Microsoft released its November 2026 security updates on Tuesday, 10 November, and once again the numbers are enormous. Depending on how you count, the release fixes roughly 1,100 vulnerabilities across Windows, Office, SQL Server, SharePoint and Exchange. Only one of them is confirmed as already being used in attacks, and it sits in a place almost every office relies on: classic Outlook.

This article is for business owners, IT administrators and everyday Windows and Microsoft 365 users who want to know what to install first and why one important fix will not arrive through Windows Update alone.

What Microsoft fixed this month

Security trackers report slightly different totals (1,092, 1,093 and 1,094 are all being quoted, and BleepingComputer counted more when it included other fixes), because counting methods differ. Using the widely cited figure of 1,093 new vulnerabilities:

• 63 are rated Critical, 1,029 Important and one Moderate.
• 535 are elevation of privilege flaws, which let an attacker who already has a foothold gain more control.
• 296 allow remote code execution, meaning an attacker could run their own code on a target system.
• By product, Windows accounts for 733 fixes, Office 174, SQL Server 52, SharePoint Server 27 and Exchange Server 9, according to IT-Connect.

This is the second-largest Patch Tuesday on record, behind October’s 1,407 fixes. Large monthly totals are becoming the norm, which makes prioritising more important than ever.

The exploited Outlook flaw: CVE-2026-124194

The zero-day is tracked as CVE-2026-124194, a spoofing vulnerability in classic Outlook. Microsoft rates it only Moderate, with a CVSS score of 6.5, but it is the one attackers are already using.

How the attack works

1. An attacker sends the victim a specially crafted message file.
2. The victim opens the file.
3. Outlook connects to a network location the attacker controls, without showing the usual warning about external content.
4. That connection can leak the user’s NTLMv2 authentication hash. Attackers can try to crack the hash offline or use it in relay attacks to impersonate the user.

The attack needs the user to open the file and needs network connectivity. Microsoft says the Preview Pane is not an attack vector for this particular flaw. It has confirmed exploitation but has not said who is behind it or how widespread it is. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November and gave federal agencies until 24 November to fix it.

Who is affected

Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. IT-Connect lists the fixed builds as 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024.

Why Windows Update alone is not enough

The Outlook fix ships through Office’s own update channel. A computer that shows Windows as fully up to date can still be running a vulnerable copy of Outlook. Do not assume Office updated itself in the background; check it.

For the Windows side, the main cumulative updates this month are:

• KB5132061 for Windows 11 24H2, 25H2 and 26H2
• KB5132059 for Windows 11 26H1
• KB5131087 for Windows 11 23H2
• KB5131096 for Windows 10 21H2 and 22H2 (LTSC editions and machines enrolled in Extended Security Updates)

Other critical flaws worth your attention

None of these is marked as exploited yet, but several are serious enough to move to the front of the queue for organisations running Windows servers:

• Three critical Outlook remote code execution flaws (CVE-2026-110043, CVE-2026-110068 and CVE-2026-111309), which IT-Connect says can be triggered just by displaying a malicious email in the reading pane.
• Windows LDAP (CVE-2026-119958), rated 9.8 out of 10, allowing unauthenticated code execution on domain controllers.
• Active Directory Domain Services (CVE-2026-118146 and CVE-2026-118148), which Microsoft rates as “exploitation more likely”.
• Windows Search (CVE-2026-116928), rated 9.8, which can be triggered by an email attachment that Exchange indexes automatically. The fix is in Windows, not Exchange.
• Exchange Server (CVE-2026-118207), fixed for Exchange Subscription Edition in KB5133453.
• Schannel (CVE-2026-119952), a pre-authentication flaw in Windows’ TLS component that depends on specific configurations.
• Eight Hyper-V privilege escalation flaws, including one that could allow a virtual machine escape.

Exchange 2016 and 2019 are not in this month’s list because their extended security update programme ended in October 2026. They are still exposed, so organisations still running them should plan a move to a supported version or to a hosted service.

What this means for Nigerian and African businesses

Many small offices across the region run classic Outlook on shared PCs and keep older Exchange servers going long past their support dates. That combination is exactly what this month’s release targets. An NTLM hash stolen from one staff member can become a way into shared drives and email for the whole office. Patching quickly, and replacing unsupported servers, is far cheaper than recovering from a compromised mailbox used to send fake invoices to your customers.

What you should do

1. Update Office on every PC that runs Outlook. In Outlook or Word, go to File > Account > Update Options > Update Now, then restart Office when asked.
2. Run Windows Update separately and restart to install this month’s cumulative update.
3. Administrators: list every device running classic Outlook, push the November Office update through Intune, Configuration Manager or your usual tool, and confirm devices reached the fixed build.
4. Patch servers in order: domain controllers, then Exchange hosts (Windows update plus KB5133453), then Hyper-V hosts.
5. Warn staff not to open unexpected message-file attachments. This is an extra layer, not a replacement for patching.
6. Back up before patching critical servers so you can recover if an update causes problems.

Sources

• Cyber Security News: Microsoft November 2026 Patch Tuesday fixes 1,093 vulnerabilities
• IT-Connect: Patch Tuesday November 2026
• WindowsForum: Exploited Outlook zero-day requires Office update
• BleepingComputer: Microsoft November 2026 Patch Tuesday

Read and share the original on Mosravo Endless Solutions Publications

Key takeaways

• Same playbook, faster clock: Sophos, Microsoft, CrowdStrike and Fortinet all report that AI mainly makes familiar attack steps quicker and cheaper rather than creating brand-new techniques.
• Exploits arrive in hours: Microsoft says the median time from a vulnerability being found in the wild to being weaponised is now well under 24 hours.
• Break-outs take minutes: CrowdStrike measured an average eCrime “breakout time” of 29 minutes in 2025, with the fastest at 27 seconds.
• Phishing has scaled up: Microsoft found phishing was the way in for 23% of the intrusions its responders handled, up from 7% a year earlier.
• Your response plan needs a new stopwatch: monthly patching, next-day log reviews and manual approvals are now too slow for internet-facing systems.

What the research actually says

It is easy to dismiss “AI is changing security” as marketing. The value of the 2026 reports is that several companies, looking at different data, landed on the same message.

Sophos: speed, not new tricks

Sophos’s AI Security 2026 report, released in July and based on its incident response work and telemetry from more than 625,000 customers, says AI is compressing attack workflows from weeks to days. The company’s chief technology officer, John Peterson, summed it up this way: attackers still need initial access, still move laterally and still exfiltrate data; what has changed is how fast they do it. Sophos describes AI as an operational force multiplier that leaves defenders less time to detect and contain activity.

