Tonight’s technology picture is less about one flashy launch and more about trust: trust at a shipping terminal, on a hotel Wi-Fi sign-in page, inside a Microsoft 365 login, in open-source dependencies, and in the components inside the next PC. Here is The IT Guys’ source-checked 5 PM technology news recap for Friday, August 7, 2026.
Listen to Jennifer’s 5 PM recap
This is a locally synthesized narration prepared from the same verified rundown as the article.
What matters tonight
- Infrastructure: North Carolina Ports is recovering from a cyberattack that pushed some work to manual processing. The Coast Guard is monitoring, while attribution and the initial access path remain undisclosed.
- Identity security: Greatness phishing-as-a-service has reportedly added device-code phishing alongside adversary-in-the-middle methods, giving criminals another way to steal Microsoft 365 sessions even when multifactor authentication is enabled.
- Traveler warning: Microsoft says a Russian state-linked cluster has compromised some hotel and venue captive portals to target travelers with credential theft and malware.
- Software governance: CISA’s new federal open-source guide turns “know what you run” into a full lifecycle discipline covering inventories, project trust, updates, end-of-life planning, contribution and open-source AI.
- PC supply chain: Nikkei reports limited use of China’s CXMT memory by HP, Asus and Acer in some non-U.S. notebooks as the DRAM market remains tight. The model list, volumes and expansion plans are not public.
- Windows deadline: Windows Insiders on older Beta or Experimental builds should install a refreshed build before the current flight certificate expires August 11. This is not a deadline for ordinary Windows 11 PCs.
The broadcast rundown
| Story | Confirmed facts | Practical move |
|---|---|---|
| North Carolina Ports cyberattack | Attack detected August 4; IT disruption, manual work and recovery across three facilities; Coast Guard monitoring. | Businesses dependent on logistics should test offline contact lists and manual order, gate and billing procedures. |
| Greatness and device-code phishing | Researchers report Microsoft 365 adversary-in-the-middle and device-code options in a commercial phishing service. | Never enter a device code you did not initiate. Audit or block device-code authentication where it is not needed. |
| Compromised captive portals | Microsoft assesses that Storm-2945 compromised hospitality sign-in portals to target travelers. | Treat a network login page as untrusted; avoid entering work credentials and use a known VPN or mobile hotspot for sensitive work. |
| CISA open-source guide | Federal guidance covers inventory, trust evaluation, secure use, contribution, publication and end-of-life. | Inventory critical dependencies, assign owners and document a replacement plan before a project is abandoned. |
| PC memory sourcing | Limited CXMT use is reported for some non-U.S. notebooks; details remain sparse. | Buy for verified configuration and warranty, not a component rumor. Record exact RAM capacity and upgradeability. |
| Windows Insider certificate | Microsoft says the current flight certificate expires August 11; current builds contain renewed certificates. | Insiders should update now. Regular Windows users should not install preview builds just because of this headline. |
North Carolina Ports recovers after cyberattack slows digital operations
The facts: Reporting from The Record, CyberScoop and BleepingComputer says North Carolina Ports detected the incident on August 4 and activated its cybersecurity contingency plan. The Port of Wilmington, Port of Morehead City and Charlotte Inland Port continued operating, but affected work moved to manual processes while systems were assessed and restored. The U.S. Coast Guard said it was monitoring the aftermath. Public reporting at the 5 PM cutoff did not identify the actor, the initial access method, stolen data, a ransom demand or a full restoration time.
Why it matters: A port’s cranes and ships are only the visible half of the operation. Appointments, credentials, cargo records, gate access, customs documents, billing and communication all depend on IT. A contained attack can therefore become a physical-world delay without the attacker touching industrial controls.
The authority had a contingency plan, reported that the attack was contained and kept facilities on a normal operating schedule while recovery continued. Manual procedures are slower, but they keep essential work moving.
“Contained” does not mean “fully understood.” Until investigators disclose the intrusion path, persistence checks, data exposure and restoration status, confident claims about the attacker or impact would be speculation.
