centrexIT

10/05/2026

Five team members. 20+ years each at centrexIT.

James Desson, Jomer Magtoto, Francisco Benitez, Agustin Cervantes, and Dylan Natter have been with us through every shift in technology and every client challenge, and they're a big reason our clients trust us.

To celebrate, we brought them and their families together in a Padres suite for the Padres vs. Marlins game. Waiting for them: custom #20 jerseys with their names on the back.

The jerseys were made right here in San Diego by Sports Fan Sewing. And a huge thank you to Aubree and the San Diego Padres for helping us keep the whole thing a total surprise.

Thank you for everything you've built here. Here's to the next 20.

09/24/2026

Google just released a September Android update that patches 180 vulnerabilities, after two months of reporting none. According to SecurityWeek, one critical flaw is a Wi-Fi bug that needs no clicks to exploit.

For nonprofits, the risk is not just phishing. It is every unpatched phone in the office, including that drawer of spare devices nobody owns. Those phones often hold donor lists and event payment access.

Here is what to check this week, no IT budget required: https://na2.hubs.ly/H07_QQQ0

09/17/2026

If anyone on your team uses Outlook on a Mac, this one is worth two minutes of your week.

Microsoft is retiring the protocol that legacy Outlook for Mac uses to reach Microsoft 365 on October 1, 2026, and its guidance is that the legacy version stops working against Exchange Online mailboxes starting that month. The fix is a single toggle inside the app. Turn off the Legacy Outlook switch and it reloads into the current version. About ten seconds.

The point is not the toggle. It is that quiet, scheduled software changes are the ones that eat a whole team's morning, and somebody should be reading the roadmap far enough ahead that it lands as a heads up instead. Full breakdown, including who is affected and who is not: https://na2.hubs.ly/H07V4YS0

Microsoft retires the protocol behind legacy Outlook for Mac on October 1, 2026. Here is what changes, who it affects, and the one toggle that moves your team across before it breaks.

09/14/2026

The phone rings on a Tuesday. The caller says they are from your IT help desk, they know your name, and they say your passkey needs updating right now. That is an attack Microsoft just disclosed, and it works on careful people.

Microsoft documented two campaigns: an AI-assisted CEO fraud operation that sent over a million scam emails in three days, and a passkey-themed campaign that takes over Microsoft cloud accounts by calling employees on their personal phones. In some cases, Microsoft said, the attackers never needed the password.

We wrote up what to check in your Microsoft 365 tenant this week. Read it here: https://na2.hubs.ly/H07Qkng0

09/11/2026

Cisco disclosed this month that three threat clusters exploited two patched Firewall Management Center flaws to steal credentials and, in one case, deploy Qilin ransomware. According to The Hacker News, the more severe flaw scores a 10.0 and is now on CISA's Known Exploited Vulnerabilities list with a September 12 deadline for federal agencies.

For biotech and medical device companies, the concern is not just downtime. It is research IP leaving quietly, and the data integrity questions that follow a ransomware event. Here is what to check and the questions to ask your IT provider today: https://na2.hubs.ly/H07N1p60

09/10/2026

Nobody was hacked in the AI incident Anthropic disclosed this week, and that is exactly why it matters.

According to The Hacker News, a Claude model breached real third-party systems during a cybersecurity evaluation. It was told it was in an offline simulation, but a misconfiguration connected it to the open internet, so it took real actions while believing it was only practicing.

If your business is rolling out AI agents that can do real work, the lesson is simple: an agent's understanding of what is real is only as reliable as the boundaries you built around it. We wrote up what to check before you deploy one:

https://na2.hubs.ly/H07K_lQ0

09/09/2026

A cybercrime group added the State of Florida DMV to its data leak site last week and set a deadline: make contact by September 11 or the alleged files go public.

Florida did not choose that date. The attacker did.

That is the part worth sitting with. A state agency needs time to confirm an intrusion, scope what was touched, involve counsel, and coordinate with federal law enforcement. Four days generates headlines. It does not permit a forensic review.

The claim itself is unconfirmed. CyberInsider could not independently verify it. FLHSMV has not publicly acknowledged an incident. But the tactic works whether or not the files are real, because the countdown starts either way.

Two things worth deciding at your own company before you ever need them:

Who can reset an account without a second human verifying the request? Account recovery is the least-watched door in most businesses.

And who declares an incident, who calls counsel, who holds the public line? A decision made under someone else's countdown is not a decision.

https://na2.hubs.ly/H07JhDm0

09/04/2026

Five healthcare providers in five different states reported ransomware-related data breaches in a single HIPAA Journal roundup this month. A specialty group in California, a behavioral health provider in Maine, a 60-bed hospital in Missouri, and two more.

Different sizes, different specialties, same story. The clearest difference in how these played out was detection speed. According to HIPAA Journal, one provider caught the attack the same day and blocked access within an hour. Another had roughly a month of quiet access first.

We wrote up what these breaches share and six things any practice can work through now. Read it here: https://na2.hubs.ly/H07DKWv0

09/02/2026

You turned on MFA. Your team uses the app, not text codes. So how did an attacker get into a finance account without ever knowing the password?

Modern phishing kits relay everything to the real login page in real time, the password and the MFA code, and then steal the session token the service hands back. The attacker replays that token and skips the login entirely. Your logs just show a successful sign-in.

The good news: FIDO2 security keys and passkeys stop this cold, because they refuse to authenticate to a fake site. We wrote up the five steps we recommend, in order, starting with your highest-risk accounts: https://na2.hubs.ly/H07B5-y0

08/31/2026

Microsoft Threat Intelligence just detailed a ransomware group called DeadLock, and the interesting part is where it hides its command-and-control. DeadLock moved parts of that infrastructure onto smart contracts on the Polygon blockchain, using them as a configuration store that points victims to its negotiation chat and leak site. Microsoft says that likely makes parts of their setup more resilient.

But here is the thing for professional services firms. The blockchain trick is about how hard they are to shut down, not how they get in. They still break in the old way, through unpatched software and stolen passwords. That part you control.

We put together the recommended Microsoft patches to prioritize this week and why patch management is the unglamorous work that keeps you off the victim list.

https://na2.hubs.ly/H07y0T00