The report also documents one of the first clear cases of AI driving a real operation. A group tracked as STAC6994 used around a dozen AI agents to write and test attack code against well-known endpoint security products, producing nearly 80 modules and more than 70 evasion techniques in a few days. Sophos says the same work would previously have taken people weeks.

Microsoft: exploitation in under a day

Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes AI as “changing the physics” of cybersecurity. Its headline figure is that the median time between a vulnerability being discovered in the wild and attackers weaponising it is now well under 24 hours. Microsoft also expects a record of roughly 72,000 CVEs in 2026, and warns that because fixing flaws is slower than finding them, unpatched vulnerabilities will pile up for years.

The same report shows how familiar entry points are growing: exploits against public-facing applications rose from 15% to 24% of the intrusions Microsoft investigated, and phishing jumped from 7% to 23%. AI lets attackers personalise every message, which Microsoft says turns targeted “spear phishing” into a mass-market operation.

CrowdStrike: minutes to move inside

CrowdStrike’s 2026 Global Threat Report, published in February, measures “breakout time”, the gap between an attacker’s first foothold and their first move to another system. The average for criminal groups fell to 29 minutes in 2025, the fastest recorded case took just 27 seconds, and in one intrusion data theft started within four minutes. CrowdStrike also reported an 89% year-on-year increase in operations by AI-enabled adversaries, and found that 42% of vulnerabilities were exploited before they were publicly disclosed.

Fortinet and J.P. Morgan: velocity is the new risk

Fortinet’s 2026 Global Threat Landscape Report frames risk in terms of “velocity” rather than sophistication. Its FortiGuard Labs team observed 122 billion exploitation attempts in 2025 and says time-to-exploit is now measured in hours. A J.P. Morgan report covered by the OECD’s AI incident monitor in August made the same point: AI helps attackers find and exploit software flaws within a single day of disclosure, while organisations struggle to patch fast enough.

How AI speeds up each stage of an attack

Thinking about a typical attack as a chain helps explain why speed is the real story.

1. Finding a way in

Reading a security advisory, understanding the bug and writing working exploit code used to take skilled people days. AI tools can now help with research, code generation and testing, which is why researchers keep reporting shorter gaps between disclosure and attack. Microsoft notes that state-backed groups use AI to hunt for vulnerabilities and tips on exploiting them, while others use AI-generated tooling to scale up.

2. Tricking people

Language and polish used to give phishing away. AI now writes convincing, personalised messages in many languages at almost no cost. Sophos highlights deepfakes and AI-assisted scams that are more scalable and more believable, including a UK victim who lost hundreds of thousands of pounds to a fake AI investment platform after months of coordinated messaging.

3. Moving and stealing inside

Once inside, attackers often reuse stolen passwords and tokens. Microsoft found that in more than half of intrusions that began with a valid account, attackers harvested more credentials once inside. Sophos says identity is now the top initial access vector, and that AI identities themselves, such as OAuth tokens, agents, APIs and developer tools, are becoming high-value targets.

4. Avoiding detection

The STAC6994 case shows AI being used to mass-produce variations designed to slip past security tools. More variations, produced faster, means signature-based defences and slow manual reviews fall further behind.

Why speed hurts small and medium businesses most

Large enterprises have round-the-clock security operations centres. Most small businesses, schools, clinics and shops in Nigeria and across Africa do not. Many rely on one IT person, an outside support company or a “we’ll patch at the end of the month” routine. When exploitation happens within a day and a break-out within half an hour, that routine leaves a wide window open.

The local fraud picture shows the human side of the same trend. Nigeria Inter-Bank Settlement System (NIBSS) data reported this year named social engineering as the most common fraud technique against bank customers. AI-polished messages make that technique cheaper for criminals to run at scale.

What defenders should change

You cannot out-type an automated attacker, but you can remove the slow steps that give them time.

Shrink your patch window for exposed systems

• List every system reachable from the internet: VPNs, firewalls, remote access tools, email servers, websites and file-sharing portals.
• Turn on automatic updates wherever the vendor supports them.
• For critical flaws in internet-facing systems, aim to patch or apply the vendor’s mitigation within 24 to 48 hours, not at the next monthly cycle.
• Subscribe to security advisories from the vendors you use, and to alerts from CISA and your national CERT, such as ngCERT in Nigeria.

Make stolen passwords less useful

• Require multi-factor authentication on email, VPN, cloud and admin accounts, preferring phishing-resistant options where available.
• Remove unused accounts, API keys and app connections, and review which third-party and AI tools have access to company data.
• Give staff and service accounts only the access they need.

Detect and respond in minutes, not days

• Use endpoint protection with automatic isolation or blocking, not just alerts someone reads the next morning.
• If you cannot staff monitoring yourself, consider a managed detection and response (MDR) provider.
• Agree in advance who can disconnect a machine or disable an account without waiting for a meeting.

Train people for convincing fakes

• Teach staff that perfect grammar and personal details no longer prove a message is genuine.
• Set a rule that any request involving money, passwords or bank details must be confirmed through a known phone number or in person.

Govern your own AI use

• Keep an inventory of AI tools, agents and integrations in use, and the accounts and tokens they rely on.
• Store backups offline or in immutable storage, and test restoring them, so a fast attack does not become a permanent loss.

Frequently asked questions

Is AI creating brand-new types of cyberattack?

Mostly not yet. The research above consistently says AI is making existing steps, such as exploitation, phishing and evasion, faster and cheaper. That is still serious, because speed removes the time defenders used to have.

Do small businesses really need to worry?

Yes. Automation lets attackers target many organisations at once, so being small no longer means being ignored. Internet-facing systems are scanned constantly regardless of who owns them.

Can AI help defenders too?

It can. Security tools increasingly use AI to spot suspicious behaviour and respond automatically. The key is to let those tools act quickly, for example by isolating an infected laptop, rather than only sending alerts.

What is the single most useful change to make first?

For most organisations, it is a combination of turning on multi-factor authentication everywhere and patching internet-facing systems within a day or two of a critical fix.

Next steps

1. This week, list every internet-facing system you run and confirm who is responsible for updating each one.
2. Switch on automatic updates and multi-factor authentication wherever they are available.
3. Set a written target for patching critical, exposed flaws within 24 to 48 hours.
4. Decide who can isolate a device or disable an account at any hour, and write down how to reach them.
5. Review which AI tools and integrations can reach your data, and remove any you no longer use.
6. Run a short refresher with staff on AI-written phishing and voice or video impersonation.

Attackers have not rewritten the rules; they have simply pressed fast-forward. Organisations that remove delays from patching, access control and response will close most of the gap.