What local businesses can learn
- Print a short emergency contact sheet for carriers, vendors, payroll, banking and IT support.
- Document how to receive orders, approve a shipment and record payment when the normal platform is offline.
- Keep immutable or offline backups for the systems that run scheduling, billing and inventory.
- Practice a 30-minute outage drill: who has authority, what gets paused and how do you reconcile manual records later?
For a workstation-level response plan, keep The IT Guys’ first 15 minutes of a ransomware incident checklist nearby.
Device-code phishing expands the ways criminals can get around MFA
The facts: ZeroBEC’s August 4 research and follow-up coverage describe Greatness as a Telegram-distributed phishing-as-a-service operation that combines adversary-in-the-middle token theft with device-code phishing against Microsoft 365. Commercial pricing and service features are researcher-reported claims, not a vendor filing or law-enforcement finding. The important mechanism is well understood: a victim is persuaded to enter a code at a legitimate Microsoft page, but the code belongs to a sign-in session initiated by the attacker.
Why a real Microsoft page can still be dangerous: The domain may be authentic while the request is not. Device-code sign-in is designed for devices with awkward input—televisions, command-line tools or appliances. A criminal can start that flow, send the resulting code to a target and invent a reason to approve it. If the victim complies, the legitimate identity provider finishes the attacker’s waiting session.
This technique depends heavily on persuasion. A clear rule—never approve a code you did not initiate—can stop the attack before a token exists. Organizations can also restrict authentication flows with Conditional Access when legitimate operations do not require them.
A password reset by itself may not terminate every active cloud session. Incident response should include session revocation, token review, sign-in-log analysis, mailbox-rule checks and validation of registered authentication methods.
Do this now
- Tell staff that support personnel should never send an unexpected device code through email, Teams, text or a document portal.
- Inventory legitimate device-code usage before blocking it; avoid breaking a known appliance or command-line workflow without a tested alternative.
- Alert on unusual device-code sign-ins, new inbox rules, unfamiliar OAuth grants and access from unexpected countries or networks.
- If compromise is suspected, disconnect the affected session from sensitive systems, preserve logs, revoke sessions and refresh credentials from a known-clean device.
Device-code defenses complement basic endpoint hygiene. On managed Windows fleets, also avoid a shared local administrator password; see our practical guide to Windows LAPS.
Microsoft warns that some hotel and venue sign-in portals were turned into attack paths
The facts: Microsoft Threat Intelligence says Storm-2945, which it describes as a sub-cluster of the Russian state-linked Midnight Blizzard actor, compromised captive portals associated with hospitality organizations from May 2026. Microsoft calls the activity “CaptiveCrunch” and says it was used to deliver malware and steal credentials from travelers. The actor attribution is Microsoft’s assessment; public evidence does not establish that every hotel Wi-Fi problem is part of this operation.
Why it matters: Captive portals train travelers to click through unfamiliar pages before gaining internet access. That expectation creates cover for fake updates, copied login screens and “verify your work account” prompts. Executives, government personnel, technicians and sales teams can carry access to email, files, remote-management systems and customer data while traveling.
You can sharply reduce exposure without abandoning public Wi-Fi: use a mobile hotspot for sensitive work, keep software current, use phishing-resistant passkeys or security keys where supported and run a trusted VPN before accessing internal systems.
A familiar hotel logo and HTTPS padlock prove very little about the business behind the page. Never install an “internet access” update or enter Microsoft 365 credentials just because a portal asks.
Traveler checklist
- Confirm the network name with venue staff; attackers can create convincing look-alike access points.
- Use cellular service or a company-managed hotspot for banking, administration and remote support.
- Do not approve MFA prompts or device codes that appeared only after joining a network.
- Disable automatic Wi-Fi joining and forget the network when the trip is over.
- If a phone is lost during travel, use our first-hour stolen-phone lockdown checklist.
