FIX256

Office website on WordPress? CISA just added a WordPress flaw to its actively exploited list. Log in, go to Dashboard, then Updates, and make sure you're on 7.1.4 or later.

Real software doesn't ask you to paste a command into PowerShell. A fake Claude download page did exactly that to start a malware infection (research from ANY RUN, via @TheHackersNews). Office rule: AI tools come from the vendor's site or your approved list. Never a search ad.

Fake "IT support" is reaching staff in Teams chats, often right after an inbox flood of sign-up emails. Arctic Wolf counted 400+ cases; Microsoft published two more on Oct 30. Teams external chat is on by default. Limit it to the partner domains you actually work with.

Small law firms: the biggest threat is a phone call. One extortion crew calls staff pretending to be IT, gets remote-access software installed, then copies client files by hand. Never let a caller you didn't contact install anything. Hang up and call IT on a number you know.

Tax firms: tell clients who'll file early in 2027 to get an IRS IP PIN before mid-November. The online tool goes down for maintenance until about mid-January.

Attackers got into Microsoft 365 at 79 orgs with MFA on, then hid payroll emails with inbox rules. Check this week: new MFA methods, new devices, odd inbox rules.

Using AI to summarize your inbox? Keep its permissions small. Summarizing shouldn't come with the power to send, pay or forward. Any payment change it flags still needs a human check and a call to a number you already have (via @Malwarebytes).

FBI/CISA on SafePay ransomware: it resets network backup drives to factory settings before encrypting. Is one backup copy offsite or offline, out of reach of your network and admin logins? When did you last test a restore?

PHP2Shell: CISA added two PHP flaws to its exploited list Oct 26, and the FBI issued a warning. Many small business websites run on PHP, including WordPress. Ask your web host which PHP version your site runs and confirm in writing that it has the fix.

New phishing trick: emails posing as a state business-filings office, with a "secure document" and an access code. Check the exact domain, and go to the agency's site yourself.

Cisco ASA or Firepower firewall with VPN at your office? A bug that can knock it offline is being exploited right now. Ask whoever manages it to update this week. Same week, WatchGuard Firebox fixes too. Know your firewall's model, its version, and who updates it.

A NY CPA firm's breach letters went out 13 months after the attack, partly because it took that long to learn whose data was taken. Can your firm say where client SSNs live today?

New Outlook for Windows won't open attachments? It's a known Microsoft issue and the fix is still rolling out. For now, use Save as, then open the saved file. Once the fix reaches you, close and reopen Outlook.

Small-office automation wins: intake forms that file themselves, new-hire/leaver checklists that actually remove access, invoice reminders that send themselves. Want one of these in your office? Call FIX256 at 845-210-1677.

WatchGuard Firebox owners: update this week. WatchGuard fixed 17 flaws, several reachable without logging in. Fixed versions: Fireware OS 2026.4 or 12.12.4 (12.5.22 for T15/T35). Not sure what you're running or who manages it? Worth finding out.

Law offices: one extortion group poses as "internal IT" to get remote access, then steals files. 42 of its 50 latest observed victims were law firms (Check Point, via Legal Futures). Rule: no remote access from a surprise call. Call IT back on a known number.

When did your office last test a restore? A backup you've never restored is a guess. Once a quarter: restore one file and one mailbox, and write down how long it took. Want a second set of eyes on your backups? Call FIX256 at 845-210-1677.

"Download ChatGPT" from a search ad may not be ChatGPT. Researchers tied 1,258 malware sandbox analyses since April to fake AI tool campaigns (via The Hacker News, Oct 15). Small-office fix: one short list of approved AI tools, and where to get them.

FBI warning for law firms: scammers pose as your IT support, get staff on a call, and talk them into a remote session. Free fix: agree on how real IT contacts you and proves it, and never give remote access to an unplanned caller.

Attackers got into Microsoft 365 tenants this month without phishing anyone, using a backup vendor's stolen app credentials. Ask your IT provider which apps can get into your M365, what they can do, and which you can remove.