This Week in IT Security
It’s been a busy week in IT — and not in a good way. Security threats dominated the headlines, with a couple of stories that should genuinely make you rethink how you handle passwords and device security when you’re away from home. Here’s what caught our eye.
Hackers Broke Into Hotel Rooms to Backdoor Executives’ Laptops
This one reads like a spy thriller, but it’s very much real. A Chinese state-linked hacking group targeted business executives attending an agricultural industry conference in China earlier this year. Rather than sending dodgy phishing emails, the attackers physically broke into hotel rooms while their targets were at dinner, booted up the executives’ laptops from a USB stick, and installed a backdoor — all before anyone returned from the main course.
Security firm CrowdStrike tracked the group and published details this week. The particularly frustrating part? A known fix existed that would have prevented the USB boot attack — but most of the affected companies simply hadn’t applied it.
What this means for you: If you travel for work, enable full-disk encryption and set a BIOS/firmware password so your laptop can’t be booted from external devices. And never leave your laptop unattended in a hotel room without at minimum locking it in the safe.
Claude Code Is Leaking Passwords Into Public GitHub Repos
This is a big one for anyone using AI coding tools. Anthropic’s Claude Code assistant has a “Don’t ask again” approval feature that’s meant to save developers from repeatedly confirming the same commands. The problem is that it logs those commands — word for word — into a project settings file. If that file ends up in a public GitHub repository (which happens more than you’d think), any secrets you typed into those commands, including passwords and API keys, go with it.
Security researchers found over 1,100 public GitHub repositories already containing exposed credentials thanks to this behaviour. Claude Code users, particularly developers working on small business projects, should audit their repositories immediately and rotate any potentially exposed keys or passwords.
What this means for you: This is a good reminder never to type sensitive credentials directly into AI tool prompts or commands. Store secrets in a dedicated password manager — something like NordPass keeps credentials out of chat logs and command histories entirely. And if you use Claude for coding work, check your public repos now. You can read more about how Claude compares to other AI assistants in our Claude guide.
SonicWall Users: Patch This MFA Bypass Flaw Now
If your small business uses SonicWall networking equipment — particularly for VPN or firewall purposes — pay attention to this one. A high-severity vulnerability has been added to the US government’s catalogue of actively exploited security flaws. The bug allows attackers to bypass multi-factor authentication on SonicOS, the operating system that powers SonicWall devices.
A CVSS score of 7.1 to 7.5 puts this firmly in “high severity” territory, and with reports of real-world exploitation already circulating, this isn’t one to sit on. SonicWall has issued a patch — if you haven’t applied it, now is the time.
What this means for you: Log into your SonicWall admin panel and check for firmware updates immediately. If you manage this remotely, tools like Splashtop make it straightforward to access and update network devices without needing to be on-site. And while MFA is still worth having, this flaw is a reminder that it’s one layer of security, not a complete solution on its own.
OpenAI Says AGI Is Here With GPT-6 Astra
On a lighter note, OpenAI made a genuinely jaw-dropping announcement this week: GPT-6 Astra, which the company is calling the beginning of the AGI era — meaning AI that can outperform humans across most economically valuable tasks. It’s a bold claim, and the AI world is still chewing over what it means in practice. Expect this to filter into the productivity tools many of us already use day to day.
What this means for you: Keep an eye on updates to your existing AI tools — the gap between cutting-edge research and consumer products is closing fast.
That’s your week in IT. Two serious security stories that deserve action today (check those repos, patch that SonicWall), one physical security reminder for anyone who travels with a work laptop, and one piece of AI news that’ll be worth watching over the coming months. Stay patched, stay sceptical, and we’ll see you next week.