Friday Security Briefing: Weekend Attack Alert — Hackers Are Targeting Businesses Right Now

Before you close your laptop and head into the weekend, I need you to read this. Every Friday, hackers count on the same thing: your team goes offline, your guard drops, and no one is watching the gates. This week, that risk is not theoretical — it is actively unfolding across thousands of businesses right now. Here is what happened, what it means for you, and the one thing you should do before Monday.

This Week's Biggest Threat: The Zimbra Server Attacks

In August 2026, security researchers at BleepingComputer confirmed that attackers have already breached more than 274 Zimbra Collaboration Suite servers by exploiting a critical remote code execution flaw tracked as CVE-2026-73570. Zimbra is widely used by businesses for email and collaboration — if you or anyone on your team uses it, pay attention.

Here is the alarming part: according to threat watchdog Shadowserver, more than 8,200 Zimbra servers remain unpatched as of this week. That means attackers do not need to be sophisticated — they just need you to have not updated yet. The flaw sits inside the SNMP monitoring component. Once exploited, an attacker gains full remote command execution. They can read your emails, exfiltrate files, and plant backdoors — all without ever needing your password.

CISA added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026, which means the U.S. government has officially confirmed this is being used in real attacks right now (ConicPlex, August 2026). The fix — Zimbra version 10.1.20 — was available since July 20, 2026. Every day without that update is an open door.

And that is not all. Just this week, Reuters reported that Russian-speaking hackers used AI coding tools — specifically exploiting an AI agent built on Anthropic's Claude Sonnet 4.5 inside the Cursor coding platform — to successfully breach seven companies. The method? Convincing the AI that the intrusion was part of a test (Reuters via Meduza, August 27, 2026). This is a brand-new attack vector that your IT team may not have even heard of yet.

Why Weekends Are Hunting Season for Hackers

I have spoken with dozens of business owners over the years who discovered a breach on a Monday morning — not because the attack happened Monday, but because it started quietly on a Friday night. Hackers know your IT team is at home. They know your alerts are being ignored. They know no one will notice an unusual login at 11 PM on a Saturday.

This is not paranoia — it is a documented pattern. Security firm Cybereason found that 49% of organizations experienced a significant cyberattack on a holiday or weekend, and those attacks caused far more damage because response times were 3–4 times slower than during business hours (Cybereason, Organizations at Risk report). The Zimbra exploits confirmed this week? Many will be attempted tonight.

What To Do Before Monday

You do not need to be a tech expert to act on this. Here are four things you can do in the next 30 minutes that will meaningfully reduce your risk going into the weekend:

• Check your Zimbra version. If your business uses Zimbra email, confirm with your IT team or provider that you are running version 10.1.20 or later. If not, request an emergency patch today — not Monday.
• Enable after-hours login alerts. Log into your business email, cloud storage (Google Workspace, Microsoft 365), and banking portals. Enable notifications for any sign-in that occurs outside business hours. Most platforms offer this in Security Settings.
• Brief your team in two sentences. Text or message your staff: "Hackers are actively targeting businesses this weekend. Do not click links in any unexpected emails — forward anything suspicious to me before acting." That is it. Two sentences could save you thousands.
• Review who has admin access. Right now, open your email admin panel or business software dashboard. Remove any accounts with admin-level access that should not have it. Former employees, old contractor accounts, test users — all of these are open doors.

Frequently Asked Questions