Sources

• AI is giving attackers a head start, Microsoft warns (Help Net Security)
• Sophos AI Security Report: AI is compressing cyberattack timelines
• 2026 CrowdStrike Global Threat Report
• Fortinet 2026 Global Threat Landscape Report
• OECD.AI: AI accelerates cyber exploits, shrinking response time

Featured image: Photo: “Globe Computer Code and Security” by perspec_photo88, CC BY-SA 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

Google has released an emergency Chrome update to fix a zero-day flaw that attackers are already exploiting. If you or your staff use Chrome on Windows, Mac or Linux, this is an update to install today, not next week. This article explains what was fixed, who is affected, and how to make sure every browser in your home or office is protected.

What happened

On Monday, 9 November 2026, Google pushed Chrome version 157.0.8103.50/.51 to the Stable channel for Windows and Mac, and 157.0.8103.50 for Linux. The update fixes nine security problems. According to security outlets reporting on Google’s advisory, the most serious is CVE-2026-125350, a “use-after-free” bug in the part of Chrome that handles XML data, and Google says it is aware that an exploit for this flaw exists in the wild.

The bug was reported to Google by an anonymous researcher on 6 November, which means Google turned around a fix in about three days. That speed is a strong signal of how seriously the company is treating it.

What a use-after-free bug means

A use-after-free happens when a program keeps using a piece of memory after it has already released it. A skilled attacker can arrange for their own data to land in that freed memory, and then trick the program into running it. In a browser, this kind of flaw is often triggered simply by opening a booby-trapped web page. That is why browser zero-days are so valuable to criminals and spyware operators: the victim does not need to download or install anything.

What Google has not said

Google has not shared who is behind the attacks, who has been targeted, or how the malicious pages are being delivered. This is normal practice. The company usually keeps bug details restricted until most users have updated, so that other attackers cannot copy the technique from the fix.

The other flaws fixed in Chrome 157

The same update closes eight more security holes. Google has not reported that any of these are being exploited, but several are rated high severity, so they add to the case for updating quickly. Reported fixes include:

• A second use-after-free bug in XML handling (CVE-2026-125346).
• A type confusion bug in V8, Chrome’s JavaScript engine (CVE-2026-125344).
• A buffer overflow in Compositing, the code that draws page layers on screen.
• An out-of-bounds write in GPU code.
• An incorrect authorization issue in the FileSystem component.
• Three uninitialized resource bugs in WebGL and GPU code.

Bugs in V8 and graphics code are favourite targets for attackers because they can sometimes be chained together with other flaws to escape Chrome’s security sandbox.

Who is affected

Anyone running Chrome on a desktop or laptop older than the versions above is exposed. That includes home users, schools, cybercafés, banks, fintechs and small businesses across Nigeria and the rest of Africa, where Chrome is the most widely used browser on PCs.

Other browsers built on the Chromium engine, such as Microsoft Edge, Brave and Opera, share much of Chrome’s code. Their makers ship their own fixes on their own timelines, so users of those browsers should watch for updates over the coming days rather than assume they are already protected.

Why the “rolling out” message matters

Google says the update will roll out “over the coming days/weeks”. In practice, that means many computers will not receive it automatically right away. A browser that has been left open for days may also have downloaded the update but not applied it, because Chrome only finishes updating when it restarts. For an exploited bug, you should not wait for the rollout to reach you.

How to update Chrome now

1. Open Chrome and click the three-dot menu in the top-right corner.
2. Go to Help, then About Google Chrome. (You can also type chrome://settings/help in the address bar.)
3. Chrome will check for updates and download the new version.
4. Click Relaunch. Your open tabs will reopen, but save any unfinished work in web forms first.
5. Go back to About Google Chrome and confirm the version starts with 157.0.8103.50 or higher.

If the About page says Chrome is up to date but shows an older version, wait a few minutes and check again, or restart the computer.

Advice for businesses and IT teams

In an office, the real risk is the one machine nobody checks: the reception PC, the accounts laptop that is never restarted, or a shared computer in a training room. A few steps help close those gaps:

• Do a quick walk-round or remote check. Confirm the Chrome version on every computer, not just your own.
• Force a restart. If you manage Chrome centrally through Google Admin console or Windows Group Policy, use your relaunch notification settings to require a browser restart within a short window.
• Check other Chromium browsers. List which browsers are installed on staff PCs and track updates for each one.
• Do not forget kiosks and display screens. Machines used for dashboards, point-of-sale screens or digital signage often run Chrome unattended and are easy to overlook.
• Remind staff about links. Until every device is updated, be extra careful with unexpected links in email, WhatsApp and SMS.

What you should do

• Update Chrome to 157.0.8103.50 or later on every Windows, Mac and Linux computer today, then relaunch the browser.
• Check the version number afterwards instead of assuming the update was applied.
• Update Edge, Brave, Opera and other Chromium-based browsers as soon as their makers release fixes.
• Turn on automatic updates and restart your browser at least once a week so future emergency fixes apply quickly.
• If a computer behaved oddly after visiting an unfamiliar site in recent days, run a full security scan and change passwords for important accounts from a clean device.

Sources

• Chrome Releases: Stable Channel Update for Desktop (9 Nov 2026)
• SecurityOnline: Chrome Zero-Day CVE-2026-125350 Exploited
• GBHackers: Google Chrome Zero-Day Vulnerability Exploited in the Wild

Featured image: Photo: “PSP Web Browser” by wyzik, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

For many Nigerian small businesses, the phone is the office. It holds the banking app, the WhatsApp Business account, the POS companion app and the email that receives invoices. That makes Android phones a prime target for harmful apps, especially ones installed from links sent in chats rather than from Google Play. This guide walks business owners, staff and everyday users through two free, built-in protections: Google Play Protect and Android’s Advanced Protection mode.

What these protections do

Google Play Protect

Play Protect is Google’s built-in app safety scanner. According to Google, it checks apps when you install them and periodically scans your device. If it finds a harmful app it may notify you, disable the app until you remove it, remove it automatically or block it from installing at all. For apps from outside Google Play, it may ask to send the app to Google for checking, and it may stop you installing an unverified app that asks for sensitive permissions commonly abused in financial fraud.

Advanced Protection

Advanced Protection switches on Android’s strongest security and privacy settings in one go and stops them being turned off by accident or by malware. It locks Play Protect on, blocks app installs from unknown sources, adds theft protections, turns on scam and unsafe-link warnings in Google Messages and blocks connections to 2G networks on supported phones. It suits business owners, finance staff and anyone who handles money or sensitive data on their phone.

Before you start

• Have the phone’s PIN, pattern or password ready. Advanced Protection requires a screen lock.
• Make sure the phone is signed in to Google Play and connected to the internet.
• Install pending system and app updates first, so you are working with current menus.
• Menu names can differ slightly between phone brands. If you cannot find an option, use the search bar at the top of the Settings app.