CISA’s open-source guide turns a vague risk into a lifecycle checklist
The facts: CISA published Open Source Software: Security Principles and Practices on July 30 for federal agencies that use, evaluate, contribute to or release open-source software. Secondary coverage highlights the agency’s “C4” evaluation lens—Codebase, Community, Conduct and Configuration—plus inventory, software bills of materials, vulnerability monitoring, secure contribution, support expectations and end-of-life planning. The guidance also addresses open-source AI systems. It is federal guidance, not a new private-sector mandate.
Why it matters to a small business: “Open source” is not one risk level. A mature, well-maintained project may be safer than opaque software with weak support. A popular package can still become dangerous when nobody owns updates, a critical dependency is abandoned or a default configuration exposes more than intended.
The guide encourages evidence over branding: inspect maintenance activity, security practices, release integrity, community health and configuration. It also recognizes that contributing fixes and funding maintenance can reduce shared risk.
An SBOM is a map, not a shield. If nobody reviews it, tracks versions and decides when to replace an abandoned component, the inventory becomes paperwork rather than protection.
A practical five-question review
- Where is it? Which servers, PCs, websites, containers or AI workflows depend on the component?
- Who owns it? Name the person responsible for updates, risk decisions and vendor or community contact.
- Is it maintained? Review release cadence, security policy, issue response and supported versions.
- What breaks if it disappears? Document backups, data export, replacement options and rollback.
- What is exposed? Minimize internet reach, privileges, secrets and unnecessary modules.
Source-access note: CISA’s canonical page returned an automated-access denial to our verification client at the cutoff. We preserved the official URL and cross-checked the publication date and guidance themes against accessible reporting rather than pretending the blocked fetch succeeded.
Limited CXMT memory use is reported as PC makers look for DRAM supply
The facts: Nikkei Asia reports, citing unnamed sources, that HP, Asus and Acer have begun using small amounts of DRAM from China’s ChangXin Memory Technologies in a limited number of notebooks intended for markets outside the United States. Tom’s Hardware preserved that narrow scope in follow-up coverage. No public model list, purchase-order data, shipment totals or independent teardown set was available in the material reviewed. Separately, TrendForce forecasts that DRAM supply will remain tight into 2027. That is an analyst forecast, not a guarantee.
Why it matters: Memory sourcing affects availability, price, qualification, repair and geopolitical compliance. It does not automatically tell a buyer whether one laptop is fast, secure or reliable. Those judgments require model-specific testing and documentation.
Additional qualified supply can reduce a single-source bottleneck and help manufacturers keep systems shipping during a tight market.
The report is easy to overstate. “Small amounts,” “limited models” and “non-U.S. markets” do not support claims that every laptop from the named brands has changed memory or that a particular retail model contains CXMT parts.
Buying advice
- Verify the exact model number, installed RAM, channel configuration and whether memory is soldered or replaceable.
- For business fleets, ask the supplier whether component substitutions can occur under the same stock-keeping unit.
- Buy from a seller with a clear return policy and retain the configuration record from the day of purchase.
- Do not turn a supply-chain report into a security accusation without model-specific evidence.
Windows Insiders face an August 11 flight-certificate deadline
The facts: Microsoft’s Windows Insider Blog says the current Insider flight certificate expires August 11, 2026. Builds released for the Beta and Experimental channels include renewed certificates, and Microsoft directs devices to update to a current build so they remain supported for future Insider flights. This applies to preview-test devices, not ordinary Windows 11 production PCs.
Why it matters: A dramatic “update by August 11 or else” headline can lead everyday users to install preview software they do not need. The safer interpretation is narrow: if a PC is already enrolled in the affected Insider channel, update it now; if it is a normal production PC, continue with the standard supported update path.
Microsoft gave advance notice and shipped builds with renewed certificates. An enrolled test device can usually resolve the issue through its normal Windows Update path.
Preview builds can contain bugs and should not be adopted on a work-critical PC merely to chase features. Back up important data and confirm the enrolled channel before changing anything.
