F5, the company behind the NGINX web server, has released out-of-band security updates for several NGINX vulnerabilities, three of which are rated critical. “Out-of-band” means the fixes arrived outside the normal update schedule, which usually signals that the vendor wants administrators to act quickly. NGINX sits in front of a very large share of websites, APIs and cloud applications, including many run by Nigerian banks, fintechs, e-commerce stores and agencies, so this is an update worth putting at the top of this week’s to-do list.

The three critical issues are tracked as CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479. F5 published its advisories in mid-October, and the out-of-band release was widely reported on 19 October 2026.

What the vulnerabilities do

All three flaws are memory-safety bugs in the NGINX worker process. According to the reporting, an unauthenticated remote attacker who sends crafted traffic to a vulnerable server can trigger a heap-based buffer overflow or a use-after-free condition. The most likely result is that the worker process crashes and restarts, which an attacker can repeat to cause a denial of service and knock a site or API offline.

The more serious outcome is remote code execution. Researchers and F5 note that running attacker code is realistic where Address Space Layout Randomization (ASLR), a standard memory protection in modern operating systems, has been disabled, or where an attacker finds a way around it. That condition is the main reason the flaws carry a “High” score of 8.1 under CVSS version 3.1 while scoring 9.2, “Critical”, under the newer CVSS version 4.0 method.

Which products are affected

F5 lists a wide range of NGINX products in its advisories, including:

• NGINX Open Source
• NGINX Plus
• NGINX Ingress Controller (used with Kubernetes)
• NGINX Gateway Fabric
• NGINX Instance Manager

Importantly, exposure depends on how NGINX is configured. The bugs are reachable only with certain non-default settings, such as particular uses of HTTP/3, Server Side Includes (SSI) combined with asynchronous file I/O, or regex-based map directives that reference capture variables. That means you should not assume you are safe just because you run a “standard” setup, and you should not assume you are vulnerable either. The only way to know is to check your configuration against F5’s advisories.

Is anyone exploiting this yet?

At the time of writing, F5 has not reported any exploitation in the wild, and no public proof-of-concept code has been reported. That is good news, but it is not a reason to wait. F5 products are a frequent target: the US Cybersecurity and Infrastructure Security Agency (CISA) has listed eight F5 vulnerabilities as actively exploited since November 2021, and four of those were used in ransomware attacks. F5 also disclosed in October 2025 that state-backed hackers had breached its systems and stolen source code and information about undisclosed vulnerabilities, which raises the stakes for any newly published F5 bug.

Historically, once a fix is public, attackers compare the patched and unpatched code to work out how to exploit the flaw. The window between a patch and the first attacks can be days rather than weeks.

Temporary mitigations if you cannot patch today

Upgrading to a fixed NGINX release is the recommended fix. If you need time to test the update, F5 has described configuration changes that reduce exposure for each flaw:

• CVE-2026-15176: avoid using the alias directive inside a location block and avoid the $request_filename variable.
• CVE-2026-97205: disable asynchronous file I/O (the aio setting) or Server Side Includes (SSI).
• CVE-2026-93479: use named regex captures instead of unnamed (numbered) captures, and keep their use limited to the block containing the regex match.

Treat these as stop-gaps only. Configuration changes are easy to undo by accident during a later deployment, and they may not cover the other, lower-severity issues fixed in the same release.

Why this matters for African businesses

Many small and mid-sized companies in Nigeria and across the continent run NGINX without realising it. It is often bundled in hosting control panels, Docker images, Kubernetes clusters, load balancers and appliances supplied by integrators. If a vendor or freelancer set up your website or app, NGINX may be quietly serving your traffic. A crash-and-restart attack against a payment page or customer portal can mean lost sales and support calls, and code execution on an internet-facing server can become the first step in a data breach.

What you should do

1. Find every NGINX instance. Check web servers, reverse proxies, Kubernetes ingress controllers and container images. Running nginx -v on a server shows the installed version.
2. Read F5’s advisories (K000162416, K000162607 and K000162608) and compare the listed conditions with your configuration files.
3. Patch internet-facing systems first, then internal ones. Update container base images and redeploy, rather than patching running containers by hand.
4. Apply the mitigations above where patching must wait, and record the change so it is reviewed later.
5. Confirm ASLR is enabled on Linux hosts; it is on by default, and it should stay that way.
6. Ask your hosting provider or IT vendor in writing whether they manage NGINX for you and when they will apply the fix.
7. Watch your logs for repeated worker process crashes, which can indicate someone is probing for these bugs.

