Security alerts
Actively exploited vulnerabilities and urgent patches for the gear small offices actually run: firewalls, VPNs, phone systems, Windows, and Microsoft 365. Each alert covers who's affected and what to do, checked against the vendor's advisory and CISA.
Follow alerts with RSS · alerts also appear under their regular topics
- Phones & PBXSecurity alert
FreeSWITCH phone systems need version 1.11.3 now — CVE-2026-116779 is being exploited
A critical FreeSWITCH flaw that allows command execution through SIP text messages is on CISA's exploited list. Here's who is affected and what to do.
- NetworksSecurity alert
VMware ESX logging flaw is on CISA's exploited list: patch the whole advisory, because it also fixes critical bugs
CVE-2026-41709 is a low-severity ESX flaw, but CISA lists it as exploited. The same Broadcom advisory fixes critical vCenter and ESX flaws. Here is what to check and install.
- Tech basicsSecurity alert
Update WordPress to 7.1.4 or your branch's latest release: a flaw in the update process is being exploited
CISA added a WordPress core flaw to its exploited list on November 3. Sites that update normally are protected once on a fixed release, and auto-updates should deliver it.
- NetworksSecurity alert
Cisco ASA and FTD firewalls: an exploited VPN flaw can force reboots, and the fix is a software update
CVE-2026-76418 lets an unauthenticated attacker crash Cisco ASA and FTD firewalls that use secondary authentication on the SSL VPN. It is exploited now. Here is how to check and what to install.
- NetworksSecurity alert
Brotli decoder flaw is being exploited: check Node.js, .NET and Linux packages
CVE-2026-111497 is a critical memory flaw in the Brotli decompression library that CISA says is exploited. Here is which software carries it, which versions are fixed, and how to check.
- NetworksSecurity alert
Patch self-hosted Jira, Confluence, and Bitbucket: an unauthenticated file-access flaw is now on CISA's exploited list
CVE-2026-21589 affects eight Atlassian Data Center products. CISA listed it as exploited on October 15. Here's who is affected, which versions fix it, and what to do if you can't patch yet.
- Tech basicsSecurity alert
PHP2Shell: two critical flaws in PHP itself are being attacked, and updating WordPress won't fix them
Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) let attackers run code on web servers. Here is who is affected, what to ask your host, and what IT should patch.
- Tech basicsSecurity alert
Install October's Windows updates: an exploited flaw lets a booby-trapped file skip Windows' safety warning
Microsoft says attackers are already exploiting a Windows Shell flaw that bypasses Mark of the Web. Here is what that means, which updates fix it, and how to check your PCs.
- NetworksSecurity alert
Fortinet path traversal flaw is now exploited: what to patch and who it affects
CISA added a Fortinet path traversal flaw (CVE-2025-61624) to its exploited list on October 16. It needs an admin login, but 7.2, 7.0 and 6.4 FortiOS have no fix.
- Useful toolsSecurity alert
Patch BeyondTrust Remote Support now: an exploited flaw let attackers act on the appliance, and patching alone may not be enough
CISA added a critical BeyondTrust Remote Support flaw on October 16 with a three-day deadline. Self-hosted servers need the BT26-05 patch, and exposed ones should be checked for compromise.
- Useful toolsSecurity alert
Patch AhsayCBS backup servers again: two chained flaws are being exploited, and the first patches weren't enough
CISA added two AhsayCBS flaws to its exploited list on October 14. Ahsay says earlier patches did not fully fix them. Here is which hotfix to apply, who can get it, and what to check.
- NetworksSecurity alert
Patch Palo Alto PAN-OS and Panorama: an exploited flaw gives logged-in attackers root, and there is no workaround
CISA added PAN-OS CVE-2026-0322 to its exploited list on October 14. Here are the fixed versions, the limited mitigation, and the one thing that shrinks your risk today.
- NetworksSecurity alert
Patch Ivanti Connect Secure now: a zero-day login bypass is being exploited, and the integrity checker won't catch it
CISA added an exploited Ivanti Connect Secure authentication bypass on October 13, 2026. Here is who is affected, what to do today, and how to respond if the VPN may already be compromised.
- Tech basicsSecurity alert
Update iPhones, iPads, and Macs now: Apple fixed an exploited flaw in how images and files are processed
Apple patched a flaw it says was exploited in a targeted attack, and CISA lists it as exploited. Here is who needs to update, to which version, and how.
- NetworksSecurity alert
Patch Cisco Secure Email Gateway: an exploited flaw gives attackers root, and there is no workaround
A critical SQL injection flaw in Cisco Secure Email Gateway is being exploited. Here are the fixed releases, who is affected, and how to check your mail logs.
