Networks
Firewalls, Wi-Fi, remote access, and the building systems that quietly share your network.
- Phones & PBXSecurity alert
FreeSWITCH phone systems need version 1.11.3 now — CVE-2026-116779 is being exploited
A critical FreeSWITCH flaw that allows command execution through SIP text messages is on CISA's exploited list. Here's who is affected and what to do.
- NetworksSecurity alert
VMware ESX logging flaw is on CISA's exploited list: patch the whole advisory, because it also fixes critical bugs
CVE-2026-41709 is a low-severity ESX flaw, but CISA lists it as exploited. The same Broadcom advisory fixes critical vCenter and ESX flaws. Here is what to check and install.
- Tech basicsSecurity alert
Update WordPress to 7.1.4 or your branch's latest release: a flaw in the update process is being exploited
CISA added a WordPress core flaw to its exploited list on November 3. Sites that update normally are protected once on a fixed release, and auto-updates should deliver it.
- NetworksSecurity alert
Cisco ASA and FTD firewalls: an exploited VPN flaw can force reboots, and the fix is a software update
CVE-2026-76418 lets an unauthenticated attacker crash Cisco ASA and FTD firewalls that use secondary authentication on the SSL VPN. It is exploited now. Here is how to check and what to install.
- NetworksSecurity alert
Brotli decoder flaw is being exploited: check Node.js, .NET and Linux packages
CVE-2026-111497 is a critical memory flaw in the Brotli decompression library that CISA says is exploited. Here is which software carries it, which versions are fixed, and how to check.
- NetworksSecurity alert
Patch self-hosted Jira, Confluence, and Bitbucket: an unauthenticated file-access flaw is now on CISA's exploited list
CVE-2026-21589 affects eight Atlassian Data Center products. CISA listed it as exploited on October 15. Here's who is affected, which versions fix it, and what to do if you can't patch yet.
- Tech basicsSecurity alert
PHP2Shell: two critical flaws in PHP itself are being attacked, and updating WordPress won't fix them
Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) let attackers run code on web servers. Here is who is affected, what to ask your host, and what IT should patch.
- NetworksSecurity alert
Fortinet path traversal flaw is now exploited: what to patch and who it affects
CISA added a Fortinet path traversal flaw (CVE-2025-61624) to its exploited list on October 16. It needs an admin login, but 7.2, 7.0 and 6.4 FortiOS have no fix.
- Useful toolsSecurity alert
Patch BeyondTrust Remote Support now: an exploited flaw let attackers act on the appliance, and patching alone may not be enough
CISA added a critical BeyondTrust Remote Support flaw on October 16 with a three-day deadline. Self-hosted servers need the BT26-05 patch, and exposed ones should be checked for compromise.
- Useful toolsSecurity alert
Patch AhsayCBS backup servers again: two chained flaws are being exploited, and the first patches weren't enough
CISA added two AhsayCBS flaws to its exploited list on October 14. Ahsay says earlier patches did not fully fix them. Here is which hotfix to apply, who can get it, and what to check.
- NetworksSecurity alert
Patch Palo Alto PAN-OS and Panorama: an exploited flaw gives logged-in attackers root, and there is no workaround
CISA added PAN-OS CVE-2026-0322 to its exploited list on October 14. Here are the fixed versions, the limited mitigation, and the one thing that shrinks your risk today.
- Networks
When a VPN user's home network uses the same subnet as the office
If someone's home router hands out the same addresses as your office network, the VPN connects but office servers can't be reached. Here's why, the quick fix with a VPN route on Windows, and the long-term fix.
- Audits & compliance
Check the NIST FIPS list before you buy a VPN or firewall for an audit
"FIPS compliant" on a spec sheet isn't the same as a current NIST validation. How to search the CMVP list, what Active and Historical mean, and why the Security Policy's tested platforms matter.
- NetworksSecurity alert
Patch Ivanti Connect Secure now: a zero-day login bypass is being exploited, and the integrity checker won't catch it
CISA added an exploited Ivanti Connect Secure authentication bypass on October 13, 2026. Here is who is affected, what to do today, and how to respond if the VPN may already be compromised.
- Networks
Reviewing an inherited firewall config: what to look for and what to fix first
You took over a firewall nobody documented. A practical order of operations for reading its rules, finding the risky ones, and changing them without taking the office offline.
- Field notes
Field note: the desk phone that could call out but never rang
A SIP phone showed Registered and placed calls fine, but incoming calls never reached it. The firewall was quietly forgetting the phone's NAT session after 40 seconds.
- NetworksSecurity alert
Patch Cisco Secure Email Gateway: an exploited flaw gives attackers root, and there is no workaround
A critical SQL injection flaw in Cisco Secure Email Gateway is being exploited. Here are the fixed releases, who is affected, and how to check your mail logs.
- NetworksSecurity alert
Zammad helpdesk flaws are being exploited: check your version and who can reach it
CISA added two Zammad flaws to its exploited list on October 2. Versions 6.5 and older are the exposed ones, and the second flaw has no vendor fix yet. Here's how to check and what to do.