Step 1: Check your phone is Play Protect certified

1. Open the Google Play Store app.
2. Tap your profile icon at the top right.
3. Tap Settings, then tap About.
4. Look for the Play Protect certification line. It shows whether the device is Play Protect certified.

If a phone is not certified, be cautious about using it for banking or business accounts. Uncertified devices may not receive Google’s protections properly.

Step 2: Make sure Play Protect scanning is on

1. In the Play Store, tap your profile icon.
2. Tap Play Protect, then tap Settings (the gear icon).
3. Make sure Scan apps with Play Protect is switched on.

Google says this is on by default and recommends keeping it on. Malware and some “helpers” offering to speed up your phone may try to persuade you to switch it off. Never do so because an app or a stranger asks.

Step 3: Turn on improved harmful app detection

1. On the same Play Protect settings screen, find Improve harmful app detection.
2. Switch it on.

With this on, unknown apps can be sent to Google automatically for analysis, which helps catch new threats faster. When Play Protect recommends scanning an app from outside Google Play, accept the scan. You will receive a result saying whether the app looks safe.

Step 4: Act on Play Protect warnings

• If you get a Play Protect notification about a harmful app, tap the notification and then tap Uninstall.
• If an app has been disabled, do not try to re-enable it. Remove it.
• If an install is blocked, treat that as a strong sign the file is dangerous. Delete the downloaded file as well.
• After removing a suspicious app, change the passwords of any banking or email accounts you used on the phone while it was installed, using a different, trusted device if possible.

Step 5: Turn on Advanced Protection (recommended for high-risk users)

1. Open the phone’s Settings app.
2. Go to Security & Privacy and then Advanced Protection. On some phones, the path is Google, then All services, then Advanced Protection.
3. Turn on Device protection.
4. When prompted, you can turn on Intrusion Logging, which keeps encrypted security logs backed up to a Google Account you choose, or skip it.
5. Tap Turn on and restart the phone if asked.
6. To protect the Google Account as well, open Advanced Protection again and tap Account protection.

If you do not see Advanced Protection, your phone or Android version may not support it yet. Keep Play Protect on and check again after the next system update.

What changes after you turn it on

• You can no longer install or update apps from unknown sources, which blocks the “download this APK” trick used in many banking scams.
• Play Protect cannot be switched off.
• Theft Detection Lock, Offline Device Lock and an automatic restart after 72 hours locked help protect a lost or stolen phone.
• Google Messages and Chrome add scam detection, unsafe link warnings and enforced secure (HTTPS) connections.

To turn it off later, follow the same path, switch off Device protection and confirm with your PIN or fingerprint.

Troubleshooting

• A business app will not install: If your POS provider or bank supplies an app outside Google Play, ask them for the Google Play version. Advanced Protection blocks other sources by design.
• Play Protect settings are greyed out: A work profile or device management tool may control them. Ask whoever manages company phones.
• Constant warnings about one app: Uninstall it. Repeated warnings are not a glitch to dismiss.

Quick checklist for every staff phone

• Play Protect certified: checked.
• Scan apps with Play Protect: on.
• Improve harmful app detection: on.
• No apps flagged or disabled by Play Protect.
• Advanced Protection on for owners, finance and admin staff.
• Screen lock set, and system updates installed.

These settings take about ten minutes per phone and cost nothing. Make them part of setting up every new staff device, and recheck them whenever someone reports a strange app or a suspicious link.

Sources

• Google Android Help: Use Google Play Protect to help keep your apps safe and your data private
• Google Android Help: Advanced Protection

Featured image: Photo: “Rooting my HTC Hero Android Phone” by Andrew Mason, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

SonicWall has released SonicOS updates that fix seven security flaws in its firewalls, and one of them is already on the US Cybersecurity and Infrastructure Security Agency’s (CISA) list of vulnerabilities known to be exploited. The bug can let someone get past SAML sign-in controls, and the multi-factor authentication (MFA) that SAML enforces, on the SSL VPN that staff use to work remotely. If your business, school or bank branch connects remote workers through a SonicWall firewall, this is one to schedule today.

What happened

SonicWall published security advisory SNWLID-2026-0014 on 6 November 2026. It covers seven SonicOS vulnerabilities across Gen7 and Gen8 firewalls. The most urgent is CVE-2026-19868, rated 7.1 (high) on the CVSS scale and reported by Ryan Harris of The Electronic Office.

According to SonicWall, the flaw is an authentication enforcement problem in the SonicOS SSL VPN service. A user who holds valid credentials for a different authentication method can bypass SAML authentication controls, and with them any MFA that SAML was meant to enforce. In practice, that weakens the extra login step many organisations rely on to stop attackers who have stolen a password.

SonicWall says its product security team has investigated a report indicating potential exploitation. CISA went further and added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 6 November, giving US federal agencies until 20 November to fix it. Neither SonicWall nor CISA has shared details of the attacks, and it is not clear whether the bug was used before the fix was available.

Who is affected

The issue matters only where SAML-based login is enabled for the SSL VPN, according to the vendor. Affected firmware is:

• Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older.
• Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older.

The fixed releases are SonicOS 7.3.4-7013 for Gen7 and SonicOS 8.2.3-8015 for Gen8. SonicWall lists no workaround, so upgrading is the only fix.

The other six flaws

Even if you do not use SAML, the same advisory is worth acting on. Reports on the advisory list:

• Two flaws rated 8.8 in the SonicOS management interface: a permissive cross-domain policy issue (CVE-2026-107155, which needs user interaction) and a session validation bug (CVE-2026-107154). Under certain conditions a remote attacker could abuse them without logging in.
• A pre-authentication heap buffer overflow in the SSL VPN (CVE-2026-82308, rated 7.5) and two TACACS+ client flaws (CVE-2026-77708 and CVE-2026-77709) that could be used to knock services offline.
• A weak password hashing issue on virtual appliances (CVE-2026-19703) that could expose a limited platform credential to someone who already has high-privileged local access.

None of these six is marked as exploited so far.

Why this matters

Firewalls and VPN gateways sit on the edge of the network and are reachable from the internet by design, which makes them a favourite target. SonicWall devices have been hit repeatedly this year. In July and September, attackers exploited zero-day flaws in SonicWall’s separate SMA 1000 remote access appliances, and SecurityWeek notes that another SonicWall bug, CVE-2026-102255, began to be targeted days after disclosure.

The new flaw is especially awkward because it undermines MFA, which organisations often treat as their safety net when passwords leak. Stolen VPN passwords are widely traded, so an attacker who can sidestep the second factor may walk straight into the internal network. For Nigerian and African firms that moved staff to remote or hybrid work and rely on a single edge firewall, the VPN is often the front door to file servers, accounting systems and email.