Quick check
- Open Settings → Windows Update → Windows Insider Program.
- If the device is in Beta or Experimental, check for updates and install the current offered build.
- Restart, return to Windows Update and confirm no additional build is waiting.
- If the device is not enrolled, this certificate deadline is not a reason to enroll it.
No new same-day Apple emergency selected at the 5 PM cutoff
Apple’s security-release index was checked for this edition, but no new August 7 item met the source and materiality gate before publication. That is not an “all clear” for unpatched Macs. Apple’s August 6 Screen Sharing security updates remain the actionable item: review The IT Guys’ Mac update guidance and install the appropriate supported update after a current backup.
On AI, tonight’s strongest practical angle is governance rather than a product launch: device-code attacks show how identity workflows can be abused, while CISA’s open-source guidance reminds organizations to inventory the models, libraries, agents and connectors they deploy. An AI label does not remove ordinary responsibilities for access control, logging, data handling and software maintenance.
Five things to do before Monday
- Brief travelers: Do not install software or enter work credentials because a hotel Wi-Fi portal asks.
- Set the device-code rule: Never approve a code you did not initiate; audit whether the business needs device-code authentication at all.
- Test one manual process: Write down how to keep taking orders or supporting customers during a cloud or internet outage.
- Assign an owner to open-source dependencies: Start with the website, remote-support stack, password manager and any AI automation.
- Update preview PCs only: Bring affected Windows Insider systems current before August 11; leave ordinary production PCs on their supported channel.
If you missed yesterday’s edition, read the August 6 technology news recap for the macOS Screen Sharing patch, AI-agent safety, token theft and other developments.
Frequently asked questions
Did the North Carolina Ports attack stop all port operations?
No. Public reporting says facilities continued operating, with affected functions slowed or moved to manual processes while systems were restored. The exact scope and full recovery timeline were not public at the cutoff.
Can device-code phishing defeat multifactor authentication?
It can bypass the protection users expect from MFA when a victim is tricked into authorizing the attacker’s waiting sign-in. The lesson is not that MFA is useless; it is that the user must verify the context of every approval. Phishing-resistant methods and Conditional Access can reduce the risk further.
Is hotel Wi-Fi always unsafe?
No, but it should be treated as an untrusted network. Confirm the network name, avoid entering work credentials into captive portals, use a trusted VPN or mobile hotspot for sensitive activity and keep devices updated.
Does CISA’s guide ban open-source software?
No. The guidance is about using, evaluating, contributing to and releasing open source more safely. It emphasizes inventory, project trust, secure configuration, updates, support expectations and responsible participation.
Are HP, Asus and Acer laptops in the United States switching to CXMT memory?
The reviewed report does not establish that. It describes small amounts in a limited number of notebooks for non-U.S. markets. Buyers should verify a specific model rather than generalize from the report.
Does every Windows 11 PC need a special update before August 11?
No. The cited deadline concerns Windows Insider preview flight certificates. Regular Windows 11 systems should continue installing their normal supported updates.
Sources checked for this edition
- The Record: North Carolina Ports cyberattack and recovery
- CyberScoop: Coast Guard monitoring the North Carolina Ports incident
- BleepingComputer: incident timeline and operational disruption
- ZeroBEC: Greatness AiTM and device-code phishing research
- The Hacker News: Greatness PhaaS device-code coverage
- Microsoft Threat Intelligence: CaptiveCrunch
- CISA: Open Source Software—Security Principles and Practices
- Help Net Security: CISA open-source guidance overview
- Nikkei Asia: reported limited CXMT adoption
- Tom’s Hardware: scope and caveats of the CXMT report
- TrendForce: DRAM supply forecast
- Windows Insider Blog: renewed flight certificates
- Apple security releases index
Research cutoff: August 7, 2026 at 5:07 PM Eastern. The article separates confirmed facts, vendor or researcher assessments, analyst forecasts and unresolved questions. Source timestamps and HTTP results are preserved in the local publication ledger.