Hey X, Iām Ray Wesnerāturning 50 in a few days and stepping into a new chapter louder and prouder than ever.
Recently widowed. Gay. Unapologetically conservative. Die-hard Trump supporter since Day 1. And most importantly: all-in for Jesus Christ again.
Buckle up, hereās my story š§µš
If your business website runs on WordPress, hereās a quick check for you š
Thereās a popular plugin called Quiz and Survey Master (QSM).
Itās used by more than 40,000 websites to create quizzes, surveys and forms without needing any coding.
Unfortunately, versions 10.3.1 and older were recently found to have a serious security flaw.
The issue is whatās known as an SQL injection vulnerability.
SQL is the language used to talk to a websiteās database, the part that stores things like user accounts, submissions, and other important data.
An SQL injection flaw means someone can sneak malicious commands into that database.
In this case, any logged-in user, even someone with a basic subscriber account, could potentially inject commands into the system.
That could allow actions like:
š« Accessing sensitive data
š« Extracting information from the database
š« Manipulating content
The vulnerability is tracked as CVE-2025-67987, and it was fixed in version 10.3.2.
The latest version available is 10.3.5, which is the safest bet.
Based on https://t.co/C2SV1Eeiu0 data, just over half of websites using QSM are on version 10.3. That means a large number are likely still vulnerable.
Thatās potentially tens of thousands of sites.
Right now, thereās no confirmed evidence of this flaw being actively exploited. But once a vulnerability is public, attackers often start scanning the internet looking for unpatched sites.
š If your site uses this plugin, the solution is straightforward: Update it immediately š
More broadly, this is a reminder of something I say often to business owners: WordPress itself isnāt usually the weak link. Itās the plugins.
Every plugin you install adds functionality but also adds potential risk.
If youāre not actively using a plugin or theme, it shouldnāt just be deactivated. It should be deleted from the server completely.
Websites arenāt a set and forget asset. Theyāre part of your digital infrastructure.
If theyāre vulnerable, they can become an entry point into your wider systems. Especially if admin accounts reuse passwords across services.
ā When was the last time someone checked which plugins your website is running and whether theyāre fully up to date?
If youāve ever tried to get an AI tool to understand a whole project instead of just one document, youāll appreciate thisā¦
Microsoft has introduced something called Copilot Agents in OneDrive.
And this is where AI starts to feel a bit more useful for real-world business work š¤
Hereās the problem itās trying to solve.
Normally, if you ask Copilot to summarize or analyze something, youāre doing it one file at a time. One Word document. One spreadsheet. One PowerPoint.
But projects donāt live in one file.
They live across proposals, meeting notes, budgets, timelines, research documents, and email summaries.
With OneDrive Agents, you can now select up to 20 related files and bundle them together into whatās saved as a .agent file.
Instead of asking: āSummarize this fileā¦ā
You can ask: āWhat deadlines are coming up across this whole project?ā
āWhere are the risks?ā
āWhat did we agree in the last three meetings?ā
And it has the context of all the selected files, not just one.
The agent behaves like other AI tools. It can summarize, answer questions, surface key points. But itās operating with a broader understanding.
Even better, these agents are saved as files inside OneDrive.
That means you can share the .agent file with colleagues. They donāt need to recreate the setup themselves. Youāre all working from the same AI āviewā of the project.
As projects evolve, you can add or remove documents from the agent or refine the instructions it uses.
It stays aligned with the latest information instead of becoming outdated.
Right now, this feature is available to people with a Microsoft 365 Copilot license accessing OneDrive via the web.
Itās clearly still evolving. Microsoft is asking for feedback, which suggests itās watching closely to see how businesses use it.
From a business ownerās perspective, the real value is reducing the time spent hunting across folders, trying to piece together context.
If AI can help you understand a whole project in one place instead of ten separate files, thatās meaningful productivity.
š¤ The question is, would you trust an AI agent to interpret multiple important documents at once, or would you still prefer to read everything yourself?
Do you use an Android phone for work? š±
Security researchers have uncovered a new piece of Android malware that can track almost everything you do on it.
And I donāt mean basic tracking.
Weāre talking:
š PIN entries
š Login credentials
š Messages
š Banking app activity
The clever (and worrying) part is how it spreads š¦
The app is called TrustBastion.
It pretends to be a security tool. Victims see pop-ups or adverts claiming their phone is infected with malware or scam messages.
The āsolutionā? Install this app to clean things up.
That fear tactic works more often than youād think š±
At first glance, the app looks harmless. But itās whatās known as a dropper.
That means the app itself doesnāt contain the malicious code straight away. Instead, it downloads it after installation.