Sources

• BleepingComputer: F5 releases out-of-band patches for critical NGINX vulnerabilities
• Daily Security Review: F5 Patches Three NGINX Memory-Corruption Flaws Enabling RCE

Many of today’s breaches do not start with clever malware. They start with someone logging in. This month, Japanese media group Nikkei disclosed its third security incident in about a month: attackers used stolen credentials to reach a development system and exposed about 1.83 million records, around 150,000 of which contained personal details such as names and email addresses. Earlier incidents at the same company involved a hijacked Google Workspace account and a compromised Microsoft 365 account that was used to send spear-phishing emails to staff.

Small businesses use exactly the same platforms, often with default settings left untouched. The good news is that both Microsoft 365 and Google Workspace include strong protections, and most can be switched on by an administrator in an afternoon. This guide walks through the most important steps. You will need an account with administrator rights.

Step 1: Protect the admin accounts first

An attacker who controls an administrator account controls everything, so start here.

1. Use separate admin accounts. Give administrators a dedicated admin login that is not used for daily email or browsing.
2. Keep the number small. Two administrators is usually enough for a small business: one main and one backup, so you are never locked out.
3. Turn on the strongest sign-in method available for those accounts, such as a hardware security key or an authenticator app, before anything else.
4. Store a break-glass account securely: an emergency admin login, with its recovery details written down and kept offline.

Step 2: Enforce multi-factor authentication for everyone

Multi-factor authentication (MFA) means a stolen password alone is not enough to sign in. The key word is enforce: offering MFA as optional leaves gaps.

In Microsoft 365

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. If you do not have advanced licences, make sure Security defaults are enabled. They require all users to register for MFA and block older, weaker sign-in methods.
3. If your plan includes Conditional Access, create a policy that requires MFA for all users and all cloud apps, and test it on a small group first.

In Google Workspace

1. Sign in to the Google Admin console (admin.google.com).
2. Go to Security, then the 2-Step Verification settings.
3. Allow users to turn on 2-Step Verification, give staff a short enrolment period, and then set enforcement to on.
4. Where possible, restrict methods to security keys or the Google prompt rather than SMS codes.

Tell staff before you enforce MFA, and set a date. A short notice prevents a Monday morning full of lockouts.

Step 3: Close the side doors

Attackers often bypass MFA through older protocols or connected apps.

• Block legacy authentication. Older email protocols such as POP, IMAP and basic SMTP authentication may not support MFA. In Microsoft 365, Security defaults or a Conditional Access policy can block them. In Google Workspace, review the settings for less secure app access and IMAP for users who do not need them.
• Review third-party app access. Staff may have granted outside apps permission to read mail or files. In Microsoft Entra, review Enterprise applications and consider requiring admin approval for new app consents. In the Google Admin console, open Security > Access and data control > API controls to see and restrict connected apps.
• Stop automatic forwarding. Criminals who take over a mailbox often set a rule to copy all mail to an outside address. Disable automatic external forwarding unless there is a business need.

Step 4: Turn on alerts and check sign-in logs

You want to know quickly when something looks wrong.

1. In Microsoft 365, review sign-in logs in the Entra admin center and alert policies in the Microsoft Defender portal (security.microsoft.com). Look for sign-ins from unexpected countries and new inbox rules.
2. In Google Workspace, use Reporting > Audit and investigation for login events, and check Rules for alerts such as suspicious login and user granted admin privilege.
3. Send alerts to a shared mailbox that more than one person checks.
4. Set a recurring 15-minute weekly slot to skim the logs. Regular, small checks catch problems early.

Step 5: Plan for the day a login is stolen

Even with good controls, an account may be compromised. Prepare the response in advance:

• Know how to reset a password and sign the user out of all sessions in your admin console.
• Know how to revoke app tokens and remove suspicious inbox rules.
• Write a one-page checklist listing who to call, including your IT provider and bank, if a mailbox is used for fraud.
• Remove accounts promptly when staff leave, and transfer their data to a manager.

