The Week in Tech: What Cloud and Cybersecurity Changes Mean for Australian SMEs

The past seven days have delivered a clear message for business leaders: cloud decisions, software updates and everyday email security are now tightly connected. A change made by a major vendor or a new technique used by attackers can quickly become an operational, financial or reputational issue for a smaller organisation.

Introduction

This week’s news is less about one dramatic breach and more about the steady tightening of the technology environment. Microsoft’s September security updates underline the importance of disciplined patching. New browser-based phishing techniques show why traditional email and web filtering can no longer carry the entire burden of defence. A renewed npm supply chain campaign highlights the risk hidden inside third-party software, while VMware’s decision to restrict public access to a migration and backup development kit illustrates how vendor strategy can affect infrastructure planning.

For Australian businesses, the practical lesson is straightforward. Technology risk is no longer limited to the systems managed directly by an internal IT team. It extends to cloud providers, software vendors, contractors, open-source packages, browsers, identity systems and the people who use them every day.

The following four developments are worth putting on the agenda now, not when they become an urgent incident.

1. Microsoft’s September updates put patch discipline back in the spotlight

Microsoft released its September security updates on September 8, including fixes across Windows, Office, Exchange Server and other products. A major vendor advisory listed remote code execution issues and server vulnerabilities including Windows DNS, DHCP and deployment services. Microsoft’s Office release notes also recorded new security fixes for Microsoft 365 Apps and supported Office editions.

The Microsoft Security Update Guide and Microsoft Office security release notes provide the authoritative detail for affected products and versions. Independent reporting described the release as one of the larger Patch Tuesday updates in recent years, with hundreds of fixes in scope. citeturn1search1turn1search0

Why it matters for businesses

For a small or mid-sized organisation, a large patch release can create a familiar problem: too many updates, too little time and no complete inventory of what is actually installed. The risk is higher where businesses operate a mixture of laptops, file servers, remote desktop systems, Microsoft 365, older line-of-business applications and devices managed by an external provider.

The most important point is not the headline number of vulnerabilities. It is the gap between a patch being available and the patch being applied, tested and verified. Attackers routinely target internet-facing services, identity systems and widely deployed software because one successful compromise can provide access to many users or systems.

Patching also has a business continuity dimension. A rushed update can cause downtime if dependencies are unknown, but delaying every update leaves the organisation exposed. Mature patching is therefore a risk decision supported by testing, backups and clear priorities.

Practical actions

• Confirm that every Windows device, server, Microsoft 365 tenant and Exchange deployment has an owner and a documented update status.
• Prioritise internet-facing systems, domain controllers, remote access services, DNS and DHCP servers, and devices used by administrators.
• Set an internal target for critical security updates, such as assessment within 24 hours and deployment within a defined business window.
• Test patches on a small representative group before wider deployment, but do not allow testing to become an open-ended delay.
• Verify that backups are working and that a recent restore test has been completed before making major changes to critical systems.
• Ask your managed service provider for written confirmation of what was patched, what was excluded and what remediation is planned.

For Australian firms, this is also a useful time to review alignment with the Essential Eight. Patching applications and operating systems is not simply a technical housekeeping task. It is part of demonstrating reasonable cyber hygiene to customers, insurers and business partners.

2. Browser-built phishing pages are making familiar warning signs less reliable

Researchers reported a phishing campaign in which the final deceptive page was constructed inside the victim’s browser rather than hosted as a conventional public website. The technique can use a temporary browser address, sometimes called a blob URL, or a fake browser window built with ordinary web technologies. The result can imitate an Adobe Reader prompt, a file download page or a login screen while the real address bar belongs to a legitimate website.

ITPro’s report on browser-built phishing described the concern raised by researchers, while other security reporting noted the use of browser-in-the-browser techniques to copy familiar interface elements. citeturn1news12turn1news14turn1search7

Why it matters for businesses

Many organisations still teach users to look for a suspicious domain, a missing padlock or a page that looks poorly designed. Those checks remain useful, but they are not enough when an attacker can create a convincing fake login panel inside a legitimate page or redirect the user through a trusted service.

The technique is especially relevant to SMEs because attackers do not need to compromise a major enterprise to make money. A convincing fake document notification can lead to stolen Microsoft 365 credentials, a fraudulent payment request, a malware download or access to customer records. Once an account is taken over, the attacker may use the same trusted mailbox to target suppliers and customers.

This is a reminder that phishing defence must be layered. Email filtering, endpoint protection and browser security all matter, but so do identity controls and simple internal procedures. A business that requires a second channel for payment changes is less exposed than one that relies on a user spotting every visual clue.

Practical actions

• Require phishing-resistant or app-based multi-factor authentication for administrators and all users with access to finance, payroll, customer data or cloud management consoles.
• Train staff to open sensitive documents through known bookmarks or official applications instead of trusting a button inside an unexpected message.
• Tell users not to enter credentials into a page merely because it displays a familiar logo, address bar or padlock symbol.
• Create a simple verification process for bank detail changes, urgent payment requests and requests to install software.
• Configure email and identity alerts for impossible travel, unfamiliar devices, suspicious inbox rules and repeated failed sign-ins.
• Run short, realistic awareness exercises that explain why a message is suspicious rather than only recording whether a user clicked.