What you should do

1. Find your firewalls and their generation. In the SonicOS web interface, check the model and firmware version on the dashboard or system status page. Confirm whether each unit is Gen7 or Gen8 before choosing the release.
2. Upgrade. Install SonicOS 7.3.4-7013 or later on Gen7 units and 8.2.3-8015 or later on Gen8 units. Back up the configuration first and plan a short maintenance window, because the firewall will restart.
3. Review SSL VPN sign-in methods. Check which authentication methods are enabled alongside SAML. Remove any you do not need, especially local accounts that do not have strong, unique passwords.
4. Check VPN login logs. Look for sign-ins at odd hours, from unexpected countries or by accounts that normally use SAML but logged in another way. Investigate anything you cannot explain.
5. Lock down the management interface. Make sure the firewall’s admin page is not reachable from the internet, and restrict it to trusted internal addresses.
6. Reset credentials if in doubt. If you see signs of misuse, reset VPN passwords and revoke active sessions after patching.
7. Ask your IT provider. If a managed service provider runs your firewall, ask them in writing to confirm the version installed and the date it was updated.

Patch first, then review. With no workaround and a confirmed listing in CISA’s exploited catalogue, every day an affected firewall stays on old firmware is a day of unnecessary risk.

Sources

• SecurityWeek: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
• Cyber Security News: SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw
• Help Net Security: SonicWall SMA zero-days were exploited weeks before disclosure

Featured image: Photo: “computer laptop keyboard HP Pavilion Entertainment PC” by GoodNCrazy, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

Every time you sign in on a new phone, laptop or browser, your account remembers it. Over months, that list fills up with old devices, office computers, a cyber café PC you used once, and sometimes a device that should never be there at all. Criminals who steal session cookies or trick you into approving a new device rely on you never looking. This guide shows small business owners and everyday users how to review signed-in devices on Google, Microsoft, Apple and WhatsApp, and remove anything you do not recognise. Set aside 15 minutes.

Why this check matters now

• Stolen sessions skip your password. Information-stealing malware grabs browser session cookies so attackers can stay signed in without knowing your password or passing two-step verification. Companies such as Vercel are now rolling out device-bound sessions precisely because this attack is so common.
• Device-link scams are rising. Fraudsters increasingly trick people into approving a new device on their accounts, for example through fake promotions that ask for a selfie.
• Old devices are loose ends. A sold phone, a former employee’s laptop or a shared office PC may still be signed in.

Before you start

• Have your own phone and computer nearby, signed in, so you can recognise them on each list.
• Make sure you know your passwords and have two-step verification working, because you may sign yourself out of an old device by mistake.
• Do this on a device you trust, not a shared or public computer.

Step 1: Google account (Gmail, YouTube, Android)

1. Go to myaccount.google.com and sign in.
2. Open Security & sign-in.
3. In the Your devices panel, select Manage all devices.
4. Select each device or session to see details such as location, browser and last activity.
5. For anything you do not recognise or no longer use, select it and choose Sign out. If several sessions share the same device name, sign out of all of them.

What looks suspicious

Google advises watching for a device you do not recognise, a location you were not in, a date or time you do not remember, or a browser you do not normally use. Note that locations can be approximate, and a phone you recently factory reset may still appear. If something is clearly wrong, change your Google password straight away.

Step 2: Microsoft account (Outlook, Office, Windows)

1. Sign in to your Microsoft account security dashboard and open Advanced security options.
2. Scroll down to Sign out everywhere and select Sign out.

This signs your account out of browsers, apps and other places it is used. Microsoft says it can take up to 24 hours to take full effect, and Xbox consoles must be signed out separately. If you suspect someone else has access, change your password as well, since signing out alone does not change it. For work Microsoft 365 accounts, ask your administrator, who can revoke sessions centrally.

Step 3: Apple Account (iPhone, iPad, Mac)

On iPhone or iPad

1. Open Settings and tap your name.
2. Scroll down to the list of devices and tap one to see its details.
3. Tap Remove from Account and confirm for any device you do not recognise.

On a Mac

1. Choose the Apple menu, then System Settings, and click your name.
2. Scroll to the device list, click a device, then click Remove from Account.

On the web

1. Sign in at account.apple.com and select Devices.
2. Click a device and choose Remove from Account.

Apple notes that a removed device can reappear if it is still signed in and goes online. To remove one permanently, sign out on the device itself, or use Find My to mark a lost device as lost or erase it.

Step 4: WhatsApp linked devices

1. Open WhatsApp on your phone.
2. Go to Settings, then Linked Devices.
3. Review the list of active sessions such as WhatsApp Web and desktop.
4. Tap any session you do not recognise and select Log Out, or choose Log Out of All Devices to clear everything.

Business owners who run customer chats from WhatsApp Web on a shop computer should check this list weekly, because anyone with that computer can read every conversation.

Step 5: Your banking and payment apps

Many banking and fintech apps now list registered or trusted devices under security or profile settings. Look for any device you do not own. If you find one, or if the app does not show this but you suspect a problem, call your bank using the number on your card or in the official app and ask them to remove unknown devices from your profile.

Troubleshooting

• I signed out my own laptop. Just sign back in with your password and two-step verification.
• The same device appears many times. Each browser or app can create its own session. Remove the ones you no longer use.
• A location is a city I have never visited. Mobile networks and VPNs can make locations look wrong, so check the device type and time as well before deciding.
• An unknown device keeps coming back. Change your password, turn on two-step verification or a passkey, and scan your computers for malware, because a stolen password or infostealer may still be active.

Quick checklist

• Google: Security & sign-in, Manage all devices, sign out unknown sessions.
• Microsoft: Advanced security options, Sign out everywhere if anything looks wrong.
• Apple: Settings, your name, remove unknown devices.
• WhatsApp: Settings, Linked Devices, log out unknown sessions.
• Bank apps: check registered devices or call your bank.
• Change passwords for any account where you found a stranger’s device.
• Put a monthly reminder in your calendar to repeat this check.

Sources

• Google Account Help: See devices with account access
• Microsoft Support: How to sign out of your Microsoft account everywhere
• Apple Support: Review devices signed in to your Apple Account
• Techpoint Africa: How to log out of WhatsApp
• BleepingComputer: Vercel rolls out protection against stolen session cookie attacks

Read and share the original on Mosravo Endless Solutions Publications

Hackers are no longer just stealing data. Over the past month they have reached into supermarket fridges, cold rooms and even blood storage, changing temperature settings until stock spoiled. This week the FBI and CISA, together with three other US agencies, issued a joint warning urging operators of industrial refrigeration and cold chain monitoring systems to lock them down. This article explains what happened, why it matters to any business that keeps goods cold, and the practical steps to take now.