Once installed, it shows a fake āupdateā screen that looks very similar to official Android or Google Play messages.
If you agree, a manipulated APK file (thatās the installation package format Android uses) is downloaded in the background.
But the download doesnāt come from some obviously shady server. It comes from Hugging Face, a well-known developer and AI platform with a strong reputation.
The infrastructure looks legitimate, so many security tools donāt immediately flag it as suspicious. The attackers hide behind a trusted name.
After installation, the malware requests extensive permissions and pretends to be a system component called āPhone Securityā.
It then asks for Accessibility permissions.
Accessibility features are designed to help users with disabilities. But when misused, they give apps the ability to read whatās on your screen, log what you type, and overlay content on top of other apps.
That means this malware can:
ā ļø Capture PIN codes and unlock patterns
ā ļø Overlay fake login screens on top of real banking apps
ā ļø Intercept payment details and messages
The stolen data is sent back to the attackersā servers, and the malware can even receive updates or new instructions.
To make detection harder, the criminals are using something called server-side polymorphism.
That means they generate slightly modified versions of the malware every 15 minutes.
Within a month, researchers found more than 6,000 variants.
Traditional antivirus tools often look for known āsignaturesā. If the file keeps changing slightly, itās harder to block.
So, what should you take from this?
First: Only install apps from the Google Play Store.
Second: Be extremely cautious of apps that claim to clean or secure your phone while asking for deep system permissions.
Third: Only enable Accessibility access if you fully understand why the app needs it.
And donāt assume that because somethingās hosted on a reputable platform, itās automatically safe.
If your business lets staff access email, banking or cloud systems from their phones, mobile security is vital.
š¤ When was the last time you reviewed what apps are installed on your company devices?
The Start menu is one of those things people donāt often think about, unless it changes š
Windows 11 has rolled out a redesigned Start menu, and more devices are now seeing it automatically.
If it hasnāt appeared on yours yet, it likely will soon.
But this isnāt a radical overhaul. Itās more of a tidy-up than a revolution š
Microsoft says it wanted to keep the original āStartā promise: A place where you begin your work. But it also wanted it to feel quicker, calmer, and more personal.
So, whatās different?
At the top, you still have a search bar. Thatās intentional. Microsoft wants search to be the fastest way to jump straight to an app, file, or setting.
Below that, youāve got your pinned apps, the shortcuts you choose to keep there.
Then comes the part people have strong opinions about⦠the Recommended section.
This shows suggested files and apps based on what youāve been working on. Microsoft says it added this because people wanted smarter suggestions that learn in real time.
But you can now turn it off š«
If you donāt like the Recommended feed, you can disable it in: Settings > Personalization > Start.
Thereās a toggle for showing recommended files and recent items.
The catch is that this also switches off recent items in File Explorer and in the taskbarās right-click menus. Itās not completely isolated.
Another noticeable change is how all your apps are displayed.
Instead of digging into a long alphabetical list and scrolling endlessly, thereās now a category view. It groups apps together and prioritizes the ones you use most.
Microsoft admits it wanted this to feel a bit more like a smartphone layout š²
Quicker visual scanning, less marathon scrolling.
Whether you like that or not will probably come down to personal preference.
Thereās also an optional Phone Link panel that slides in from the side when you need it and stays hidden when you donāt. Itās designed to make your connected phone feel closer to your desktop without cluttering the interface.
Now, hereās the honest bit.
If you already disliked the current Windows 11 Start menu, this probably wonāt change your mind. Itās an evolution, not a throwback to Windows 7.
And no, you still canāt move the taskbar. Microsoft says that would break the UI flow and animations, which hasnāt silenced the debate š¤«
The bigger question is practical: Does this make it faster for your team to find what they need?
Because when someone wastes 30 seconds hunting for an app, ten times a day, across twenty employees⦠that adds up.
š¬ When you use your PC, do you mostly click pinned apps, or do you rely on search to find everything?
Have you ever gone into Windows settings to check your storage⦠and been hit with one of those āDo you want to allow this?ā pop-ups?
Thatās not random š±
Windows 11 has introduced a security change that affects the Storage section inside Settings.
Now, when you open Settings ā System ā Storage, Windows triggers a User Account Control (UAC) prompt.
UAC is the security pop-up that asks for permission before allowing changes that could affect the system.
If youāre using an admin account, you click āYesā and carry on as normal.
But if youāre not an admin, and on a business machine where staff have standard user accounts you may not be, youāll be blocked from accessing the Storage panel unless you enter the admin password.
