While most owners were busy with the summer rush, attackers had a record season. New website flaws arrived by the hundreds every week, scam calls started using cloned voices, and some break-ins were run largely by software. None of it required a big target. Small businesses are often the easiest door in.

• Attacks on websites now begin within hours of a flaw going public, so updates on a schedule are no longer optional
• AI has made scam calls and emails convincing enough that a familiar voice or signature is no longer proof
• The AI tools your staff use every day are now part of your security, for better or worse

Five hours

Most small business websites run on WordPress, and most of WordPress runs on plugins: the add-ons that handle forms, booking, shopping carts and page layouts. Security firm Patchstack counted 11,334 new WordPress vulnerabilities in 2025, up 42 percent from the year before, and 91 percent of them were in plugins. The number that should worry an owner is a different one. Patchstack found the typical time between a flaw going public and attackers exploiting it at scale was five hours.

Five hours is less than a business day. A site that gets updated “when someone remembers” is a site that sits open for weeks. And this fall, the problem reached WordPress itself. On October 28, WordPress released version 7.1.4 to close a flaw in the core software that could let an attacker run code on a server while the site was updating. On November 3, the federal Cybersecurity and Infrastructure Security Agency added it to its list of vulnerabilities being actively exploited. If your site is not on 7.1.4 or a patched release for its branch, it should be today.

A familiar voice is no longer proof

The FBI’s Internet Crime Complaint Center logged nearly $21 billion in reported losses for 2025. Business email compromise, where a criminal poses as a boss, a vendor or a lawyer to redirect a payment, accounted for more than $3 billion of it. More than 22,000 complaints involved AI.

The technique has grown up fast. In early November, federal prosecutors described a scheme in which three men used AI-generated voice and video to impersonate company executives and attorneys, taking at least $129 million from the accounting staff who could approve wire transfers. Researchers at Check Point found that trained observers could pick out an AI-generated face only 41 percent of the time. If professionals cannot tell, your bookkeeper should not have to. The defense is a rule, not a skill: any request to change where money goes gets a callback to a number you already have on file. Never the number in the email.

The doors you did not know were open

Verizon’s 2026 Data Breach Investigations Report found that a third party, such as a vendor, a contractor or a piece of outside software, was involved in 55 percent of breaches at small and midsize businesses. Every plugin, app and service you connect is a key to your building, and you are trusting whoever holds a copy.

AI adds a new set of keys. IBM’s 2026 Cost of a Data Breach study tied unapproved AI tools, the chatbots and assistants employees sign up for on their own, to 43 percent of breaches. Nobody means harm. An employee pastes a customer list into a free tool to save an afternoon, and that list now lives somewhere you do not control.

Three habits for 2027

You do not need to become a security expert. You need a few habits that hold even on a busy week:

• Update on a schedule, and back up first. Critical fixes the same day, everything else on a regular cycle, with an offline backup you have actually tested.
• Turn on two-step login everywhere money or customer data lives. Email, banking, your website, your Google Business Profile. Passkeys are better still where they are offered.
• Write a one-page AI policy. Which tools are approved, what information never goes into them, and that a person checks anything that leaves the building.

The summer of 2026 made one thing clear: the gap between a problem and an attack is now measured in hours, not months. The businesses that come through safely are not the ones with the biggest budgets. They are the ones with someone watching every week. If you are not sure when your site was last updated, request a free site security check.

Peregrine Digital Media · Albuquerque, New Mexico · 505-296-0419 · peregrinedigital.com