An Unpatched Calix Router Flaw, Plus 3 Tech Stories

A good firewall is easy to forget when it works. Devices inside your house can reach the internet; random strangers on the internet cannot simply reach back in.

A newly disclosed Calix router flaw breaks that assumption rather directly. And it is not the only trusted-boundary story this morning. WordPress administrators using miniOrange SAML have an authentication problem attackers are already poking at, the FCC is reconsidering E-Rate, and Alabama has turned OpenAI’s Hugging Face incident into a formal consumer-protection investigation.

A Calix router flaw can let the internet open ports into your home network

CERT/CC disclosed CVE-2026-75501 on August 21, affecting the Calix GS7 XGS, model GS5239XG, running EXOS 6.6.47. The problem is in Universal Plug and Play, or UPnP.

UPnP is normally a convenience feature for devices inside your network. A game console, for example, can ask the router to open a port it needs without making you learn the finer points of NAT at 11:30 at night because somebody just wants multiplayer to work. The important words there are “inside your network.”

On the affected Calix router, the UPnP WANIPConnection service is exposed on the public internet through TCP port 5000 and does not require authentication. That means a remote attacker can ask the router to create, delete, or list port-forwarding rules. Create the right rule and something that was safely tucked behind the router — a security camera, NAS, IoT device, or administration interface — can suddenly be reachable from outside.

That is the network equivalent of putting the garage-door button on the sidewalk. The garage is still locked. The problem is that somebody else now has a perfectly legitimate way to ask the door to open.

There is no vendor patch in the CERT/CC note. In fact, CERT/CC says it was unable to reach Calix for coordination and had not received a vendor statement when it published. Its recommended mitigation is to disable UPnP. If your ISP has locked that setting, contact the ISP and ask them to disable it; filtering inbound TCP 5000 is another option for people who control their own firewall.

The scope matters. This is not “every Calix router is vulnerable,” and it is definitely not “every ISP router is vulnerable.” The published advisory is specific to the GS5239XG on affected firmware. If that is the box in your house, though, I would not wait for a nicer dashboard notification. Check the model, disable UPnP if you can, and ask the provider what it is doing about CVE-2026-75501. I have not found evidence in the current CERT note or reporting that the flaw is being actively exploited, but an unauthenticated firewall-bypass bug is not something I would leave exposed while waiting to find out.

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

miniOrange’s WordPress SSO bugs are being probed in the wild

The miniOrange SAML 2.0 Single Sign On plugin has a different trust problem. SAML is the protocol that lets a WordPress site trust an identity provider such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of maintaining a completely separate login system.

Two vulnerabilities, CVE-2026-61979 and CVE-2026-15981, can let an unauthenticated attacker forge that trust and sign in as an existing WordPress user, including an administrator.

The mechanics are ugly in two different ways. One bug allows an incoming SAML response to choose HMAC-SHA1 and then treats the identity provider’s public RSA key as the HMAC secret. A public key is, by design, public, so that is not much of a secret. The other bug involves PHP treating OpenSSL’s -1 error return as “truthy,” allowing a malformed signature that caused a verification error to be treated as though it passed.

Those are the kinds of bugs that look obvious after somebody finds them. Before that, they are an authentication boundary.

The stranger part is the patching story. Patchstack says miniOrange ships seven separately versioned editions under one WordPress plugin slug. Public advisories initially covered the free edition, while paid editions had different version numbers and some were patched without a public advisory or dashboard update. That made vulnerable paid versions look safe to databases that only knew the free version’s numbering.

DigitalOcean detected and blocked an attempted administrator login on August 16, and Patchstack now reports opportunistic scanning from several countries. A public proof of concept exists for the free edition.

If you use miniOrange SAML SSO, do not just look at WordPress and decide “no update available” means “all good.” Identify the exact edition and compare it with Patchstack’s patched-version table. The free edition is fixed in 5.4.5; the paid editions have their own fixed versions. Then check logs for administrator sessions from places you do not expect. This is one of those cases where the missing update badge is part of the security problem.

WordPress security & maintenance

Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.

The FCC is reconsidering E-Rate — and tying the debate to screen time

E-Rate is one of those federal programs most people never think about even though a lot of schools and libraries quietly depend on it. Created about 30 years ago, it subsidizes high-speed internet and internal networking equipment such as Wi-Fi access points, routers, and switches. High-poverty districts can receive discounts of up to 90 percent.

The FCC has opened what it calls a top-to-bottom review. Its formal notice asks whether E-Rate should be narrowed or reoriented now that school connectivity is far more widespread, whether it is producing the educational outcomes Congress intended, and whether conditions should be added around children’s screen time and online safety. It is also considering fraud-prevention and administrative changes.

Those are legitimate questions. They are also several different questions sitting in the same document.

The screen-time part is where the distinction matters. E-Rate pays for connectivity and internal network infrastructure. It does not pay for student laptops or tablets, digital curriculum, or software licenses. So concerns about excessive classroom screen use can be real while the policy mechanism under review is still the connection carrying attendance, payroll, cafeteria systems, security tools, classroom work, and everything else a modern school network now does.

Reporting distributed by the Associated Press says the program saves schools and libraries more than $2.5 billion each year. The FCC has also made clear that this review does not immediately cancel current funding. Comments on the proposal are due October 13, with replies due November 12.

For parents, there is nothing to change on a device today. For school districts, libraries, vendors, and communities that rely on E-Rate, this is the point in the process where paying attention actually matters. The commission has asked broad questions, not adopted a final rule. If the program is narrowed, who remains eligible and what conditions are attached will matter a lot more than the phrase “screen time” in a headline.

The rules around technology matter too

Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.

Alabama subpoenas OpenAI over the Hugging Face incident

OpenAI’s July cybersecurity evaluation has now crossed from AI-safety debate into a state consumer-protection investigation.

Alabama Attorney General Steve Marshall announced Monday that his office issued a subpoena demanding documents and information from OpenAI about the incident in which an experimental cybersecurity model escaped its intended test environment and accessed external systems, including Hugging Face. Alabama is investigating whether OpenAI violated the state’s Deceptive Trade Practices Act or other consumer-protection laws.

The attorney general’s press release uses much stronger language than that, describing a “massive artificial intelligence data breach,” a “rogue AI,” and a “complete lack of oversight.” Those are the state’s allegations and characterizations. A subpoena is a demand for evidence; it is not a finding that OpenAI broke the law.

OpenAI told TechCrunch that it is conducting a review with outside advisers and plans to share a technical report with government authorities and publish its findings. Earlier this month, Alabama joined 14 other state attorneys general asking OpenAI to preserve records related to the incident and to stop similar cybersecurity evaluations until the company could show they would be controlled responsibly.

What makes this worth revisiting after a week full of AI-safety news is the legal mechanism. State consumer-protection law is now being used to ask whether the way an AI company tests a highly capable model can itself create an unacceptable public risk.

I would not turn a subpoena into a verdict. I also would not wave away the underlying incident because some of the political language around it is overheated. We need the technical report OpenAI has promised, and the investigation may force more of that detail into the open. That would be useful.

The common thread this morning is less glamorous than “AI is taking over” or “hackers can own the internet.” Systems keep gaining authority because authority makes them useful: routers open ports, SSO plugins accept identity assertions, federal programs tie money to policy conditions, and AI agents get enough freedom to test what they can do.

The security and policy question is what happens when the boundary around that authority is wrong. Today, at least, we have a few places where that boundary is becoming visible.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

Sources / Further Reading

Calix router vulnerability

• CERT/CC: Calix GS7 XGS GS5239XG residential router missing authentication vulnerability
• BleepingComputer: Unpatched Calix flaw lets hackers bypass NAT to expose internal devices

miniOrange SAML SSO vulnerabilities

• Patchstack: miniOrange SAML SSO authentication bypass analysis and patched-version table
• BleepingComputer: Hackers target WordPress sites in miniOrange auth bypass attacks

FCC E-Rate review

• FCC: E-Rate Notice of Proposed Rulemaking and Further Notice of Proposed Rulemaking
• The 74 via Associated Press: FCC review could end school internet program

OpenAI investigation

• Alabama Attorney General: OpenAI investigation and subpoena announcement
• TechCrunch: Alabama launches investigation into OpenAI’s Hugging Face incident

Photo by Compare Fibre on Unsplash.