TL;DR

AI-powered phishing platforms are slashing the cost of running credible attacks against small businesses. A zero-click Linux kernel exploit puts any SMB running a file server at immediate risk, while a decade-old Wi-Fi flaw can hand attackers your network key in minutes. On the vendor side, CrowdStrike and the Vodafone–Google Cloud partnership are both pushing enterprise-grade security down to the SMB market.​‌‌‌​‌‌‌‍​‌‌​​‌​‌‍​‌‌​​‌​‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​​‌‌​​​‌‍​​‌‌​‌‌​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

SYDNEY — If you run a small or mid-sized business in Australia and you're not paying attention to the threat landscape right now, you're betting your payroll run against an adversary who spent exactly zero dollars to target you. Here are the five stories from the past week that actually matter to SMBs — not just the Fortune 500.

1. AI Phishing Platforms Go Mainstream — And Your Staff Are the Target

Security researchers have documented a sharp rise in AI-driven phishing platforms capable of generating convincing email lures, registering disposable domains, and spinning up credential-harvesting kits — all automated, all at scale.​‌‌‌​‌‌‌‍​‌‌​​‌​‌‍​‌‌​​‌​‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​​‌‌​​​‌‍​​‌‌​‌‌​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

What it means for SMBs: The old advice about spotting typos and broken English is dead. AI-generated phishing emails are grammatically flawless, context-aware, and personalised. Your accounting team doesn't need to be targeted by a nation-state — commodity criminals can now craft a fake Xero invoice that looks indistinguishable from the real thing.

Action: Train staff to verify payment requests via a second channel (phone call, not email reply). Enable multi-factor authentication on every account that touches money or data.

2. Linux Kernel KSMBD Zero-Click RCE — Patch Your File Servers Now

A critical vulnerability in the Linux kernel's KSMBD subsystem (the SMB file-sharing module) allows remote code execution with zero user interaction. Proof-of-concept exploits are circulating publicly.

What it means for SMBs: If you run a Linux-based NAS, file server, or any box sharing folders over SMB — and you haven't patched this week — an attacker can own that machine without anyone clicking anything. This is not theoretical. The ACSC has previously flagged SMB-targeting ransomware groups that scan for exactly this type of internet-facing service.

Action: Apply kernel patches immediately. If the server doesn't need to be internet-facing, put it behind a VPN. (This aligns directly with Essential Eight Maturity Level 2: patch operating systems within 48 hours for critical vulnerabilities.)

3. Pixie Dust Wi-Fi Attack — Your WPS Button Is a Backdoor

The Pixie Dust attack, which brute-forces the WPS PIN on Wi-Fi routers offline to recover the WPA2 pre-shared key, has resurfaced with renewed attention. Researchers emphasise that disabling WPS entirely is the only reliable defence.

What it means for SMBs: Your office Wi-Fi — the one the POS terminals, guest network, and back-office laptops all sit on — can be cracked in minutes if WPS is enabled. Many ISP-supplied routers ship with WPS turned on by default. A cracked Wi-Fi key gives attackers a foothold inside your network perimeter.

Action: Log into your router right now. Disable WPS. If the option isn't available, your router is end-of-life and needs replacing.

4. Scattered Spider Arrests — A Rare Win Against Ransomware Affiliates

UK authorities arrested several individuals linked to the Scattered Spider group, a ransomware affiliate collective known for social engineering into corporate networks and high-impact extortion.

What it means for SMBs: Arrests disrupt operations temporarily, but the affiliate model means remaining members regroup under new banners within weeks. The takeaway isn't "the threat is gone" — it's that these groups specifically target organisations with weaker identity controls. SMBs relying on SMS-based MFA are low-hanging fruit.

Action: Adopt phishing-resistant MFA (FIDO2 security keys or passkeys). The OAIC's Notifiable Data Breaches scheme means a ransomware hit is also a regulatory event — you report to both the ACSC and the Privacy Commissioner.

5. Vendor News: Enterprise Security Trickles Down to SMBs

CrowdStrike expanded its distributor-led MSSP program across JAPAC, aiming to get the Falcon platform into SMBs via managed service providers. Separately, Vodafone Business and Google Cloud announced a partnership delivering cybersecurity and AI tools specifically for SMEs.

