Misconfig Monday

Free weekly newsletter of patch priorities + one misconfig fix, every Monday. Tailored towards businesses without a dedicated SOC or limited IT support.

[Misconfig Monday @MisconfigMonday]

"Auto-updates are enabled" is a setting, not proof the fix landed.

For WordPress 7.1.4, the release says background updates begin automatically on sites that support them. Check the installed core version or ask your host to confirm completion.

[Misconfig Monday @MisconfigMonday]

Cannot patch Alpine SSH yet? Alpine says disabling password authentication closes this hole.

First verify key login works. Keep your session open, set PasswordAuthentication no, check the config and restart sshd. Test a new key login before disconnecting.

[Misconfig Monday @MisconfigMonday]

New on CISA's exploited list does not always mean a new bug.

Apple CVE-2024-27834 was added Nov 4, 2026. Apple documented a fix in Safari 17.5 back in 2024.

Keep browsers on supported, current releases; do not stop at an old minimum fix.

[Misconfig Monday @MisconfigMonday]

Solo IT question: if you were unreachable tomorrow, could someone find the emergency access instructions?

Not your passwords in a shared document. The steps, the authorized people and where approved recovery credentials are secured.

[Misconfig Monday @MisconfigMonday]

A break-glass admin account is not a reason to skip MFA.

Microsoft recommends phishing-resistant authentication, such as a FIDO2 security key, for Entra emergency accounts. Use a different method from your everyday admin login so one failure does not block both.

[Misconfig Monday @MisconfigMonday]

S3 gotcha: Block Public Access does not erase your old bucket policies or public ACLs.

Turn the guardrail off later and those permissions can matter again. Review the underlying policies too, rather than treating the switch as a cleanup tool.

[Misconfig Monday @MisconfigMonday]

The Alpine SSH bug is not "any long password gives root everywhere."

It depends on password login, affected non-PAM authentication and specific account/password-hash conditions. Root access has extra conditions.

Use Alpine's advisory, not the viral shorthand.

[Misconfig Monday @MisconfigMonday]

SonicWall SSLVPN admins: check CVE-2026-19868. CISA added it to its exploited list on Nov 6.

Valid credentials for an alternate login method may bypass SAML controls, including SAML-enforced MFA. Follow SonicWall's mitigation guidance for your setup.

[Misconfig Monday @MisconfigMonday]

Small-business question: who owns updates for your website?

You, your host, your web designer, or nobody quite knows?

Put one name next to that job today. "Managed hosting" is not a substitute for agreeing who checks that security updates landed.

[Misconfig Monday @MisconfigMonday]

Misconfig Monday #004 is out.

This week: turn off SSH password logins, then patch WordPress and SonicWall.

Plain-English steps for small businesses and IT teams without a SOC. Free:
https://t.co/FzuoJf7cOt

[Misconfig Monday @MisconfigMonday]

An S3 bucket being private today is not a permanent guardrail.

AWS recommends all four Block Public Access settings at the account and bucket levels. Check app needs before changing them: a public website may depend on public access.

[Misconfig Monday @MisconfigMonday]

Alpine SSH admins: installing the security update is only half the job. Restart sshd too.

Alpine says a package upgrade does not replace the running daemon. Use: rc-service sshd restart

Keep your current session open and test a fresh login.

[Misconfig Monday @MisconfigMonday]

Perfect spelling does not make an email safe.

CISA warns that phishing can now have flawless grammar. Look at the request: unexpected urgency, payment details or a login link?

Report suspicious messages through your normal process; do not reply to them.

[International Cyber Digest @IntCyberDigest]

‼️ UPDATE: Attackers have fired more than 240,000 exploit attempts at a WordPress flaw that opens while a site is updating, including the update that fixes it.

During an update, WordPress briefly leaves installer files in a predictable folder anyone can reach. Hit it in that window and an attacker with no password can create an admin account and plant code.

Every version from 4.7 to 7.1.3 is exposed.

The fix is 7.1.4. Wordfence advises blocking web access to the upgrade folder before installing it.

[Misconfig Monday @MisconfigMonday]

An urgent payment email is a reason to pause, not hurry.

If it might be real, contact the sender through a number or channel you already trust. Do not use the phone number or login link in the suspicious message to verify the message.

[Misconfig Monday @MisconfigMonday]

An app running on an AWS EC2 server should not need an AWS access key pasted into its code.

AWS recommends an IAM role with temporary credentials instead. Give the role only the permissions that app needs.

[Misconfig Monday @MisconfigMonday]

Next Monday: the next round of actively exploited bugs and a new 5-minute misconfig check.

Get it free: https://t.co/1ybK17H6r0

[Misconfig Monday @MisconfigMonday]

An edge device that was exposed while it was vulnerable may already be compromised, even after you patch.

Check vendor guidance for signs of compromise, and rotate the passwords and keys it held.

[Misconfig Monday @MisconfigMonday]

Before the weekend: re-check the admin ports you closed this week.

Shodan InternetDB only updates once a week, so a fresh fix may not show yet. For today, repeat the phone test: Wi-Fi off, cellular on, browse to your public IP. Re-run Shodan next week.

[Misconfig Monday @MisconfigMonday]

VMware ESX shops: CISA also added CVE-2026-41709 to KEV. It's low severity on its own (CVSS 2.7) and needs an admin.

But it's part of Broadcom's July advisory VMSA-2026-0006. On ESX 8.0 and skipped it? Go straight to 8.0 U3k, which also fixes a critical bug in it.