What happened

The French supermarket attacks

The wave began in France in mid-October. According to The Register and Infosecurity Magazine, attackers tampered with refrigeration controllers on 11 October 2026, triggering defrost cycles and pushing temperatures up. Retailers including Carrefour, Intermarché, Monoprix and Coopérative U reported affected stores. Intermarché’s parent group said about 150 of its stores were hit and Carrefour confirmed about 80. Le Monde reported one freezer near Bordeaux whose setpoint was changed from minus 22°C to 150°C, with a technician watching several settings change every second, which suggests automated tools.

France’s national cyber agency, CERT-FR, issued an alert on 12 October reporting numerous compromises of Danfoss AK-SM and AK-SC controllers, and also listed Dixell/Copeland xweb devices. Danfoss said the affected stores were running outdated firmware. Researchers at Claroty had disclosed flaws in Danfoss controllers, including a hidden authentication mechanism that could bypass the admin password, and Danfoss patched those in August 2025. Authorities have not confirmed which weakness was used in France.

It kept spreading

BleepingComputer reports that a second wave in November hit more than 115 stores across six European countries, with some systems shutting down and others reaching 50°C. On 3 November, France’s national blood service (EFS) said an incident at a refrigeration equipment provider had altered temperature and defrost settings at three blood storage facilities.

The FBI and CISA warning

The joint advisory from the FBI, CISA, and the US departments of Health and Human Services, Agriculture and Transportation targets electronic temperature controllers and commercial refrigeration management systems used in grocery retail and cold storage. These tools let operators monitor temperatures remotely, manage defrost cycles and control cooling equipment.

According to BleepingComputer’s summary, the agencies say attackers go after controllers that are unpatched or reachable from the internet, using authentication bypass flaws, code injection bugs and weak configurations. Once inside, they can change setpoints, force continuous heating or defrost, and blind operators to the real temperature. The possible results include lost inventory, shorter equipment life, fire hazards and unsafe storage that nobody notices in time.

Why it matters in Nigeria and across Africa

The same kinds of networked controllers sit inside supermarkets, cold rooms, pharmacies, hospital stores, vaccine depots, fish and poultry distributors, and food processors across the continent. Many were installed by a refrigeration contractor who enabled remote access so they could monitor or fix things without a site visit, often with the default password left in place. The Register reports that internet scans in October found more than 4,500 Danfoss controller interfaces exposed online. Nothing about that problem is unique to Europe.

In a market where power interruptions already strain cold chains and a single spoiled consignment can wipe out a month’s margin, a remote attacker quietly raising temperatures overnight is a serious business risk, not a curiosity.

How to tell if you are exposed

• Ask your refrigeration contractor which controller brand and model you use, how it connects to the internet, and who has remote access.
• Check for a web login page. If you or your contractor can reach the controller from a browser outside your premises without a VPN, it is probably exposed.
• Look for default passwords and shared logins that former staff or old contractors still know.
• Check firmware age. If nobody has updated the controller since installation, assume it is missing fixes.
• Watch for odd behaviour: unexplained defrost cycles, setpoints you did not change, alarms that were switched off, or temperature graphs that look too flat.

What you should do

1. Take controllers off the public internet. This is the agencies’ first recommendation. If remote access is genuinely needed, put it behind a VPN or a secure remote access service with strong authentication.
2. Change default and shared passwords on every controller and management console, and give each contractor their own account.
3. Apply firmware and software updates from the manufacturer. Ask your contractor to confirm the version in writing.
4. Separate the cold chain network from the office Wi-Fi and point-of-sale systems so one compromise cannot spread.
5. Set safe limits in the controller so it cannot be driven outside acceptable temperature ranges, as the advisory recommends.
6. Keep an independent check. A simple standalone thermometer or data logger that is not connected to the controller gives you a second opinion if the main system is tampered with.
7. If you suspect tampering, follow CERT-FR’s advice: disconnect or restrict network access, factory reset, patch, change all credentials, review accounts and reconfigure from scratch. In Nigeria you can also report incidents to ngCERT.

Refrigeration has quietly become part of your IT estate. Treat the controller box on the cold room wall with the same care you give your router and your accounting software.

Sources

• BleepingComputer: FBI, CISA warn of cyberattacks targeting refrigeration systems
• The Register: French supermarket refrigeration attacks
• Infosecurity Magazine: French supermarket cyber-attack impacts more refrigeration controllers

Featured image: Photo: “Digbeth Cold Storage – 123 – 135 Digbeth” by ell brown, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

A newly disclosed OpenSSH weakness lets an attacker sign in to certain locked or key-only Linux accounts simply by typing an extremely long password. The bug, nicknamed “*sshole” by the researcher who found it, only affects systems built on the musl C library, such as Alpine Linux, but those systems are everywhere: in Docker containers, cloud images, routers and embedded devices. OpenSSH has already shipped a fix in version 10.6p2. This article explains who is exposed, how to check, and what to change today.

What happened

On 5 November 2026, security researcher Ozgun Kultekin published details of an authentication bypass in the way OpenSSH checks passwords on musl-based Linux systems. According to his write-up and reporting by BleepingComputer and The Register, an attacker can log in to an account whose password field in /etc/shadow is a single asterisk (*) by sending a password longer than 256 bytes. The researcher’s page describes passwords between 257 and 1,024 characters being accepted.

An asterisk in the shadow file is a long-standing Unix convention meaning “no password can ever match this account”. Administrators use it for accounts that should only sign in with SSH keys, for service accounts, and on Alpine for the root account. The flaw turns that “locked” marker into a password that any sufficiently long string can satisfy.

BleepingComputer reports that the researcher used AI agents to run roughly 17,600 authentication tests while hunting for the behaviour. The Register says there is no indication that vulnerable systems have been exploited so far, but full technical details and a checking tool are now public, so that window may not last.

How the bug works, in plain terms

Three separate design decisions, each reasonable on its own, combine to create the hole:

1. musl’s crypt() returns “*” on failure. Since 2012, when musl’s password hashing function fails it returns the string * rather than an empty value.
2. musl rejects passwords over 256 bytes. Its SHA-512 password hashing refuses very long inputs as a denial-of-service safeguard, and that refusal counts as a failure, so the function returns *.
3. OpenSSH still hashes the attempt. A 2016 OpenSSH change, made to stop attackers discovering valid usernames by timing logins (CVE-2016-6210), makes sshd hash the supplied password even for accounts without a usable hash, borrowing a salt from another account that does have a real password.

Put together: the overlong password fails to hash, musl returns *, sshd compares that with the stored *, the two match, and the login succeeds.

Who is affected

Conditions that must all be true

Per the researcher and BleepingComputer, a system is only exposed when every one of these applies:

• OpenSSH is running on a musl-based distribution such as Alpine Linux, OpenWrt, Buildroot or Yocto, or in a container image built on one.
• PAM authentication is not in use. Alpine’s openssh-server package does not use PAM by default.
• SSH password authentication is enabled, which is OpenSSH’s default.
• At least one account has * as its password hash.
• At least one other account has a real password hash.