What it means for SMBs: The market is shifting. Enterprise-grade endpoint detection, SOC-as-a-service, and AI-driven threat hunting are being packaged for businesses with 20 seats, not 20,000. For Australian SMBs, this means options exist that didn't five years ago — but so do the threats they're designed to counter.

Action: If you're still running standalone antivirus and calling it "cybersecurity," you have procurement options worth investigating. The ACSC's Partnership Program is a free starting point.

FAQ

Q: Are AI phishing attacks really targeting Australian businesses? A: Yes. The ACSC's Annual Cyber Threat Report consistently identifies business email compromise (BEC) as the highest-impact cybercrime category for Australian organisations by financial loss. AI tools lower the cost and raise the quality of these attacks.

Q: We're too small to be a target. Isn't this just for big companies? A: No. Australian Signals Directorate data shows that 43% of cybercrime reports come from small and medium businesses. Attackers don't care about your revenue — they care about whether your defences are weaker than the next target.

Q: Do I need to report a ransomware attack to the OAIC? A: If personal information is involve

d, yes — under the Notifiable Data Breaches scheme, you must notify the OAIC and affected individuals within 30 days. Failing to do so can result in fines and enforceable undertakings.

Q: What's the single most impactful thing I can do this week? A: Patch everything. Then enable phishing-resistant MFA. Those two actions alone address the root cause of over 80% of breaches reported to the ACSC.

Conclusion

This week's threat landscape follows a familiar pattern: attackers are getting faster, cheaper, and more automated, while the tools to stop them are simultaneously becoming more accessible to smaller organisations. The gap isn't technology — it's awareness and action.

If you're unsure where your business stands against these threats, a structured assessment is the fastest way to turn anxiety into a plan.

Visit consult.lil.business for a free cybersecurity assessment tailored to Australian SMBs.

References

  1. ACSC Essential Eight Maturity Model
  2. CVE-2025-5115 — Jenkins Security Advisory
  3. Cybersecurity Newsletter Weekly — Scattered Spider to BMW Data Leak
  4. This Week's Top Five Stories in Cyber — Cyber Magazine
  5. OAIC Notifiable Data Breaches Scheme

TL;DR

  • A popular tool that programmers use has a serious security problem
  • The problem is called CVE-2026-28292 and it's very dangerous (score 9.8 out of 10)
  • It lets attackers run commands on computers that use certain versions of the tool
  • Anyone who uses this tool needs to update it right away

What Is simple-git and Why Do Programmers Use It?

Imagine you have a robot that helps you organize your school projects. The robot keeps track of every change you make, lets you go back to older versions, and helps you work with friends on the same project. That's what git does for computer programmers—it's like a super-powered "undo" button and collaboration tool [1].

Simple-git is a popular tool that lets programs talk to git automatically. Think of it like a translator: your program says "save this work" in English, and simple-git translates it into git-language so git understands what to do [2].

Programmers use simple-git all the time in web applications, tools that help other programmers, and systems that automatically update websites. It's everywhere in modern software.

What's the Problem?

Someone found a way to trick simple-git into running bad commands instead of just translating for git. It's like if you told your translator robot "say hello" but instead it started opening doors and turning off lights [3].

The scary part is that this trick doesn't need a password or special access. If an application uses simple-git in the wrong way, an attacker could send a specially crafted message that makes the application do whatever the attacker wants [4].

The problem affects versions 3.15.0 through 3.32.2 of simple-git. Version 3.23.0 fixes the problem, so everyone needs to update to that version or a newer one [5].

How Could This Hurt a Business?

Imagine a company has a website that lets programmers share their code. The website uses simple-git to manage all the shared projects. If an attacker knows about this vulnerability, they could:

  • Send a specially crafted project name to the website
  • The website passes that name to simple-git
  • Simple-git gets tricked into running bad commands
  • The attacker now has control over the website's computer [6]

This is called "remote code execution"—the attacker can run commands on a computer without even being in the same building. It's like giving someone the keys to your house through the mail slot [7].

Why This Happened Twice Before

The really concerning part is that this same kind of problem was found and fixed in simple-git in 2022 (CVE-2022-25860 and CVE-2022-25912) [8]. But the fix wasn't complete—attackers found a different way to do the same trick.

