This week in IT and cyber security: 8–14 August 2026

Here is everything we published on the System Force blog this week – a bumper week covering urgent security alerts, AI pitfalls and how to invest in your people.

Critical WordPress Plugin Lets Hackers In as Admin

A critical flaw in the miniOrange OAuth SSO plugin (CVSS 9.8) lets a complete stranger log in to your WordPress site as administrator without needing a password. If you use this plugin to allow staff to sign in with their Microsoft or Google accounts, disable it immediately and check for any unfamiliar admin users – no official patch had been released at the time of writing.

Law Firm Cyber Security: Lessons From the NCSC Report

The NCSC has published a cyber threat report aimed squarely at UK legal practices, highlighting phishing, ransomware and payment redirection fraud as the biggest risks. The message is clear: law firms hold exactly what criminals want, making strong security a professional obligation rather than just an IT decision. The post walks through practical steps including multi-factor authentication, bank transfer verification training and working towards Cyber Essentials certification.

Automated IT Support: How Intelligent, Always-On Solutions Are Transforming Business Efficiency

AI-driven IT support is reshaping how SMEs manage their technology – identifying issues before users notice them and handling routine tasks without manual intervention. Always-on monitoring means faster resolution times and less downtime, helping businesses run more smoothly around the clock. For smaller organisations that cannot justify a large in-house IT team, intelligent automation is increasingly the practical, cost-effective answer.

Can You Trust the Answer? AI Hallucinations at Work

AI tools are remarkably good at sounding confident – even when they are completely wrong. This post explains what AI hallucinations are, why they happen, and the real-world business risks when an invented fact or a made-up source finds its way into a document or a customer reply. The practical advice: keep a human in the loop, always verify anything important against a reliable source, and make sure your team knows when to double-check.

What Business Leaders Need to Know About Network Segmentation

Network segmentation means splitting your business network into separate zones with their own access controls, so that if attackers break into one area they cannot roam freely across everything else. It also improves network performance and makes compliance easier to manage – particularly for firms in regulated sectors such as finance, healthcare and legal services. The guide covers what segmentation involves, why it matters for SMBs, and how to go about putting it in place.

Critical WordPress Vulnerability Under Active Attack

A critical WordPress core vulnerability (CVE-2026-60137) has been added to the US CISA Known Exploited Vulnerabilities catalogue, meaning real attacks are happening right now rather than posing a theoretical risk. When chained with a second flaw, it allows an unauthenticated attacker to run their own code on a vulnerable site without a password – one of the most serious categories of web vulnerability. If your site runs WordPress 6.8, 6.9 or 7.0, update to the latest patch release without delay.

Unlock Your Team’s Potential with Training-as-a-Service

Training-as-a-Service replaces one-off sessions with continuous, on-demand learning accessible on any device – and System Force IT’s offering includes tailored learning paths, interactive labs and preparation for certifications such as CompTIA, CISSP and Microsoft Fundamentals. It integrates with tools your staff already use, including Microsoft Teams and Slack, so training fits around the working day rather than interrupting it. A smart way to keep your workforce skilled up as technology keeps moving.

If any of these topics have got you thinking about your own setup, we would love to hear from you – get in touch with the System Force team.