Quick checklist

• Separate, protected admin accounts, kept to a minimum
• MFA enforced for every user, not just offered
• Legacy sign-in blocked and external forwarding disabled
• Third-party app access reviewed
• Alerts on and logs checked weekly
• A written plan for a compromised account

Menu names change from time to time as Microsoft and Google update their consoles, so if a setting has moved, search for it by name inside the admin portal. The steps themselves remain among the most effective defences a small business can put in place.

Sources

• BleepingComputer: Nikkei discloses third data breach in a month, 1.8M records exposed

Featured image: Photo: “UF Norman Office Laptop Desk Workstation” by cdsessums, CC BY 2.0, via Openverse — source

If your business website, online shop or customer portal runs on PHP, today matters. The PHP security team has scheduled an urgent release for Wednesday, 21 October 2026, at 14:00 UTC (3:00 p.m. in Lagos) to fix two critical remote code execution flaws in PHP core. This article is for website owners, small business IT leads, developers and anyone who manages a WordPress, Laravel or other PHP-based site, whether on shared hosting, a VPS or in containers.

Key takeaways

• PHP will ship fixes for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, on 21 October 2026 at 14:00 UTC.
• The PHP security team rated both flaws 9.2 on the CVSS v4.0 scale. Early online claims of a perfect 10.0 score were not confirmed by PHP.
• Details of the bugs leaked before the planned disclosure, which is why the release was announced at short notice.
• Fixes are expected only for supported PHP 8 branches. Sites still on PHP 5 or PHP 7 will not receive an official patch.
• No public exploit code or in-the-wild attacks had been reported at the time of the announcement, but that can change quickly once technical details become public.

What happened

On the evening of Tuesday, 20 October 2026, Jakub Zelenka posted an advance notice from the PHP security team on the official php.announce mailing list. It warned of an upcoming critical security release fixing two vulnerabilities, each scored 9.2 under CVSS version 4.0, and set the release for 14:00 UTC on Wednesday, 21 October. The notice also said the team could publish earlier if details of either flaw became public or if there was evidence of active exploitation, and it urged users to prepare so they can update as soon as the new versions are available.

The timing was not ideal. Earlier the same day, a post on the Hacker News forum claimed that a source had revealed two PHP remote code execution bugs, with an announcement expected on 22 October. That post was later removed, but screenshots spread across X and Mastodon, and some posts listed the reserved CVE numbers. Security firm watchTowr publicly confirmed that the leak related to real, embargoed PHP vulnerabilities, while making clear it had not discovered them and would not share technical details. PHP’s official schedule effectively brought the fix forward by about a day.

What we know about the flaws

Very little technical information has been published, and that is deliberate. According to security advisories from Beazley Security Labs and Threat Landscape, both CVE records are still marked as reserved. PHP has not said which function or extension is affected, which configurations are vulnerable, or whether an attacker needs to be logged in. Some advisories note that a critical rating like this could point to unauthenticated remote code execution, but PHP has not confirmed that.

Remote code execution is the most serious class of web bug because it can let an attacker run their own commands on your server. In practice that can mean defaced pages, stolen customer data, hidden malware that redirects visitors, or a foothold for wider attacks on your network.

Which versions are affected

PHP has not yet published official affected or fixed version ranges; these will come with the release. Public reporting suggests the current releases of the 8.2, 8.3, 8.4 and 8.5 branches are affected. Claims that every version back to PHP 5 is affected came from social media and have not been confirmed. What is clear is that PHP 5 and PHP 7 are end-of-life, so they will not receive official fixes regardless.

Who is affected

PHP powers a very large share of the web, including popular content management systems such as WordPress, Joomla and Drupal and many custom business applications. That makes this release relevant to:

• Small businesses and NGOs with a website on shared hosting, where the host controls the PHP installation.
• Developers and agencies managing client sites on VPS or cloud servers, where you are responsible for updates.
• Teams using containers, where old PHP base images can linger in production long after newer builds exist.
• Organisations running appliances or third-party products that bundle their own copy of PHP.