- NetworksSecurity alert
Zammad helpdesk flaws are being exploited: check your version and who can reach it
CISA added two Zammad flaws to its exploited list on October 2. Versions 6.5 and older are the exposed ones, and the second flaw has no vendor fix yet. Here's how to check and what to do.
- NetworksSecurity alert
Patch Citrix NetScaler again: a SAML flaw is being exploited, even if you patched last week
CISA added CVE-2026-88779 on October 4. It hits NetScaler Gateways and ADCs doing SAML sign-in, and the September fixes don't cover it. Here's who's affected and which builds fix it.
- NetworksSecurity alert
Patch Cisco Catalyst SD-WAN Manager: an exploited login bypass with no workaround
CISA added a critical Cisco SD-WAN Manager flaw to its exploited list on September 30 with a three-day deadline. Here are the fixed releases and how to check your logs.
- NetworksSecurity alert
Patch FortiMail now: an exploited path traversal flaw, rated 9.8
CISA added a FortiMail flaw to its exploited list on October 1 with a three-day deadline. Here are the fixed versions, the workaround, and what to check if you can't patch today.
- NetworksSecurity alert
Patch on-premises SharePoint: a code-execution flaw fixed in August is now being exploited
CISA added a Microsoft SharePoint Server flaw (CVE-2026-65660) to its exploited list on September 25. Microsoft fixed it in August. Here's which builds are safe and how to check yours.
- NetworksSecurity alert
Patch Check Point gateways and management servers: two flaws are being exploited
CISA added two critical Check Point flaws on September 22, one in VPN gateways and one in management servers. LivePatch covers the VPN flaw but not the management server flaw.
- NetworksSecurity alert
Patch Citrix NetScaler now: two flaws are being exploited
CISA added two NetScaler ADC and Gateway flaws to its exploited-vulnerabilities list with a September 30 deadline. One affects every deployment, even default configurations. Here's what to patch.
- NetworksSecurity alert
Patch FortiGate firewalls: an exploited FortiOS flaw, and no fix for 6.4
CISA added a FortiOS heap overflow to its exploited list on September 9. Here are the fixed versions, a workaround if you can't upgrade yet, and why FortiOS 6.4 needs to go.
- NetworksSecurity alert
Patch MikroTik RouterOS now: attackers are taking over routers through SSH
CISA lists three exploited RouterOS flaws from September, and CERT Polska says attacks began by September 2. Here are the fixed versions and how to check for compromise.
- Useful toolsSecurity alert
Patch N-able N-central to 2026.3 Hotfix 4: pre-authentication code execution
A critical flaw can let an attacker run code on an on-premises N-central server without logging in. CISA added it to its exploited list on September 8. Hosted customers are already patched.
- Useful toolsSecurity alert
Update ConnectWise ScreenConnect to 26.6.5: an exploited flaw lets files run on remote PCs
CISA added a ScreenConnect client flaw to its exploited list on September 11. Cloud instances are updated, but on-premises servers need 26.6.5 and every host client needs reinstalling.
- Active DirectorySecurity alert
Two Windows flaws from September Patch Tuesday are being exploited
Microsoft confirmed attacks using two Windows privilege-escalation flaws fixed on September 8. If your September updates aren't installed yet, install them now.
- Tech basicsSecurity alert
Update WordPress now: a critical flaw is being exploited
If your business website runs on WordPress, make sure it has updated to 7.1.2 or a patched older release. CISA added the flaw to its exploited list on September 25.
- NetworksSecurity alert
Update Zyxel GS1900 switches: an exploited flaw lets attackers on your network take over
CISA added a Zyxel GS1900 switch flaw to its exploited list on September 21. It's reachable from inside your network, not the internet, but it's being used. Here's the firmware for each model.
- NetworksSecurity alert
If you manage Cisco firewalls through an on-prem FMC, patch it now
A critical, unauthenticated flaw in Cisco Secure Firewall Management Center gives root access with no login. It's under active exploitation and in CISA's KEV catalog.
- NetworksSecurity alert
Patch SonicWall SMA1000 now — two exploited flaws chain to remote code execution
A critical, unauthenticated SSRF and a command injection bug in SonicWall SMA1000 are being chained for remote code execution. What's affected and what to do today.
- Phones & PBXSecurity alert
Patch Sangoma Switchvox now — an unauthenticated flaw is being exploited
A critical, unauthenticated SQL injection in Switchvox SMB is being actively exploited to plant reverse shells. Here's what's affected and what to do today.
Get new guides by email
Plain-English tech tips, scam and security alerts, and fixes for small offices, whether you're the office manager or the IT pro. No spam, and you can unsubscribe anytime.