In simple terms, Windows is putting a small lock on the storage controls š
Storage settings allow you to delete files, manage drives, and remove system data.
If someone with limited access decided to start ācleaning upā without understanding what they were deleting, it could cause problems.
It also adds a minor extra hurdle if an unauthorized person gains access to the machine locally.
Itās not going to stop a determined attacker on its own, but layered security is about reducing easy wins.
From a business perspective, this is sensible.
In most companies, staff shouldnāt have full control over system storage anyway. Limiting access to more sensitive settings reduces accidental damage.
The only slightly awkward part is that this change arrived without warning. The first time the pop-up appears, it can feel confusing because it didnāt happen before.
It also adds an extra click to what used to be a seamless process.
Thereās also a small wrinkle at the moment. Some temporary file cleanup options (related to old Windows updates and drivers) seem to have disappeared from the Storage panel.
They can still be removed using the older Disk Cleanup tool, but Microsoft will likely tidy that up.
Overall, Iād rather see Windows lean slightly more secure than slightly more convenient, wouldnāt you?
š Are your team members using standard accounts or does everyone still have admin access just in case?
If I asked you where your biggest security risks sit, youād probably say email, passwords, or maybe remote access, right?
Very few business owners would point at Excel or PowerPoint.
And yet, Office apps are one of the most common entry points attackers use ā ļø
Thatās why Microsoft has released an updated security baseline for Microsoft 365 Office apps.
Itās a tightening of the screws behind the scenes šŖ
In simple terms, a security baseline is Microsoftās recommended āsecure settings templateā.
IT admins can apply it to make Word, Excel, PowerPoint and the rest more resistant to modern attack methods.
This latest version focuses heavily on reducing the risk created by older components and external connections.
Take Excel, for example. If a spreadsheet contains a link to pull in data from an external source, and that source is blocked under your security rules, Excel will now refuse to refresh it.
You will see an error instead.
Attackers often hide malicious data connections inside spreadsheets.
If Excel automatically reaches out to an untrusted source, that can create an opportunity for compromise.
Stopping that automatic refresh removes a potential weakness.
In PowerPoint, Microsoft is disabling OLE content.
OLE (Object Linking and Embedding) is a long-standing technology that allows content from other applications to be embedded into files.
It has legitimate uses, but it has also been exploited in the past. Reducing reliance on older embedding mechanisms lowers the risk profile.
Across all Microsoft 365 apps, there are further changes, including:
š Blocking documents that try to use non-HTTPS web connections (HTTPS is the encrypted, secure version of web traffic)
šDisabling older graph components that arenāt widely used anymore
š Turning off legacy add-ins like the classic OrgChart
š Preventing fallback to outdated network protocols
Microsoft is steadily moving businesses away from older technologies that attackers know how to abuse.
For you, the important thing is this: These stronger settings need to be deployed by your IT team using Microsoftās Security Compliance Toolkit. They donāt automatically switch on everywhere.
š¤ When was the last time someone reviewed how your Office apps are configured, not just whether theyāre up to date?
If youāve ever logged into SharePoint late at night to fix something quickly, youāll understand this one š
Microsoft is adding dark mode to the SharePoint admin center.
Now, before you think this is just a cosmetic tweak, hear me out š
For years, most of the Microsoft 365 admin portals have supported dark mode. Exchange. Teams. The main Microsoft 365 admin center.
But SharePoint? Bright white screen.
Every time.
If you prefer dark mode (and a lot of people do), jumping into SharePoint always felt a bit⦠jarring.
Thatās finally being fixed š
Admins will now be able to switch between light and dark themes inside the SharePoint admin center.
Itās optional. Nothing is being forced on anyone.
And importantly:
⢠This doesnāt change any settings
⢠It doesnāt affect end users
⢠It doesnāt require any preparation
⢠Itās purely about visual comfort and accessibility
Dark mode reduces the amount of bright light your screen emits. For people working long hours, or logging in during the evening to deal with an issue, it can reduce eye strain and make the experience more comfortable š
Itās not going to revolutionize your business, but small quality-of-life improvements matter more than people think.
Thereās also a consistency benefit here.
If youāve already chosen dark mode across other Microsoft 365 portals, SharePoint will now align with that preference instead of standing out like a floodlight.
Switching it on is simple: Open the SharePoint admin center from the Microsoft 365 admin portal and use the Dark Mode toggle in the top right.
Thatās it.
I often say that good IT isnāt always about dramatic new features. Sometimes itās about making everyday tools slightly more pleasant to use.
š If you regularly manage SharePoint, do you prefer dark mode across your tools or are you still sticking with the classic bright white screens?