Across Nigeria and the wider continent, many SMEs rely on low-cost shared hosting and on developers who built a site years ago and have since moved on. Those sites are often running older PHP versions that nobody has checked recently. If that sounds like your organisation, treat this as the prompt to find out.

Why the leak raises the stakes

Coordinated disclosure normally gives defenders a head start: the fix and the details arrive together, and attackers have to work backwards from the patch. When details leak early, that head start shrinks. Advisories note that researchers have largely respected the remaining embargo, and at least one researcher has said they will publish a technical lab only after the embargo lifts. Even so, once patched versions are public, attackers can compare old and new code to find the bug. Sites that update within days are in a far stronger position than those that wait weeks.

What you can do before the release

1. Build an inventory

List every server, hosting account, container image and appliance that runs PHP. Record the version for each. On a server you can run php -v; on WordPress you can check under Tools > Site Health > Info > Server; in cPanel, the MultiPHP Manager shows the version for each domain.

2. Talk to your host or distribution

If you use shared or managed hosting, ask your provider when they will roll out patched PHP builds and whether you need to do anything. If you run Linux servers, watch your distribution’s security advisories, because many teams install PHP from distribution packages rather than directly from php.net.

3. Reduce exposure

Advisories recommend restricting non-public PHP applications, such as internal admin panels and staff portals, to trusted networks or VPN access. Internet-facing applications that cannot be patched quickly should be isolated where possible.

4. Plan your upgrade path off old PHP

If you find PHP 5, 7, 8.0 or 8.1 anywhere, prioritise moving it to a supported PHP 8 branch. According to php.net, the supported branches are 8.2, 8.3, 8.4 and 8.5, and PHP 8.2 itself only receives security fixes until 31 December 2026, so moving to 8.3 or newer buys more time.

What you should do

1. Today: confirm which PHP versions you run and who is responsible for updating each one.
2. After 14:00 UTC: check php.net and your host or distribution for the patched versions, then apply them as soon as they are available. Test critical functions such as checkout, contact forms and logins afterwards.
3. This week: watch for exploit reports. If public exploit code appears, treat any unpatched internet-facing site as urgent.
4. This quarter: retire any PHP version that no longer receives security updates and make PHP version checks part of your regular maintenance routine.

Sources

• php.announce: Upcoming Critical PHP Security Release
• Beazley Security Labs: Critical RCE Vulnerabilities in PHP
• Threat Landscape: PHP Core RCEs Leak Early
• PHP: Supported Versions

Featured image: Photo: “First Web Server” by User:Coolcaesar at en.wikipedia, CC BY-SA 3.0, via Openverse — source

If you have been putting off that small “Relaunch” button in the corner of Google Chrome, now is the time to click it. Google has pushed three separate security updates to Chrome’s stable channel in the first half of October 2026, and together they close a long list of memory-safety bugs that attackers prize because they can lead to code running on your computer simply because you opened a booby-trapped web page.

The latest release, announced on 15 October, brings Chrome to version 155.0.8059.84/.85 on Windows and Mac and 155.0.8059.84 on Linux. As usual, Google is rolling it out gradually over the following days and weeks, which means many machines will not have it yet unless someone checks.

What Google fixed this month

The October updates came in quick succession:

• 6 October: a large desktop update that Malwarebytes reported contained 247 security fixes, four of them rated Critical, including use-after-free bugs in Chrome’s browser and navigation code that could allow code to run outside Chrome’s sandbox.
• 13 October: an update to version 155.0.8059.79 (Windows and Linux) and 155.0.8059.80 (Mac) fixing 37 vulnerabilities, seven of them Critical. These included a buffer overflow in ANGLE, the layer Chrome uses to translate graphics instructions, and six use-after-free flaws in areas such as PDF handling, networking, SVG images and media playback.
• 15 October: a smaller update with 10 fixes: one Critical use-after-free in Chrome’s prerendering feature, six rated High (including several in the V8 JavaScript engine and the DOM), and three Medium.

Google has not said that any of the flaws fixed in these three October releases are being exploited in the wild. That is good news, but it is not a reason to wait. Once fixes are public, attackers can study the changes and try to build working exploits against people who have not updated. Google itself keeps technical details restricted until most users are protected, precisely because of that risk.