The best user guidance is practical. Instead of telling staff to identify every phishing email, tell them what to do when something feels unusual: stop, do not enter credentials, contact the person through a known channel and report the message.

3. The return of Shai-Hulud shows why software supply chains need business oversight

Researchers reported a new wave of the Shai-Hulud npm worm during the week. The campaign was described as moving through JavaScript packages and attempting to evade npm’s malware scanning and triage processes. Earlier variants of the malware were associated with compromised packages, developer credentials and self-propagation through software repositories.

ITPro’s coverage of the latest npm activity reported that researchers had identified malicious activity moving through the npm ecosystem. A Singapore Cyber Security Agency advisory has also warned organisations using Node.js to review dependencies and treat credentials on affected systems as potentially compromised. citeturn1news13turn1search2

Why it matters for businesses

A business does not need to develop software in-house to be affected by a software supply chain incident. Websites, customer portals, booking systems, payment integrations, marketing platforms and internal automation may depend on open-source components maintained by third parties.

The risk is not limited to malicious code running in a production application. A compromised package may expose developer tokens, cloud credentials, build pipelines or secrets stored on a workstation. That creates a pathway from a seemingly ordinary update to a wider cloud or data breach.

For managers, the challenge is visibility. Many businesses know which major applications they buy, but not which libraries, plugins, APIs and packages sit underneath them. That makes it difficult to assess risk, respond quickly or ask the right questions of a supplier.

Practical actions

• Ask software suppliers whether they maintain a software bill of materials, or SBOM, for important products and how quickly they notify customers about vulnerable dependencies.
• Require developers and contractors to use lockfiles, trusted registries and review processes for new packages and updates.
• Remove unused dependencies and limit the permissions available to build systems, deployment tools and package publishing accounts.
• Store tokens and secrets in a managed secrets platform rather than in source code, local configuration files or shared documents.
• Rotate developer, cloud and CI/CD credentials if a potentially affected package was installed on a privileged machine.
• Include software supply chain questions in vendor due diligence, cyber insurance reviews and procurement processes.

SMEs should not try to inspect every line of open-source code manually. The practical goal is to know where software comes from, what access it has, who owns the response and how quickly the business can isolate an affected system.

4. VMware’s VDDK decision is a reminder to plan for vendor change

VMware, now part of Broadcom, ended public downloads of its Virtual Disk Development Kit, or VDDK, during the week. The kit has been used by software developers for backup, recovery, cloning and migration operations involving VMware virtual disks. The company said access remains available through selected technology alliance partners for licensed backup and recovery use cases, while migration providers and other users said the change could disrupt projects already in progress.

The Register’s report on the VDDK change explains why the decision matters to backup vendors, migration partners and organisations considering a move away from VMware. citeturn2search0

Why it matters for businesses

Most SMEs are not running enormous private clouds, but many still rely on virtualisation for file services, line-of-business applications, backup infrastructure and legacy workloads. A change to a development kit may appear highly technical, yet it can affect the cost, timing and risk of a migration or backup project.

The broader lesson is about dependency. A vendor may change licensing, product packaging, support terms, APIs or download access with limited notice. If a business has no documented exit plan, it can become dependent on a single supplier even when alternatives exist.

This is particularly important after major acquisitions. Contract terms, product roadmaps and support arrangements can change when a platform moves into a larger vendor portfolio. The impact may not be visible until a renewal, an audit, a support issue or a planned migration exposes it.

Practical actions

• Maintain a current register of critical platforms, including product versions, renewal dates, support status and the business processes they support.
• Review whether backup and disaster recovery tools are officially supported for your current virtualisation platform and target replacement platform.
• Keep independent copies of essential installers, configuration exports, licences, encryption keys and recovery documentation where contract terms permit.
• Ask vendors for clear notice periods covering price changes, product retirement, support changes, API changes and access to migration tools.
• Test a representative workload recovery to an alternative environment rather than assuming a migration will work because a tool is advertised as compatible.
• Include exit costs and data portability in procurement decisions, not only monthly subscription price.

The goal is not to abandon VMware or any other platform automatically. It is to ensure that the business has choices. A cloud or virtualisation strategy is stronger when it includes a realistic recovery and exit plan.

What This Means For Your Business

The common thread across this week’s stories is that business resilience depends on small operational habits. A security update only helps when it is deployed. Multi-factor authentication only helps when it covers the accounts attackers want. A backup only helps when it can be restored. Supplier assurance only helps when someone has reviewed the answer and assigned an owner.

Start with a one-hour technology risk review. Confirm which systems are internet-facing, which accounts have administrative access, which suppliers hold sensitive data and which business services would stop if a key cloud or virtualisation platform became unavailable. Then identify the three gaps that would cause the greatest disruption and assign a person and date to each one.

For smaller organisations, outsourcing can be sensible, but outsourcing does not remove accountability. Ask your IT provider for clear evidence of patching, backup tests, identity protection, alert monitoring and incident response. If the answers are vague, that is a business risk worth addressing before the next incident.

The technology landscape will keep changing, but the response does not need to be complicated. Keep an accurate asset list, patch promptly, protect identities, verify unusual requests, understand supplier dependencies and test recovery. Those actions improve security, continuity and confidence at the same time.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.