It is Friday, May 15, 2026, and we are heading into a nice spring weekend. Before you head out to enjoy the weather, it is a good idea to take a quick look at what happened in the digital world this week. There were a few big updates and some new trends that small business owners should know about.
Security can sometimes feel like a lot to handle, but it is usually just a matter of keeping things updated and staying aware of the common tricks people use. You do not need to be a computer genius to keep your business safe. You just need to stay consistent with the basics. This week, most of the news is about things you can fix with just a few clicks or a quick phone call to your service providers.
Some new security items in Microsoft 365
Microsoft 365 is the backbone of most small businesses. Because so many people use it, it is often a target for new discoveries. This week, researchers found a few things that you should be aware of.
One of the items is called CVE-2026-41089. This is what experts call a "wormable" risk. That sounds a bit scary, but it just means that if one computer on a network gets this specific bug, it can spread to other computers automatically without any person doing anything. It is like a digital cold that spreads through the office. It mostly affects domain controllers, which are the main computers that manage all the user accounts in a business. If you use a managed service provider, they are likely already looking at this, but it is a good thing to mention to them.
Another item to look at is CVE-2026-40364. This one is found in Microsoft Word. Usually, we think we are safe as long as we do not open a strange file. However, this bug can let a hacker in just by you looking at a file in the "Preview Pane." You do not even have to double-click it. It is just a small hole in the digital fence that Microsoft is currently patching.
We are also seeing some news about Copilot AI. Many businesses are using AI to help write emails or summarize meetings. A recent report (CVE-2026-26129) showed that AI can accidentally share sensitive information if it is not set up correctly. For example, if an employee asks the AI about company finances, the AI might share details they are not supposed to see.
At Black Clover Cyber Security, we focus on providing the monitoring and forensic logs you need. This helps make sure your AI tools are being helpful without becoming a liability for your business. If you want to learn more about how to use AI safely, you can read about it in our guide on growth guardrails for safe AI adoption.
The recent Chrome update contains many fixes
If you use Google Chrome, you might have seen a little "Update" button in the corner of your browser lately. You should probably click that if you haven't yet. Google just released Chrome 148, and it is a very big update.
This update includes 127 different fixes. That sounds like a big number, but it is just Google being very thorough. Out of those 127 fixes, 14 of them are considered critical. These are the "front doors" that hackers try to use to steal data. Some of these bugs involve WebRTC, which is the technology that helps with video calls, and others involve script injection.
When hackers find these gaps, they try to use them to look at your personal information or peek at what you are doing online. The good news is that updating your browser closes these gaps immediately.
Keeping track of every single update can be a chore for a busy business owner. That is why we offer Continuous Vulnerability Management. We find these gaps before the hackers do, so you can focus on running your business. It is just one way we help you stay ahead. You might find it useful to check out our thoughts on why built-in security sometimes isn't enough.
Current trends affecting small businesses
Every week, we look at the themes that are affecting small and mid-sized businesses (SMBs). This helps us understand what to watch for.
One of the biggest themes right now is identity abuse. A new report says that 9 out of 10 small businesses have at least one compromised user account. This does not always mean your bank account is empty. It often just means a hacker has a password to an old email account or a low-level login. They use these small wins to try and get into bigger systems later.
Another trend is a new type of ransomware nicknamed the "Sorry" ransomware. This one is targeting web hosting panels like cPanel. Hackers are using a critical bypass to get into the control panel of your website. Once they are in, they lock everything up and leave a note that says "Sorry." It is a polite name for a very frustrating problem.
We are also seeing something called "Zero-Click NTLM Theft." This is a way for hackers to steal your login credentials without you ever clicking a link or downloading a file. They use sneaky tricks in the background of websites or emails to grab your "digital fingerprint" while you are just browsing.
These things sound complex, but they are solvable. Using dark web credential defense and 24/7 monitoring is essential for survival in 2026. If you have a plan in place, these threats are just things we handle in the background for you. You can see more about how this works in our post on SMB-focused cybersecurity in 2026.
It is just a matter of checking the right things
When you hear about 127 bugs or "wormable" risks, it can feel overwhelming. But remember, most of these problems exist because of a missed update or a setting that wasn't quite right. You haven't had a problem yet because you are taking the time to read about this and stay informed.
Staying safe is just about moving from "trusting" that everything is fine to "knowing" that everything is fine. This is especially true for things like your website hosting and your email settings. For example, ensuring your email is properly verified is a simple step that keeps your name from being used by scammers. You can read more about that in our article on DMARC policy enforcement.
Cybersecurity is not a one-time project. It is a habit. Just like locking the office door at night, you just need to make sure your digital doors are locked too. If you are not sure where to start, you can always look at your "Secure Score" in Microsoft 365. It is a simple way to see how you are doing.
Steps you can take this afternoon
To make sure your weekend is as peaceful as possible, here are three things you can do right now. They only take a few minutes.
- Update Chrome and Office. Open your Google Chrome browser, go to settings, and click "About Chrome." It will check for the update and install it automatically. Then, open Word or Excel, go to "File," then "Account," and click "Update Options" to make sure you have the latest Microsoft patches.
- Contact your web host. Send a quick email to the person who manages your website or your web hosting company. Ask them if they have patched cPanel for CVE-2026-41940. This is the fix for that "Sorry" ransomware we mentioned. It is a quick check that can save you a lot of trouble later.
- Check your Secure Score. If you use Microsoft 365, you can look at your security dashboard to see your current score. It is just a number that tells you how many of the basic safety features you have turned on.
If you find that your score is lower than you would like, or if you just want someone to help manage these updates for you, we are here to help. You can book an assessment with us to see where you stand. We can help you turn that assessment into a 90-day plan to harden your security.
Cybersecurity is just part of doing business in 2026. It is a minor thing to keep up with once you have the right partners and the right habits. Have a great weekend, and stay safe out there.
Ready to see if your digital office is secure? Book a Discovery Call today, or take our Cyber Security Maturity Check or AI Readiness Quiz to get a head start on your safety plan. We are here to help you secure, defend, and protect your business.