AI is now finding browser bugs

One detail in the 15 October release stands out. Several of the reported vulnerabilities, including a high-severity memory corruption bug in Chrome’s DOM, were credited to a researcher at the AI company Anthropic working with its Claude model. The 13 October release also credited a V8 bug report to the same researcher with help from Claude. Google’s release notes do not describe exactly how the AI was used.

For readers, the practical meaning is simple. Defenders and researchers are using AI tools to find flaws faster, and it is reasonable to expect attackers to try the same. Faster discovery means more frequent patches, and the gap between a fix being published and someone trying to abuse the bug may shrink. Keeping browsers current is becoming more important, not less.

Why browser updates matter for businesses

For most small businesses, the browser is the front door to everything: online banking, email, accounting software, payment dashboards and cloud storage. A single compromised browser can expose saved sessions and data across all of those services.

Chrome updates itself in the background, but there are common reasons it falls behind:

• The browser is left open for days or weeks, so a downloaded update never gets applied until Chrome restarts.
• Staff use older, unmanaged laptops that are rarely switched off.
• Other Chromium-based browsers on the same machine, such as Microsoft Edge, Brave or Opera, follow their own update schedules.
• Android phones with automatic app updates turned off can lag behind.

How to check your Chrome version

1. Open Chrome and click the three-dot menu in the top-right corner.
2. Go to Help, then About Google Chrome.
3. Chrome will check for updates automatically and download any that are available.
4. Click Relaunch to finish installing. Your open tabs will normally come back after the restart.
5. Confirm the version number shows 155.0.8059.84 or later. If it still shows an older build, the rollout may not have reached you yet, so check again in a day or two.

On a Chromebook, connect to the internet, let the device download the update, then select the “Update device” notification and restart. On Android, open the Google Play Store, search for Chrome and tap Update if the option appears.

For IT administrators

Do not rely on users clicking Relaunch. If you manage devices through Google Workspace, Microsoft Intune or a similar tool, use it to report Chrome versions across your fleet and enforce a relaunch deadline. Prioritise machines used for finance, payroll and administrator accounts. Remember to check other Chromium-based browsers too, as each vendor ships these fixes on its own timeline.

What you should do

• Update today: open About Google Chrome on every computer you use and relaunch the browser.
• Restart regularly: close and reopen your browser at least once a week so updates actually install.
• Check your phone: update Chrome on Android and iPhone through the app store.
• Cover every browser: update Edge, Brave, Opera and any other browsers installed on the same machines.
• Reduce exposure: remove browser extensions you no longer use, and avoid clicking links from unexpected messages until you have updated.

A two-minute restart is one of the cheapest security controls available. With three updates in two weeks, make it a habit rather than an afterthought.

Sources

• Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI – Cyber Security News
• Google Chrome Update Addresses 37 Vulnerabilities, Including 7 Critical Flaws – India News Network
• Update Chrome and ChromeOS to fix critical security issues – Malwarebytes

Featured image: Photo: "PSP Web Browser" by wyzik, CC BY 2.0, via Openverse — source

“Abeg, can I use your account to receive some money? I’ll send you something small for your trouble.” It sounds like a harmless favour between friends, or an easy way to earn extra cash. But Nigeria’s police leadership has just made it clear that it can also make you part of a fraud investigation.

Speaking in Abuja on 15 October 2026 at the 2026 Cybersecurity Awareness Campaign of the Nigeria Police Force National Cybercrime Centre (NPF-NCCC), Inspector-General of Police Olatunji Disu warned that account holders who allow others to receive money through their accounts may be investigated if those accounts are tied to fraud. The campaign’s theme was “Towards a Resilient Cyberspace: Think Before You Click.”

What the police said

According to reports by Vanguard and Blueprint, the IGP listed online activities that can attract prosecution under Nigeria’s Cybercrimes (Prohibition, Prevention, etc.) Act. They include:

• Letting others use your bank account or SIM card to receive money when you do not know the source or purpose of the funds.
• Dealing in fake payment alerts or receipts, or trading in other people’s BVNs, NINs or card details.
• Gaining unauthorised access to someone else’s phone, WhatsApp, email or social media account.
• Creating fake accounts using another person’s name or photo.
• Cyberbullying, spreading false information that could cause panic, and sharing private images without consent.