Cloud images deserve special attention

BleepingComputer notes that Alpine’s official AWS and Azure images include a default alpine account with passwordless doas rights. On those images, a successful bypass of that account could lead straight to root access.

Who is not affected

Systems using glibc, which includes Debian, Ubuntu and Fedora, are not affected, and neither are setups that authenticate through PAM. The researcher also lists the Dropbear SSH server and OpenBSD as unaffected, so embedded devices that run Dropbear rather than OpenSSH fall outside this issue.

Why this matters for African businesses and developers

Alpine is popular precisely because it is small. Many Nigerian and African startups, agencies and fintech teams use Alpine-based Docker images to keep cloud bills and image sizes down, and many small ISPs and hotspot operators run musl-based firmware on routers and access points. These systems are often set up once and forgotten. If any of them expose SSH to the internet with password logins switched on, they should be checked now rather than at the next maintenance window.

How to check your systems

1. Find musl-based hosts and containers. List servers, VMs, containers and appliances running Alpine, OpenWrt, Buildroot or Yocto with OpenSSH installed.
2. Check whether password login is on. Run sshd -T | grep -i passwordauthentication on each host. If it says yes, the host is a candidate.
3. Look for asterisk accounts. On Alpine, BleepingComputer suggests grep '^alpine:' /etc/shadow; more broadly, look for any account whose second field is *.
4. Review logs. Search authentication logs for password logins to accounts that should never accept one. On Alpine, grep "Accepted password" /var/log/messages is a starting point. A successful password login for an account with * in its shadow field is a red flag.
5. Use the researcher’s checker. The disclosure page links a checking tool on GitHub; review it before running it in production.

What you should do

• Update OpenSSH to 10.6p2 or later. On Alpine, run apk upgrade openssh and restart sshd. Rebuild Docker images so containers do not keep shipping the old package.
• If you cannot update yet, turn off password logins. Add PasswordAuthentication no to a file in /etc/ssh/sshd_config.d/ (or to sshd_config) and restart the SSH service. Make sure your key-based access works first so you do not lock yourself out.
• Do not expose SSH to the whole internet. Restrict it with a firewall, VPN or allow-list of office IP addresses.
• Treat suspicious logins as an incident. If logs show unexpected password logins, rotate keys and credentials, check for new users or cron jobs, and rebuild the host from a clean image where possible.
• Ask your vendors. If you rely on routers or appliances built on OpenWrt or Yocto, ask the vendor whether they ship OpenSSH and when a firmware update is due.

Key-only SSH with password logins disabled has long been best practice. This bug is a sharp reminder of why: an account you believe is locked may not be, and the simplest defence is not to accept passwords over SSH at all.

Sources

• BleepingComputer: OpenSSH flaw lets attackers log into password-disabled Linux accounts
• *sshole: researcher’s technical disclosure
• The Register: Get root on a musl Linux system with an overly long password

Featured image: Photo: “Inside Introduction to the Command Line” by OsamaK, CC BY-SA 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

AI assistants are moving from chat windows into browsers and desktop apps where they can click, type, read files and even run commands. That is useful, but it also changes the risk of something most people ignore: browser extensions. Two pieces of research published this autumn show how an ordinary extension could quietly take over an AI assistant. This practical guide is for business owners, IT staff and anyone using AI tools at work.

Key takeaways

• Researchers at Forever Security showed that a single browser extension could hijack AI assistants in Chrome, Edge, Perplexity Comet, Opera Neon and Claude in Chrome.
• A newer report, published on 6 November, says the same kind of extension could send instructions to Claude Desktop through Anthropic’s Dispatch feature.
• These were researcher demonstrations. No real-world attacks were reported.
• The fix is mostly good hygiene: keep browsers updated, cut back extensions, and switch off AI features you do not use.

Why extensions and AI agents are a risky mix

A browser extension with permission to read and change web pages can see and alter almost anything you do in that browser. Until recently, the worst case was stolen passwords or injected adverts. Now, when an AI assistant takes instructions from a web page or a signed-in session, an extension that can tamper with that page may be able to give the assistant orders as if they came from you. If the assistant can open files, use your camera, browse on your behalf or run commands, the extension inherits that power.

What the September research found

The Hacker News reported on 16 September that Forever Security tested five Chromium-based products. Their extension needed only two common permissions: one to change web pages and one (declarativeNetRequest) to change network traffic. With these, it injected code into the trusted page each AI feature listened to.

Results by product

• Gemini Live in Chrome: the researchers could read local files, use the camera and microphone and take screenshots. Google fixed this as CVE-2026-0628 in Chrome 143.0.7499.192 in early January 2026.
• Perplexity Comet: described as the worst case, with file reading, agent control and access to browsing history.
• Microsoft Edge: agent control only; fixed as CVE-2026-55945 in Edge 150.0.4078.48 on 2 July.
• Opera Neon and Claude in Chrome: agent control only, with no fix dates given for the specific method.

The new Dispatch report

On 6 November, The Hacker News reported further Forever Security research, written up by Gal Weizman, on Dispatch, a feature that lets people send tasks from their phone to Claude Desktop. The researchers say Dispatch accepted an ordinary signed-in claude.ai browser session. That meant an extension able to run scripts on claude.ai could send instructions to Claude Desktop, which can run commands on the computer.

In their test, a script sent prompts asking Claude to install a software package, and automatically clicked “Allow” on approval prompts. The package then opened the Calculator app, a harmless stand-in for what the researchers say could have been file theft or a backdoor. The attack required a malicious extension already installed, the user signed in to both claude.ai and Claude Desktop, Dispatch turned on, and the computer awake with the desktop app open.

How Anthropic responded

According to the report, the researchers notified Anthropic on 14 May. Anthropic accepted the report as valid but closed it as a duplicate of an issue it had already found internally, and on 13 October told the researchers Dispatch would be retired, targeting the end of October. The article says Dispatch is closed to new users. The researchers also suggested similar risks might apply to other remote-control features but had not tested them.

What this means for businesses

The lesson is not “stop using AI”. It is that AI tools with real permissions should be treated like any other powerful software. The weakest link is often an extension someone installed long ago and forgot about, which may since have been updated with new permissions.

