Microsoft’s notice for this flaw

Update every iPhone, iPad and Mac (if you haven’t since late September)

Who it affects: anyone with an iPhone, iPad or Mac, including personal phones used for work email or sign-in codes. Apple fixed a flaw where opening a booby-trapped image or document could let an attacker run their own code on the device. Apple says it was used against specific targeted people, so most offices aren’t the likely target, but the update takes minutes.

What to do:

  1. iPhone or iPad: plug it in, connect to Wi-Fi, then go to Settings > General > Software Update and install what’s listed. You want iOS 26.7.1 or newer (version 27 is also fine).
  2. Mac: Apple menu > System Settings > General > Software Update. You want macOS Tahoe 26.7.1, Sequoia 15.8.1, or newer.
  3. While you’re there, turn on Settings > General > Software Update > Automatic Updates on each phone and iPad.

How long: about 5 minutes of your time per device, plus install time. Leave it plugged in.

Full alert

If you have an IT company or MSP, forward them this:

  • Ivanti Connect Secure VPN: a login bypass exploited since early October. Patch, and check for compromise, because a clean integrity check doesn’t prove the box is clean. Full alert
  • Palo Alto Networks firewalls and Panorama: an exploited flaw gives a logged-in attacker full control of the firewall. No workaround, so upgrade PAN-OS and lock down who can reach the management page. Full alert

The scam going around

Fake farm equipment dealers. The FTC warned on September 15 that scammers are posing as farm equipment businesses. It starts with a tractor ad on social media at a good price, or a search result that looks like a dealer you’ve bought from before. Once you reach out, they send a real-looking purchase agreement and invoice and ask for thousands of dollars, usually by wire transfer, as a deposit or full payment. They even set a delivery date. The equipment never comes. They stop answering or blame a problem with the delivery truck.

It works because the paperwork looks normal and the name is one you trust. The fake part is the contact details: the FTC says top search results can be paid ads that scammers use to pose as real businesses. Any office buying big equipment online, like a contractor shopping for a used skid steer, can hit the same trap.

The rule that beats it: before you send money, call the dealer on a number you already have or one from an invoice you paid before, not the number in the ad or the top search result. And don’t pay anyone who insists on wire transfer, gift cards, cryptocurrency or a payment app. FTC notes that money sent those ways is nearly impossible to get back.

If you spot one, report it at ReportFraud.ftc.gov.

Your 10-minute fix

Turn on two-step sign-in for your Google account. Two-step sign-in means a stolen password isn’t enough: whoever signs in also needs a code or a tap on your phone. Start with the inbox your bank and payroll send password resets to.

  1. Go to myaccount.google.com and select Security & sign-in.
  2. Under How you sign in to Google, select Turn on 2-Step Verification and follow the steps.
  3. When Google offers backup codes, print or download them and store them somewhere safe that isn’t your email. They get you back in if you lose your phone.
  4. Never give a backup code or a sign-in code to anyone who asks for it, including someone who says they’re from Google.

On Microsoft 365 instead? Ask whoever has admin access: “Are security defaults turned on for everyone?” That free setting covers the whole office at once.

Full guide: Turn on two-step sign-in

Sources

You’re getting this because you subscribe to Small Office IT Watch from smalltownsysadmin. Questions or a scam you want checked? Just reply. This is general information for small, non-regulated offices, not legal or compliance advice.

Get this every Monday

$8/month or $80/year. Cancel anytime.

Subscribe