Multi-factor authentication is supposed to be the wall that keeps intruders out of your Microsoft 365 and practice-management accounts. But a fast-growing class of malware, infostealers, does not try to climb the wall. It waits for your staff member to unlock the door, then quietly...
Federal investigators found a hidden backdoor in a widely used patient monitor that silently shipped patient data to a hard-coded overseas address - and a US state has since ordered agencies to inventory Chinese-made networked medical devices. Dental practices run connected devices too: intraoral sensors,...
A critical Microsoft SharePoint flaw, CVE-2026-55040, lets a remote attacker forge a valid login token and impersonate any user - up to a full site administrator - without ever knowing a password. Microsoft patched it in July, but once Rapid7 published proof-of-concept code this week,...
A new attack called 'Plug and Pwn,' disclosed at DEF CON 34, abuses the Windows Plug and Play feature every computer relies on. By emulating a USB device, an attacker can make Windows automatically install a signed-but-vulnerable vendor driver as SYSTEM - the highest level...
Microsoft's August 2026 Patch Tuesday fixed an actively exploited Windows zero-day (CVE-2026-68820) that the North Korean Lazarus group used to turn a fake job offer into total, stealthy control of a Windows machine. The attack chain - social engineering, then a kernel privilege-escalation flaw, then...
CISA has confirmed that ransomware crews are actively exploiting two SonicWall SMA1000 remote-access flaws - one of them a maximum-severity, no-password-required bug - to seize the appliance and walk straight into the network behind it. For any dental practice that reaches its systems through a...
Windows 10 stopped getting security updates in October 2025. If a single reception, operatory, or imaging PC in your practice is still running it, you are now storing patient data on a machine Microsoft no longer patches — and that is a compliance problem, not...
The breach at Abbott Laboratories didn't start with malware. It started with a phone call to a real employee. For dental practices, that's the uncomfortable part — because your weakest security control answers the phone at the front desk....
A Russian state-sponsored group is exploiting a zero-day flaw in Outlook Web Access that runs the moment a victim opens an email. No link to click, no attachment to open. Here is what CVE-2026-42897 and the OWAReaper backdoor mean for a dental practice on Microsoft...
CISA this week urged organizations to isolate their vital systems during a cyberattack. For a dental practice running on one flat network, that advice is a wake-up call. Here is how segmentation stops ransomware from jumping from the front desk to your imaging server and...
A medical billing vendor breach exposed 1.26 million patients without a single encrypted file. Here is what the MCBS incident and the rise of extortion-only attacks mean for dental practices that outsource billing....
A cyberattack on healthcare billing software vendor Craneware exposed how a breach at a trusted third party can put your practice's data at risk, even when your own network did nothing wrong....
Two new attack techniques are making headlines: websites that make your browser assemble malware in memory, and 'ClickFix' prompts that trick staff into pasting a command that infects the PC. Both routinely evade traditional antivirus. Here is what they mean for a dental practice -...
Microsoft is making passkeys the default sign-in for Microsoft 365 and Entra ID, and it is retiring its own SMS and voice codes on February 1, 2027. Here is what that timeline means for a dental practice and how to get ahead of it....
