This Week in Small Business Security — 2026-08-31

A roundup of what's actually happened in security over the past week — real incidents and newly disclosed vulnerabilities, not filler.

In the news

• FulcrumSec claims Manchester Airports hack, theft of 86 GB of data (BleepingComputer) — FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information be…
• Anthropic warns infostealer malware is hijacking Claude sessions to drain usage (BleepingComputer) — Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. [...]
• Chrome Web Store extensions caught stealing crypto, browser data (BleepingComputer) — Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lu…
• TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor (The Hacker News) — Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix …
• Anthropic is cutting Claude Code's current weekly limits by 17% (BleepingComputer) — Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. [...]

Newly published, high-severity CVEs

• CVE-2026-66897 (CVSS 9.9, CRITICAL) — A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. Whe…
• CVE-2026-28165 (CVSS 9.8, CRITICAL) — Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
• CVE-2026-32558 (CVSS 9.8, CRITICAL) — Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
• CVE-2026-66587 (CVSS 9.8, CRITICAL) — Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Source: NIST National Vulnerability Database.

This week in our own scan data

We ran 0 Security Score scans across our customers in the past 7 days.

No findings recorded this week.

Nothing stood out — most sites checked out clean.

If any of the above sounds familiar, the fix is usually quick: missing security headers and outdated front-end libraries are the two most common findings we see, and both are typically a same-day fix. Run a free Security Score scan to see where your own site stands.

This roundup is generated weekly from CISA's KEV catalog, NIST's NVD, a small set of established security news feeds, and Hebrides Cyber's own (anonymised) scan data. Set AZURE_OPENAI_ENDPOINT/KEY/DEPLOYMENT for a narrative AI write-up instead of this templated summary — see src/lib/newsletter.ts.