- NetworksSecurity alert
Patch Citrix NetScaler again: a SAML flaw is being exploited, even if you patched last week
CISA added CVE-2026-88779 on October 4. It hits NetScaler Gateways and ADCs doing SAML sign-in, and the September fixes don't cover it. Here's who's affected and which builds fix it.
- Tech basics
Securing your office Wi-Fi, including a separate network for guests
A plain-English checklist for locking down the office Wi-Fi: the right security setting, a strong password, and a separate guest network so visitors stay off your business computers.
- NetworksSecurity alert
Patch Cisco Catalyst SD-WAN Manager: an exploited login bypass with no workaround
CISA added a critical Cisco SD-WAN Manager flaw to its exploited list on September 30 with a three-day deadline. Here are the fixed releases and how to check your logs.
- NetworksSecurity alert
Patch FortiMail now: an exploited path traversal flaw, rated 9.8
CISA added a FortiMail flaw to its exploited list on October 1 with a three-day deadline. Here are the fixed versions, the workaround, and what to check if you can't patch today.
- NetworksSecurity alert
Patch on-premises SharePoint: a code-execution flaw fixed in August is now being exploited
CISA added a Microsoft SharePoint Server flaw (CVE-2026-65660) to its exploited list on September 25. Microsoft fixed it in August. Here's which builds are safe and how to check yours.
- NetworksSecurity alert
Patch Check Point gateways and management servers: two flaws are being exploited
CISA added two critical Check Point flaws on September 22, one in VPN gateways and one in management servers. LivePatch covers the VPN flaw but not the management server flaw.
- NetworksSecurity alert
Patch Citrix NetScaler now: two flaws are being exploited
CISA added two NetScaler ADC and Gateway flaws to its exploited-vulnerabilities list with a September 30 deadline. One affects every deployment, even default configurations. Here's what to patch.
- NetworksSecurity alert
Patch FortiGate firewalls: an exploited FortiOS flaw, and no fix for 6.4
CISA added a FortiOS heap overflow to its exploited list on September 9. Here are the fixed versions, a workaround if you can't upgrade yet, and why FortiOS 6.4 needs to go.
- NetworksSecurity alert
Patch MikroTik RouterOS now: attackers are taking over routers through SSH
CISA lists three exploited RouterOS flaws from September, and CERT Polska says attacks began by September 2. Here are the fixed versions and how to check for compromise.
- Useful toolsSecurity alert
Update ConnectWise ScreenConnect to 26.6.5: an exploited flaw lets files run on remote PCs
CISA added a ScreenConnect client flaw to its exploited list on September 11. Cloud instances are updated, but on-premises servers need 26.6.5 and every host client needs reinstalling.
- Tech basicsSecurity alert
Update WordPress now: a critical flaw is being exploited
If your business website runs on WordPress, make sure it has updated to 7.1.2 or a patched older release. CISA added the flaw to its exploited list on September 25.
- NetworksSecurity alert
Update Zyxel GS1900 switches: an exploited flaw lets attackers on your network take over
CISA added a Zyxel GS1900 switch flaw to its exploited list on September 21. It's reachable from inside your network, not the internet, but it's being used. Here's the firmware for each model.
- NetworksSecurity alert
If you manage Cisco firewalls through an on-prem FMC, patch it now
A critical, unauthenticated flaw in Cisco Secure Firewall Management Center gives root access with no login. It's under active exploitation and in CISA's KEV catalog.
- Field notes
Field note: the internet problem that was really a cable TV booster
An office's internet kept dropping packets after a speed upgrade. The culprit was an old cable TV signal booster sitting in the line. A good reminder to look at the physical path.
- Field notes
Field note: chasing a network loop across a multi-story building
A network loop kept knocking things offline. Loop protection didn't stop it. Tracking a single MAC address switch by switch finally did.
- Field notes
Field note: VPN users could reach one network but not the other
Everything on the VPN side checked out. The missing piece was a single return route on a second firewall, so replies went nowhere.
- NetworksSecurity alert
Patch SonicWall SMA1000 now — two exploited flaws chain to remote code execution
A critical, unauthenticated SSRF and a command injection bug in SonicWall SMA1000 are being chained for remote code execution. What's affected and what to do today.
- Useful tools
Advanced IP Scanner: a fast inventory of everything on the network
A free Windows network scanner for finding devices, addresses, and shares, and why you should only ever download it from one place.
- Useful tools
Network monitoring for small shops: Auvik vs. free tools like Zabbix, LibreNMS, and Checkmk
Auvik gives you maps and alerts in an afternoon for a monthly fee. The free tools cost nothing to license, but you pay in setup, upkeep, and your own time. Here's how they compare.
- Useful tools
Wireshark for small-shop troubleshooting: what it's for and how to use it safely
When a problem only makes sense at the packet level, Wireshark shows you exactly what's happening, including captures taken on your firewall. Here's how to use it safely.
- Networks
Getting building automation off your office network
HVAC and building controls often sit on the same network as office PCs, speaking a protocol with no authentication. Here's how to separate them without breaking the heat.