DHS Bans DeepSeek at US Civilian Agencies, and the Order Is Vague
The Department of Homeland Security ordered federal civilian agencies on Monday to stop using DeepSeek products and remove anything already in place. It covers “all DeepSeek…
Category
Security
Follow Security via RSSOctober Windows Server Updates Break On-Prem Exchange Mail and OWA: Here’s the Fix
Microsoft confirmed that October’s Windows Server security updates can break on-premises Exchange on Windows Server 2019 and later: OWA sign-in fails, mail sits in the Outbox,…
WPSplinter: A 16-Year-Old Broadcom Wi-Fi Bug Lets Strangers Hijack Routers
Researcher Quentin Kaiser disclosed WPSplinter, two bugs in Broadcom’s proprietary Wi-Fi Protected Setup (WPS) code dating back to at least 2010. Someone in Wi-Fi range can…
Update: ConnectWise Suspends Cloud Backup, SaaS Security and Cloud Management
Update to my earlier post, ConnectWise Cloud Backup Breach Hits Microsoft 365 Tenants. The outage got bigger. What’s new Because SaaS Security and Cloud Management are…
Plex2Shell: Attackers Are Taking Over Unpatched Plex Servers. Update Now
If you run Plex Media Server at home, stop what you’re doing and check your version. A four-bug chain called Plex2Shell is being used in the…
OpenCode Console Breach: Rotate Your OpenAI, Anthropic and Google Keys
Heads up if you use OpenCode’s hosted Console. OpenCode says an intruder got into a legacy system on the night of October 16, and the AI…
How-To: Web Server Quick Wins a Read-Only Audit Will Find
A careful read-only audit of a web server almost always turns up the same handful of things. None of them are fancy, and all of them…
How-To: Hardening an Authoritative BIND DNS Server
If you run your own authoritative DNS with BIND, it’s easy to set it up once and forget it. Here’s the checklist I work through: audit…
SiteGuard WAF Flaw CVE-2026-106931 Exploited: Root or SYSTEM via the Stats Feature
When the thing that’s supposed to protect your web server becomes the way in, that’s a patch-today item. What’s going on Attackers are exploiting CVE-2026-106931, an…
ConnectWise Cloud Backup Breach Hits Microsoft 365 Tenants: Check Your Service Principals
This is a supply-chain hit that MSPs and anyone running Microsoft 365 should look at today. ConnectWise shut down access to its Cloud Backup service (formerly…