A short action plan for SMEs

1. Audit extensions. On each work browser, open the extensions page and remove anything nobody can explain. Pay special attention to extensions that can read and change data on all websites.
2. Control installs. If your work browsers are centrally managed, set an allow-list of approved extensions.
3. Update browsers. Make sure Chrome is on 143.0.7499.192 or later and Edge on 150.0.4078.48 or later, and that automatic updates are on.
4. Turn off unused AI features. Disable cross-device or remote-task features you do not need. If you do need them, review which devices are paired and remove old ones.
5. Do not auto-approve. Read approval prompts from AI agents before clicking “Allow”, especially prompts to install packages or run commands.
6. Watch agent activity. The researchers recommend monitoring AI agents for unexpected package installs, setting changes, credential access and outside connections.
7. Separate profiles. Use a clean browser profile, with few or no extensions, for AI tools and sensitive work such as banking.

Frequently asked questions

Is my AI assistant hacked right now?

Very unlikely. The research describes possible attacks that require a malicious extension already installed. There was no public evidence of these methods being used in real attacks.

Are extensions from official stores safe?

Store review helps, but it does not guarantee an extension will stay safe after later updates. Fewer extensions means fewer chances for trouble.

Should we ban AI tools at work?

Bans often push staff to personal accounts you cannot manage. A clear policy on approved tools, extensions and settings is usually more effective.

Next steps

• Spend ten minutes today removing unused browser extensions on your work devices.
• Check your browser version and turn on automatic updates.
• List the AI tools your team uses and switch off remote-control or cross-device features nobody needs.
• Agree a simple rule: no one clicks “Allow” on an AI agent’s request without reading what it will do.

Sources

• The Hacker News: Malicious browser extensions could use Claude Dispatch to run code
• The Hacker News: One extension could hijack AI assistants across Chrome, Comet, Edge, Opera Neon and Claude

Featured image: Photo: “PSP Web Browser” by wyzik, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications

When criminals break into an email account, one of the things they can do is quietly set up forwarding or a hidden rule. Even after you change your password, a copy of every message, including invoices and password-reset emails, can keep flowing to them. This step-by-step guide shows small business owners and everyday users how to check Gmail, Outlook and web-hosting mailboxes for forwarding they did not create, and what to do if they find one.

Key takeaways

• Changing your password does not remove forwarding addresses, filters or rules an attacker created.
• In Gmail, check the Forwarding and POP/IMAP, Filters and Blocked Addresses and Accounts and Import tabs.
• In new Outlook for Windows, check Settings > Mail > Forwarding and Settings > Mail > Rules.
• Web host DreamHost’s October breach advice told customers to review webmail forwarding rules and filters, a good habit for every business mailbox.

Why this matters right now

Hosting provider DreamHost disclosed in late October that an attacker had broken into its web-based File Manager and reached some webmail systems, obtaining login details for a limited number of webmail users. Among its advice to affected customers was to check webmail forwarding rules and filters for anything they did not create. The same advice applies after any phishing incident, suspicious login alert or password leak. A hidden rule is a useful tool in invoice and payment fraud, because it lets criminals watch conversations and step in at the moment money changes hands.

What you need before you start

• Access to the mailbox in a web browser on a computer, since some settings are easier to find there than in phone apps.
• About 10 minutes per mailbox.
• A list of any forwarding you set up on purpose, such as sending a shared enquiries address to a staff member.

Step by step: checking Gmail

Google’s Gmail security tips list the settings to review. In Gmail on the web:

1. Click the Settings gear, then See all settings.
2. Open the Forwarding and POP/IMAP tab. Confirm your mail is not being forwarded to an address you do not recognise, and that your POP and IMAP settings are what you expect. If you do not use forwarding, choose Disable forwarding and save.
3. Open the Filters and Blocked Addresses tab. Look for any filter with a “Forward to” action pointing to an unknown address, and any filter set to “Delete it” that you did not create. A delete filter can hide bank alerts or replies you would otherwise notice.
4. Open the Accounts and Import tab. Under Send mail as and Check mail from other accounts, confirm every address belongs to you. Under Grant access to your account, make sure no unknown person has been given access.
5. Open the General tab and check your signature and vacation responder for changes.
6. Finally, run Google’s Security Checkup to review recovery options, 2-Step Verification and account permissions.

Step by step: checking new Outlook for Windows

1. Select Settings (the gear icon), then Mail, then Forwarding. If Enable forwarding is switched on and you did not set it, turn it off and save.
2. Go to Settings > Mail > Rules. Read each rule carefully. Watch for rules that forward or redirect messages, move them to folders you rarely open, mark them as read, or delete them.
3. To remove a suspicious rule, select More actions (the three dots) next to it, then Delete rule. Microsoft notes you can also use the toggle beside a rule to switch it off without deleting it, which is handy if you want to keep it as evidence while you investigate.

Classic Outlook on Windows

In the classic desktop app, rules are under Home > Rules > Manage Rules & Alerts, on the Email Rules tab. Check each account listed under Apply changes to this folder, because each mailbox has its own rules.

Step by step: hosting webmail and control-panel mailboxes

Many small businesses use email that comes with their web hosting, accessed through webmail or a hosting control panel. Menus differ between providers, but the checks are the same:

1. Sign in to your hosting control panel and look for sections named Forwarders, Email routing or similar. Remove any forwarder you did not create.
2. Sign in to webmail, open its settings and look for Filters, Rules or Forwarding. Remove unfamiliar entries.
3. Check for auto-replies you did not set.
4. If you use an email app such as Outlook or Thunderbird with this mailbox, update the saved password there after changing it, as DreamHost advised its customers.

If you find something suspicious

1. Take screenshots of the rule or forwarding address before removing it.
2. Remove the forwarding address, filter or rule.
3. Change the password to a strong, unique one, and change it anywhere else you reused it.
4. Turn on two-step verification if it is not already on.
5. Sign out other sessions from your account security settings.
6. Warn your contacts, especially customers and suppliers you exchange invoices with, and tell them to confirm any change in bank details by phone.
7. Check your sent and deleted folders for messages you did not send.
8. For a business mailbox, tell your IT provider, and if customer data may have been exposed, seek advice on your obligations under the Nigeria Data Protection Act.

Troubleshooting

• I cannot find the Rules option in new Outlook for my Gmail or Yahoo account. Microsoft says new Outlook does not support rules for third-party accounts, so check those mailboxes in their own web settings.
• A rule keeps coming back. Someone may still have access. Change the password again, sign out all sessions and check for unknown apps or people with access.
• Staff use a shared mailbox. Ask the account administrator to review it, since shared mailboxes can have rules too.

Monthly checklist

• Forwarding settings reviewed on every business mailbox.
• Filters and rules reviewed; unknown ones removed.
• “Send mail as” and account access lists checked.
• Two-step verification confirmed on.
• Recovery phone number and email up to date.

Sources

• Google: Gmail security tips
• Microsoft: Set up rules in Outlook
• Microsoft: Turn on automatic forwarding in Outlook
• DreamHost: October security incident

Featured image: Photo: “Free woman’s hands typing laptop” by unknown, CC CC0 1.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications