Active exploits hit both Cisco email gateways and Palo Alto firewalls this week, so patching needs to move up the list.
Cisco warned that attackers are already abusing a critical flaw in Secure Email Gateway, where a crafted attachment lets an unauthenticated sender write files to the appliance and then run commands as root. If you run these gateways, check Cisco advisories, patch fast, and review logs for odd attachments and unexpected system changes.
Palo Alto Networks pushed fixes for a high severity PAN-OS remote code execution bug in the management interface, which the company says is under active exploitation. If you have internet exposed management on these devices, prioritise the update and lock down access to the interface to trusted admin networks only.
Nextcloud admins also got a scare after attackers used a flaw in the optional Collabora Online built in CODE Server app to plant web shells on servers, with the first logged attack on 10 September. If you use that app, audit your Nextcloud instances for web shells, apply the vendor guidance, and strip out unused or optional apps where you can.
On the phishing side, Microsoft and partners disrupted three phishing kits named CoGUI, Haozi, and Iron Man System, which they link to more than 1 billion scam messages since January 2026. This is good news, but you should assume copycat kits will fill the gap, so keep user training and mail filtering rules current.
The US Department of Justice also charged 14 people and seized about 187 computers and KVM devices tied to North Korea’s fraudulent remote IT worker scheme, which affected more than 70 US companies. If you hire remote contractors, tighten identity checks and watch for odd access patterns that might hint at hidden operators behind a single account.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.