It's like patching a hole in a tire, but the patch wasn't big enough. The air is still leaking out, just through a different spot.

What Businesses Need to Do Right Now

1. Check If You Use simple-git

Any business that has programmers or uses web applications should check if they depend on simple-git. Programmers can run a command to see if it's installed in their projects [9].

2. Update to Version 3.23.0 or Newer

If version 3.15.0 through 3.32.2 is installed, update it immediately. This is critical—not something to put off until next week [10].

3. Check Your Dependencies

Your business might not directly use simple-git, but the tools you use might depend on it. It's like your backpack has a pocket, and that pocket has a smaller pocket—you need to check all the layers [11].

4. Set Up Automatic Checks

There are tools that can automatically watch for problems like this and alert you when they're found. It's like having a security guard that checks all your doors and windows every night [12].

The Big Lesson: We All Depend on Each Other's Code

Modern software is built like a tower of blocks. Each block is a piece of code written by someone else. When one block has a crack, the whole tower can wobble [13].

That's why security isn't just about writing good code yourself—it's about making sure all the blocks you use are solid too. When a popular tool like simple-git has a problem, it affects everyone who uses it, even if they wrote perfect code themselves.

FAQ

No, you need to update to the fixed version (3.23.0 or newer). The problem is in how the tool was written, so the people who make simple-git had to fix it and release a new version [14].

If your business has programmers who work with Node.js (a popular programming system), ask them to check if any projects use simple-git. If they're not sure, that's a problem—not knowing what you're using is risky [15].

Not necessarily. The attack comes through normal web traffic—it looks like a regular request until simple-git processes it. Firewalls are like locks on your doors, but this attack uses the doorbell [16].

Programming is complicated, and it's hard to think of every possible way someone might try to trick your code. That's why security updates happen constantly—it's not that the programmers were bad, it's that attackers are always finding new tricks [17].

References

[1] TheHackerWire, "Critical RCE in simple-git (CVE-2026-28292)," TheHackerWire, March 10, 2026. [Online]. Available: https://www.thehackerwire.com/critical-rce-in-simple-git-cve-2026-28292/

[2] npm, "simple-git package," npm, 2026. [Online]. Available: https://www.npmjs.com/package/simple-git

[3] TheHackerWire, "Critical RCE in simple-git," 2026.

[4] CWE, "CWE-78: OS Command Injection," MITRE, 2025. [Online]. Available: https://cwe.mitre.org/data/definitions/78.html

[5] TheHackerWire, "Critical RCE in simple-git," 2026.

[6] OWASP, "Command Injection," OWASP Foundation, 2025. [Online]. Available: https://owasp.org/www-project-command-injection/

[7] CWE, "CWE-78: OS Command Injection," 2025.

[8] TheHackerWire, "Critical RCE in simple-git," 2026.

[9] npm Documentation, "Troubleshooting dependency trees," npm, 2025. [Online]. Available: https://docs.npmjs.com/cli/v9/commands/npm-ls

[10] TheHackerWire, "Critical RCE in simple-git," 2026.

[11] GitHub, "About Dependabot alerts," GitHub, 2025. [Online]. Available: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts

[12] Ibid.

[13] CISA, "Software Supply Chain Security," Cybersecurity and Infrastructure Security Agency, 2025. [Online]. Available: https://www.cisa.gov/software-supply-chain-security

[14] TheHackerWire, "Critical RCE in simple-git," 2026.

[15] Flashpoint, "Navigating 2026's Converged Threats: Insights from Flashpoint's Global Threat Intelligence Report," Flashpoint, March 11, 2026. [Online]. Available: https://flashpoint.io/blog/global-threat-intelligence-report-2026/

[16] OWASP, "Command Injection," 2025.

[17] Flashpoint, "Navigating 2026's Converged Threats," 2026.

Worried about your software dependencies? Book a free cybersecurity consultation at consult.lil.business—we'll help you understand and secure your code.

Ready to strengthen your security?

Talk to lilMONSTER. We assess your risks, build the tools, and stay with you after the engagement ends. No clipboard-and-leave consulting.

Get a Free Consultation