Attackers no longer need custom malware to take over a practice network. Fresh phishing campaigns are stealing Microsoft 365 sessions and then quietly installing the same remote-access tools your IT provider uses. Here is how RMM abuse works and how a dental practice can tell...
A recent attack that pried patient records out of a medical software provider through a single SQL injection flaw is a wake-up call for dental practices. Here is what the vulnerability is, why your practice management software may be exposed, and the concrete steps to...
A 12-office dental group has begun notifying nearly 46,000 patients after an attacker used a single compromised account to reach their records. Unlike the big supplier breaches, this one started somewhere your practice actually controls - a login. Here is what happened and exactly what...
A high-severity flaw in Elementor, the page builder running on over 10 million WordPress sites, lets an attacker create a rogue administrator the moment a logged-in admin opens a booby-trapped link. If your dental practice website was built with Elementor, here is why it matters...
A critical WordPress Core flaw, CVE-2026-87902, went from public disclosure to active exploitation in under five hours. If your practice website runs WordPress on typical cPanel hosting, here is why it may be in the vulnerable configuration and exactly what to do this week....
Pearl has brought its FDA-cleared 3D imaging AI to general dentists in the U.S. and Canada. The tool that reads cone-beam scans is now a mainstream purchase - which makes it an IT and data question, not just a clinical one. Here is what your...
A bill reintroduced in the Senate would replace healthcare's voluntary cybersecurity guidance with enforceable minimum standards, mandatory audits, annual executive sign-off, and far larger penalties. Here is what the Health Infrastructure Security and Accountability Act would require, and why a small dental practice should start...
Microsoft's September security updates are knocking out Always On VPN connections on Windows. If your team logs in from home or a satellite office, here is exactly what breaks, how to confirm it, and how to restore secure remote access without leaving your practice exposed....
Since 2023, U.S. law has required the makers of connected medical and dental imaging devices to build cybersecurity in and prove it to the FDA. Most practices have never thought to ask about it. Here is how to turn that rule into three questions you...
Security firms are tracking active, unpatched attacks against a flaw in FastJson - an open-source Java component buried inside other people's software - and healthcare is on the list of industries being hit. Most dental practices will never run FastJson directly. The reason this still...
Backup software is supposed to be the thing that saves you after an attack - so it is unsettling when the backup tool itself becomes the way in. On September 16, 2026, CISA added CVE-2026-87886, a flaw in the Acronis Backup plugin for cPanel and...
Weeks after the last N-central scare, a worse one has landed: CVE-2026-86218, a pre-authentication remote code execution zero-day rated a perfect 10.0 and already exploited in the wild. It needs no password. Most dental practices are exposed through their IT provider, not directly - here...
A new strain of Android malware called RatHat uses an AI engine to drive a phone or tablet on its own, self-pairs with Android's debug bridge to keep shell-level control even after the app is deleted, and is built to steal banking logins and one-time...
A Windows update locks out your server, a billing vendor lands on a leak site, or ransomware freezes the schedule at 8 a.m. - and suddenly a fully digital dental practice cannot see patients. The fix is not more panic on the day; it is...
Google Meet can be used for a compliant patient video visit - but only on a paid Google Workspace plan with a signed Business Associate Agreement and the right configuration. The free version most people click into is not covered, and using it for a...