He stressed that ignorance of the law is no excuse, and that penalties include imprisonment and heavy fines. The Director of the National Cybercrime Centre, AIG Akaninyene Ezima, also urged young people to reject quick-money schemes and online criminal recruitment, and warned that criminals are increasingly using AI for deepfakes, synthetic identities and impersonation.

How money mule recruitment works

Fraudsters who steal money need somewhere to send it that cannot be traced back to them. So they recruit “money mules”: ordinary people whose accounts or SIM cards are used to receive and move stolen funds. The approach usually looks innocent:

• The friendly favour: a friend, neighbour or online contact says their own account is “restricted” and asks to use yours for a payment.
• The fake job: an online “payment processing agent” or “remote finance assistant” role that pays commission for receiving transfers and forwarding them.
• Account or SIM rental: offers of cash to open a new bank account, wallet or SIM registered in your name and hand it over.
• The romance or investment link: someone you met online asks you to receive money for them and send it on, sometimes in crypto.

When the stolen money is traced, it leads to your name, your BVN and your SIM registration, not the fraudster’s. Victims of the original scam see your account as the one that took their money. Your bank may freeze your account, and you may have to explain yourself to investigators.

Insider risks at banks and fintechs

The police also turned their attention to the institutions themselves. The IGP urged banks, fintechs and telecom operators to guard against insider threats, including compromised staff and misuse of privileged access, by screening employees, restricting access to sensitive systems, monitoring transactions and running regular audits. He said the warning was not a judgement on employees’ integrity. A representative of the Nigeria Data Protection Commission (NDPC) added that the Commission is working with law enforcement under the Nigeria Data Protection Act, 2023, to tackle the misuse of personal data. The IGP also warned digital lenders against using customers’ personal data to harass or blackmail borrowers.

How to protect yourself

1. Never lend your account. Do not let anyone, including friends and relatives, receive money through your bank account, wallet or POS terminal if you do not know exactly where it came from.
2. Never hand over a SIM. A SIM registered with your NIN is linked to you. Do not sell, rent or give one to someone else.
3. Reject “receive and forward” jobs. No legitimate employer asks you to receive money in your personal account and send it on.
4. Guard your identifiers. Keep your BVN, NIN, card details, PINs and one-time passwords private. Banks will not ask for your PIN or OTP.
5. Check your statements. Review your account regularly and report any transfer you do not recognise to your bank immediately.
6. Talk to young people. Students and job seekers are prime targets for mule recruitment. Explain the risks plainly.

If you have already been used

Stop all transfers immediately, do not forward any more money, and contact your bank. Keep records of messages and transactions and report the matter to the police. Coming forward early is far better than being discovered later.

What you should do

• Say no to any request to use your account, wallet, POS or SIM for someone else’s money.
• Businesses: limit staff access to customer data and payment systems to what each role needs, and review access regularly.
• Report recruitment attempts and fraud to your bank and the police.
• Share this warning with family members, staff and students who may not know the risks.

Your account is tied to your identity. Protect it like you would your name.

Sources

• Cybercrime: IGP warns Nigerians against seven online offences – Vanguard
• Police, NDPC warn banks, fintechs against insider cybercrime risks – Blueprint

Featured image: Photo: “Sadness – 2011-04-20” by 4nitsirk, CC BY-SA 2.0, via Openverse — source

The US Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026, confirming that attackers are already using them. The flaws affect three kinds of equipment that sit at the edge of many business networks: Palo Alto Networks firewalls, Cisco email security gateways and AhsayCBS backup servers. CISA gave US federal civilian agencies until 17 October to fix them.

The deadline is a US government requirement, but these products are widely used by companies, banks, universities and managed service providers across Africa and elsewhere. If your organisation, or an IT provider that manages your systems, runs any of them, treat this as urgent.

Palo Alto Networks PAN-OS: CVE-2026-0322

This high-severity flaw (CVSS 8.6) affects the management interface of PAN-OS, the operating system on Palo Alto Networks firewalls. According to Help Net Security’s summary of the vendor advisory, an attacker who is authenticated and can reach the management interface over the network can run code with root privileges, the highest level of control on the device.

