Cisco Email Gateways Are Under Attack, Plus 4 Stories
A malicious email can root Cisco’s email gateway
If you run Cisco Secure Email Gateway on-premises, this one deserves attention before the rest of the morning gets away from you. Cisco disclosed CVE-2026-76461 Monday and says attackers are already exploiting it. The vulnerability affects physical and virtual Secure Email Gateway appliances regardless of configuration. An attacker doesn’t need an account. They can send a specially crafted email through the gateway and, if exploitation succeeds, execute commands as root on the operating system underneath it.
The mechanism is SQL injection in the gateway’s email-parsing logic. That’s worth spelling out because “email parsing vulnerability” makes this sound like somebody has to open a poisoned message. They don’t. The gateway itself processes the message. Malicious SQL embedded in that input can escape the boundaries the software expected, alter database operations and ultimately reach operating-system command execution. The thing you installed to inspect dangerous email can become the thing the attacker uses to get inside.
Cisco has no workaround. The first fixed releases are AsyncOS 15.5.5-014 for 15.5 and earlier, 16.0.4-302 for the 16.0 branch and 16.5.0-780 for 16.5. Cisco recommends moving to 16.5.0-780 when possible, and says its Secure Email Cloud devices have already been upgraded.
And because this is being exploited, patching is only half the job for an exposed system. Cisco tells administrators to check mail_logs for suspicious SQL, including patterns such as COPY ... TO PROGRAM, and to cross-check external firewall and network logs. That last part matters. Root access is root access; an attacker with that level of control may be able to remove the evidence you were hoping to find on the appliance itself. Cisco’s recovery guidance for a compromised virtual appliance includes preserving forensic data, deploying a clean fixed VM, rebuilding the configuration and renewing credentials and cryptographic material.
We’ve hit this point several times lately, but it’s worth repeating because the distinction keeps getting lost: installing a patch closes the vulnerability going forward. It does not travel backward in time and prove nobody used it yesterday.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
India is testing where a software warranty ends
India’s consumer regulator has escalated an investigation into Apple’s software warranty terms after complaints that the iOS 18 update damaged iPhone functionality and left owners paying for repairs.
The Central Consumer Protection Authority says complaints included green, pink or white screen lines and microphone problems after the update. It argues that charging customers for repairs when a company’s own software caused the problem could be an unfair trade practice. A display repair for an iPhone 15 was estimated at 27,900 rupees, about $291.
There’s an important “if” in that paragraph. Apple says it found no systemic iOS 18 problem or safety concern in India, says the case is based on 75 complaints, and argues that providing software without a warranty is normal across the industry. The regulator has opened a detailed investigation; it has not established that iOS 18 caused every failure being alleged.
What makes this more interesting than another batch of unhappy-phone-owner complaints is the warranty question. Apple’s software license says the software is provided without warranty, while the company’s limited warranty covers hardware. But a modern phone’s hardware and software aren’t really separate products in the way a toaster and the cookbook sitting beside it are. If a manufacturer requires or strongly encourages an operating-system update and that update can be shown to damage the device, how much of the repair cost can the manufacturer push back onto the customer with an “as is” software clause?
India could ultimately fine Apple, order refunds or require changes to its business practices. Or the investigation could conclude Apple’s explanation is sufficient. For now, the practical advice is less dramatic: keep current backups before major operating-system upgrades, document a failure if it appears immediately after an update, and keep service records. An investigation is not proof of a defect, but good records are useful if a warranty dispute becomes real.
China can now stop people leaving over “technology security”
China’s new entry-and-exit rules took effect Tuesday, adding technology and industrial security to the grounds the government can use to restrict travel. Citizens deemed a potential threat to national technology security can be barred from leaving the country.
The rules target violations involving export controls or technology import and export management that may endanger industrial or technological security. They also allow exit bans lasting six months to three years for citizens who return to China after illegal or criminal acts abroad that authorities say harmed national security or national interests. Foreign nationals can face entry bans of one to five years for false statements in visa applications.
This isn’t a general warning that everybody carrying a laptop through Shanghai is about to be detained. China has long restricted travel for some officials and state-linked employees with access to sensitive information. What changes is that technology-transfer and export-control language is now explicitly part of the legal framework. Taiwan has warned people working in technology to be especially careful when traveling to mainland China; Beijing says the new rules provide clearer legal protection.
For companies moving engineers, researchers or executives across borders, that widens the meaning of technology compliance. Export controls aren’t only about whether a chip, source-code repository or design document can cross a border. In some jurisdictions, the person carrying the knowledge can become part of the enforcement question too.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Exposed Vite servers are being mined for cloud credentials
Developers using Vite should check whether a development server has accidentally been exposed to the internet. F5 Labs says its honeypots recorded more than 32,000 Vite-related file-read events during August, up from 1,732 events across the previous three months. The scanners weren’t casually poking around. They were systematically looking for .env files, AWS credentials, Azure tokens, Terraform state, serverless configuration and process environment data.
The main flaw, CVE-2026-39364, is an unauthenticated file-read and access-control bypass in Vite’s development server. Vite has an internal /@fs/ route that lets the development environment serve files from the host system while a deny list is supposed to keep sensitive files off limits. Carefully chosen query parameters can bypass that check and cause a protected file to come back in plain text.
By default, Vite binds to localhost, which is exactly where a development server belongs. The risk appears when somebody starts it with --host, changes server.host, maps the wrong Docker port or otherwise makes that development service reachable from outside. At that point, one request can expose credentials that open something far more valuable than the test site.
F5 recommends updating to a fixed release — 7.3.2, 8.0.5 or an appropriate patched point release on older supported branches — and eliminating public exposure of development tooling. I’d add one more step that follows directly from what attackers are searching for: if an affected Vite server was publicly reachable while vulnerable, assume any secrets available through it may have been read and rotate them. Changing the lock on the development server doesn’t invalidate an AWS key somebody may already have copied.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
The UK is moving 23 million government logins toward passkeys
Here’s a security story where the action is mostly “please do more of this.” The UK government is rolling passkeys out to more than 23 million GOV.UK One Login users after an initial trial with more than 300,000 people. One Login is used for services including taxes, pensions, childcare support and driver’s-license services.
A passkey replaces the secret you type with a cryptographic credential tied to the legitimate service. Your phone or computer can unlock it with the same fingerprint, face scan or PIN you already use on the device; the biometric data stays on the device rather than being handed to the website. Because the credential is bound to the real site, a fake login page can’t simply collect it the way it can collect a password or one-time code.
The government says nearly one in ten daily One Login sign-ins already uses a passkey and estimates the change is saving almost £600 a day in SMS costs. Passwords and security codes remain available as a fallback, which is a useful reminder that account recovery still matters: beautifully phishing-resistant front-door authentication doesn’t help much if the back door is weak.
Still, this is what I want to see from passkeys: not another standards announcement, but millions of normal people using them for boring, important accounts. If a service you trust offers a passkey, it’s increasingly worth taking the couple of minutes to set one up — just don’t create one on a shared device that somebody else can unlock.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Cisco: Secure Email Gateway SQL Injection Vulnerability
- Reuters: India escalates Apple software-warranty investigation
- Reuters: China tightens travel rules over technology security
- F5 Labs: Mass scanning for exposed Vite endpoints
- BleepingComputer: Vite servers targeted for AWS and Azure secrets
- GOV.UK: Passkeys expand across One Login
