CyberExperts.com

Cybersecurity news, intelligence & practical insights. Helping professionals stay informed, prepared & secure. | 5 Minute Cyber Brief ⚡

[CyberExperts.com @CyberExpertsUS]

Attackers got into unpatched Check Point Mobile Access gateways through the PHP2Shell bug, then used a second bug to become root. Install the November Jumbo Hotfix for your version, then check for signs of break-ins since Oct 30.

https://t.co/saKAp7M8bA

[CyberExperts.com @CyberExpertsUS]

Thursday's brief: upgrade clustered FortiGates first, push Zoom Workplace 7.1.8, require the new iOS and macOS builds, and find any emSign certificate before Windows drops the roots on Monday.
https://t.co/KACpABhPL0

[CyberExperts.com @CyberExpertsUS]

Starting Monday, Nov 16, Windows and Edge stop trusting the last eMudhra root certificates. If a site, VPN portal or vendor login you rely on uses an emSign certificate, replace it this week.
https://t.co/4klYxbyzAe

[CyberExperts.com @CyberExpertsUS]

Apple's Monday updates fix a Bluetooth bug that lets a nearby device pair with an iPhone or Mac without a tap, and an iMessage bug that lets outsiders join group chats. Require iOS 27.2.1 or 26.7.3 in MDM.
https://t.co/jKhuwOyvyw

[CyberExperts.com @CyberExpertsUS]

Fortinet released a critical patch for FortiOS that fixes a memory corruption vulnerability. If you're running FortiOS, update now. https://t.co/x0e9VeY7i3

[CyberExperts.com @CyberExpertsUS]

Could you pass the ISSEP? Per NIST SP 800-59, which provides the framework for effective security controls over federal resources: Clinger-Cohen, OMB Circular 130, FISMA or EO 13011? Answer + explanation in video. Free ISSEP practice: https://t.co/2N7t5hVM1t

[CyberExperts.com @CyberExpertsUS]

Zoom fixed a critical bug in Zoom Workplace for Windows that an outsider can trigger with no account. The fix is version 7.1.8. Check what your fleet is actually running, then turn on auto-update.
https://t.co/0qEo7xLeyM

[CyberExperts.com @CyberExpertsUS]

Wednesday's brief: push the November Office update for the Outlook hash leak, relaunch Chrome on 157.0.8103.50, confirm the Barracuda gateway patch before Friday, and upgrade N-central before it goes back online.
https://t.co/ACxfNaAIvq

[CyberExperts.com @CyberExpertsUS]

N-central follow-up: N-able shipped 2026.4 Hotfix 2 and says attackers are scanning for unpatched servers. On-prem: install the hotfix while still offline, update agents and probes, then reconnect.
https://t.co/NzBpOSc1Dc

[CyberExperts.com @CyberExpertsUS]

Barracuda now sees attacks on the email gateway bugs it patched November 2. CISA wants them fixed by Friday, with a compromise check. Confirm the patch landed, turn auto-patching back on and keep the admin page off the internet.
https://t.co/MSZuamg5OZ

[CyberExperts.com @CyberExpertsUS]

Microsoft fixed an Outlook bug attackers were already using: open a booby-trapped message file and Outlook sends your Windows sign-in hash to their server, no warning. The fix is in the November Office update, not the Windows one. Block outbound 445 too.
https://t.co/osJjOT8Yef

[CyberExperts.com @CyberExpertsUS]

@HemaneYugal Pretty much. Once it's on KEV, attackers are already using it, so it jumps the queue, especially if the system faces the internet. Patch soon is for bugs nobody has seen exploited yet.

[CyberExperts.com @CyberExpertsUS]

Attackers are already using a Windows bug Microsoft fixed Tuesday. It lets a booby-trapped file skip the "this came from the internet" warning. CISA wants it patched by Friday. Push the October update to email laptops first, and make sure they restart.
https://t.co/va56O7Xozm

[CyberExperts.com @CyberExpertsUS]

@HemaneYugal Start with the web or app access logs around the vulnerable endpoint: unusual POSTs, odd user agents, long or encoded parameters, and 500 errors from unknown IPs. Then look for new admin accounts, new files in web directories, and outbound connections you can't explain.

[CyberExperts.com @CyberExpertsUS]

A China-linked spy group was inside BeyondTrust Remote Support appliances for six weeks before a fix existed. CISA wants self-hosted boxes patched today. Patch first, then check for intruders.
https://t.co/nLxfHyYjyU
Does your help desk host its own?

[CyberExperts.com @CyberExpertsUS]

Good question. Hit the service itself rather than the package manager: check the version banner or status page it serves, or the running process (e.g. php -v from the same PHP-FPM pool, or the app's /health or version endpoint). If it still shows the old build, the restart didn't take.

[CyberExperts.com @CyberExpertsUS]

PHP2Shell patches are out (8.5.12, 8.4.27, 8.3.36, 8.2.35) and attack attempts are already hitting sensors. Restart every PHP worker and check the version that is actually serving requests.
https://t.co/Ykpjtm68l3

[CyberExperts.com @CyberExpertsUS]

CISSP myth or fact: Bell-LaPadula is about integrity. Verdict and why in the video. Free, no card.
https://t.co/sALhqxZ99s

[CyberExperts.com @CyberExpertsUS]

CISSP myth or fact: Bell-LaPadula is about integrity. Verdict and why in the video. Free, no card.
https://t.co/sALhqxZ99s

[CyberExperts.com @CyberExpertsUS]

Google patched a Chrome bug that attackers already have an exploit for. The fix downloads on its own but does nothing until the browser restarts. Get every machine to 157.0.8103.50 or later and force a relaunch.
https://t.co/0f1C5EBlwU

[CyberExperts.com @CyberExpertsUS]

Tuesday's brief: keep on-prem N-central offline until N-able's hotfix, upgrade FreeSWITCH to 1.11.3, patch Aspera Faspex to 5.0.19 PL1, and check Alpine hosts for SSH keys nobody added.
https://t.co/fh5ElRPTqw

[CyberExperts.com @CyberExpertsUS]

SSHole follow-up: attackers are now logging in to Alpine hosts and adding their own SSH keys, which survive the patch. Update openssh, restart sshd, then check every authorized_keys file.
https://t.co/7AiA8X3s38

[CyberExperts.com @CyberExpertsUS]

IBM Aspera Faspex 5: any signed-in account, client logins included, can grab full admin. CISA lists it as exploited with a Thursday deadline and IBM has no workaround. Install 5.0.19 PL1 and check for new admins.
https://t.co/bqqMJGOsJk