Affected: PA-Series and VM-Series firewalls, and Panorama management appliances. Cloud NGFW and Prisma Access are not affected.

Fix: Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Devices on unsupported versions must be upgraded to a supported, fixed release. There is no workaround, but limiting access to the management interface to trusted internal IP addresses significantly reduces the risk. Palo Alto Networks’ advisory also lists IP addresses linked to exploitation attempts, which administrators can check against their logs.

Cisco Secure Email Gateway: CVE-2026-76519

This is a critical path traversal bug (CVSS 9.8) in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An attacker can trigger it simply by sending a specially crafted email attachment, which makes it especially dangerous, because the gateway’s job is to process incoming mail from anyone.

Affected: Physical and virtual appliances where File Reputation is enabled and assigned to a mail policy, and where the Content Scanner Tools component is older than version 25.3.0.5525.

Fix: Cisco says there is no workaround. Administrators can either install Content Scanner Tools 25.3.0.5525 or later, which does not need an operating system upgrade or restart, or move AsyncOS releases older than 16.5 to 16.5.0-780. Because an attacker with root access can cover their tracks on the appliance itself, Cisco’s guidance is to also review external firewall and network logs for unexpected uploads to outside IP addresses.

AhsayCBS backup servers: CVE-2026-105133 and CVE-2026-105134

AhsayCBS is backup server software used by many hosting companies and IT service providers to store their clients’ backups. Two flaws are being chained together: an improper authentication bug (CVE-2026-105133) lets attackers get past the login, and a critical command injection bug (CVE-2026-105134) then lets them run commands with SYSTEM privileges.

Help Net Security reports that attackers have used the chain to plant web shells and cryptocurrency miners on internet-facing servers. Earlier patches (v9.15.2.59 and v10.3.4.0) turned out to be incomplete, so a server that was patched previously may still be exposed.

Fix: Version 10 users should install the v10.3.4.45 hotfix, and users of versions 7, 8 and 9 should install v9.15.2.70. Both are available from Ahsay’s partner portal, and the server must be rebooted afterwards. Testing by security firm Huntress indicates the 10.3.4.45 hotfix blocks the first step of the attack chain.

Why edge devices keep getting hit

Firewalls, email gateways and backup servers have three things in common: they face the internet, they are trusted by everything behind them, and they are often patched less often than laptops because nobody wants to interrupt mail flow or backups. That combination makes them attractive targets. A compromised backup server is particularly serious, because backups are what businesses rely on to recover from ransomware.

Many small businesses do not manage these devices directly. They are often looked after by an internet provider, a hosting company or an outsourced IT firm. That is fine, as long as someone is clearly responsible for applying security updates and can confirm that it has been done.

What you should do

1. Find out whether you use these products. Check your asset list, or ask your IT provider directly whether you run PAN-OS firewalls, Cisco Secure Email Gateway or AhsayCBS.
2. Patch now, not at the next maintenance window, using the fixed versions listed above.
3. Lock down management interfaces. Firewall and appliance admin pages should never be reachable from the open internet. Restrict them to a management network or VPN.
4. Re-check previously patched Ahsay servers, since the earlier fixes were incomplete.
5. Look for signs of compromise: unknown files in web folders, unexpected high CPU use (a common sign of cryptominers), new admin accounts and unusual outbound traffic.
6. Protect your backups. Keep at least one recent copy offline or in separate storage that the backup server cannot overwrite.
7. Ask your provider for written confirmation that the updates were applied, with the date and version numbers.

Sources

• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog
• Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products

Featured image: Photo: “IMG_0668” by Jemimus, CC BY 2.0, via Openverse — source

Cybersecurity is a continuous process of identifying, prioritising and reducing digital risks. Organisations and individuals benefit from practical controls that are consistently maintained.

The right approach depends on the organisation, its systems and the impact of disruption. Start with a documented baseline, assign ownership, and review the controls regularly rather than relying on a one-off implementation.

Image: Cybersecurity Visuals Challenge 2019 – Rebecca Wang.jpg — Rebecca Wang (CC BY 4.0) — source and licence

Key areas to focus on

Threat modelling and asset visibility

Identify important systems, data flows and likely attack paths. Use this inventory to prioritise protection and make risk decisions explicit.

Multi-factor authentication and least privilege

Require multi-factor authentication where possible, remove unused accounts and grant only the access needed for each role.

Patching, monitoring and incident response

Apply security updates through a controlled process, collect useful logs and define who will investigate and escalate suspicious activity.

Backups and recovery testing

Keep protected backups and regularly test restoration so recovery assumptions are supported by evidence.

A practical implementation checklist

• Document the current environment and the most important risks.
• Choose an owner and a realistic completion date for each action.
• Test the control and retain evidence of the result.
• Review exceptions, incidents and lessons learned on a regular schedule.

Common mistakes to avoid

Avoid assuming that a tool alone solves the problem. Unreviewed alerts, undocumented changes, excessive permissions and untested recovery plans can weaken otherwise good technology investments. Keep procedures understandable and make sure people know how to follow them.

Conclusion

Good IT practice combines appropriate technology with clear ownership, user awareness and regular verification. Begin with the highest-impact gaps, track progress and improve the process as requirements change.

Editorial note: This article is general information. Verify technical details against your own environment and current vendor documentation before making operational changes.

Phishing remains one of the most common ways attackers get a first foothold, because it targets people rather than software. The good news is that the warning signs are learnable, and a few habits stop most attempts.

The classic warning signs

Messages that create urgency or fear, such as an account about to be closed, are designed to stop you thinking. Check the sender address for lookalike domains, be cautious with unexpected attachments, and distrust any request to bypass normal approval steps or keep something secret.

Spelling is no longer a reliable clue

Attackers can now polish their writing with automated tools, so a well-written message is not proof of safety. Judge behavior instead of grammar: who is asking, why now, and does the request fit how this person normally works?

• Hover over links to see the real destination before clicking
• Open sites by typing the address or using your bookmark
• Confirm payment or password requests through a different channel
• Report suspicious messages instead of just deleting them

What to do if you clicked

Do not panic or hide it. Disconnect the device if you opened an attachment, change the affected password from a clean device, enable multi-factor authentication and tell your IT contact straight away. Early reports limit the damage.

Key takeaway: slow down, verify through another channel, and report anything suspicious.

Passwords are hard to remember, easy to reuse and simple to steal. Passkeys are a newer sign-in method designed to fix those weaknesses, and many major services already support them.

How passkeys work

A passkey is a pair of cryptographic keys. The private key stays on your device, protected by your fingerprint, face or screen lock, and the service holds only the public key. Because there is no shared secret to type, there is nothing for a fake website to capture.

Why businesses should care

Phishing and credential stuffing depend on stolen passwords. Passkeys are tied to the real website address, so they will not work on a lookalike page. They can also reduce password reset requests, which saves support time.

• Enable passkeys alongside passwords first, then retire passwords gradually
• Let staff register more than one device
• Secure the account recovery process, since attackers target it next
• Keep a hardware key for administrators and critical accounts

Planning the rollout

Start with a pilot group, document the sign-in steps and train staff on what to do when they lose a phone. Review which of your own applications can accept passkeys through your identity provider.

Key takeaway: passkeys remove the password that attackers rely on, but plan account recovery carefully.

The old security model trusted anyone inside the office network. Today staff work from homes, cafes and cloud services, so that boundary has largely disappeared. Zero trust is the response to that change.

The core idea

Never trust by default, always verify. Every request is checked using who is asking, the health of their device, what they are trying to reach and how unusual the request looks, whether it comes from inside or outside.

It is an approach, not a product

No single tool delivers zero trust. It is built from smaller steps that work together, and you can adopt them gradually.

• Strong identity with multi-factor authentication for every user
• Least privilege, so people reach only what their job needs
• Device checks before access to sensitive systems
• Network segmentation so one breach cannot spread everywhere
• Continuous monitoring and quick revocation of access

Where to begin

Map your most valuable data and who really needs it. Fix identity and access for those systems first, then expand. Measure progress by how much a single stolen password could do, and keep shrinking that number.

Key takeaway: limit what any one account or device can reach, and verify every time.