Your Security Tools Need Security, Plus 3 Stories
The devices and software that protect a business can become some of its most valuable attack targets. That’s the thread running through today’s most urgent news: attackers are exploiting a firewall management interface, an email security gateway, and a backup management server. There are also important changes for Florida families, remote employers, and anyone who keeps a browser open for days at a time.
The Security Stack Has Become the Attack Surface
CISA’s latest alert puts three kinds of security tools under attack. The agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog Wednesday. They affect three products that are supposed to make organizations safer: Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and AhsayCBS backup servers.
The Cisco flaw is the most direct. CVE-2026-76519 affects the Advanced Malware Protection feature in Secure Email Gateway. The gateway examines attachments and asks Cisco’s file-reputation service whether they’re dangerous. A specially crafted attachment can abuse a path-traversal error to write a file somewhere it shouldn’t, then run commands as root. The attacker doesn’t need an account. Cisco says there’s no workaround, so affected gateways need fixed software, not a hopeful configuration tweak.
Palo Alto’s CVE-2026-0322 is different. An attacker needs authentication and network access to the PAN-OS management interface, but successful exploitation can still run arbitrary code as root on PA-Series or VM-Series firewalls and Panorama. Palo Alto says it has seen limited exploitation. Patch the affected release, restrict management access to trusted internal addresses, and review the company’s indicators of compromise. Restricting access reduces who can reach the vulnerable service. It doesn’t repair the flaw or prove the device is clean.
The Ahsay story may be the most instructive for smaller organizations and managed service providers. Attackers are chaining an authentication bypass, CVE-2026-105133, with a command-injection flaw, CVE-2026-105134, in AhsayCBS. Huntress observed web shells and cryptocurrency miners on compromised systems. Ahsay also says earlier patches didn’t fully fix the problem. Version 10 customers need hotfix 10.3.4.45, while versions 7 through 9 need 9.15.2.70, followed by a reboot.
I keep coming back to the same practical question: who can erase the backups as well as the live systems? A backup server with SYSTEM-level malware is no longer a recovery plan you can simply trust. If your provider uses AhsayCBS, ask for the installed hotfix version, whether the management interface was exposed, and whether they checked the published indicators. If evidence of compromise exists, Huntress recommends rebuilding the host from a trusted backup. This is the same uncomfortable lesson behind the recent Veeam backup-server warning: a backup product is part of your privileged infrastructure, not a magic safety box.
Backups & recovery
Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.
A federal appeals court has cleared the way for Florida to enforce H.B. 3 while the underlying case continues. The law requires covered platforms to block accounts for children under 14. Fourteen- and 15-year-olds need parental consent.
This isn’t a ban on every website with comments. The law targets platforms that use algorithms to select content and have features such as infinite scrolling, push notifications, public engagement counts, autoplay, or livestreaming. The Eleventh Circuit concluded that the law is likely content-neutral and can probably survive intermediate First Amendment scrutiny. It reversed the preliminary injunction, but that isn’t the same as a final Supreme Court ruling that every part of the law is settled forever.
The practical catch is age assurance. A platform can’t reliably exclude a 13-year-old without estimating or verifying age, and verification can create a new privacy problem if it collects government IDs, facial estimates, or other sensitive information. The court’s opinion acknowledges that platforms face significant compliance work, but it doesn’t make the technical tradeoff disappear.
Florida families don’t need to upload documents to anyone this morning merely because the injunction was lifted. Watch what each service actually asks for, what data it retains, and what appeal comes next. Platforms have a more immediate problem: the state can enforce the law while litigation proceeds.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
A Company Laptop Doesn’t Prove Who Is Using It
The Justice Department says a North Korean remote-worker scheme reached more than 70 U.S. employers and generated about $3 million. Prosecutors announced two arrests, an indictment, searches at more than 40 Texas locations, and the seizure of roughly 187 laptops and KVM devices. The criminal charges are allegations, and the defendants are presumed innocent unless proven guilty.
The mechanism matters more than the spy-movie headline. According to the indictment, workers used stolen or fabricated identities, VPNs, proxies, and U.S.-based facilitators. Company laptops were shipped to U.S. homes, where facilitators installed remote-access software so someone elsewhere could appear to be working locally. The laptop was in America. The operator wasn’t necessarily in the room.
For employers, the answer isn’t to treat every remote applicant as a suspect. It’s to verify the person and the working arrangement at several points: compare identity documents with a live interview, ship devices only to verified addresses, inventory remote-control software, limit a new hire’s access, and independently confirm payroll-account changes. No single check solves this. Several ordinary controls make the fraud much harder to sustain.
Restart Chrome and Firefox After Their Big Updates
Google’s Chrome 155 update fixes 37 security defects, including seven critical memory-safety problems. Mozilla’s Firefox 158 fixes 77 vulnerabilities, including high-severity use-after-free bugs, sandbox escapes, privilege-escalation flaws, and information leaks. There’s no public indication in the vendor advisories that these particular browser bugs are already being exploited.
Browsers usually update themselves, but the new code doesn’t protect an old process that’s still running. Check for updates and restart the browser, especially on shared workstations and managed systems that stay open for long stretches. Chrome desktop should reach 155.0.8059.79 or .80, depending on the operating system, and Firefox should reach version 158. The exact version matters more than the reassuring little “up to date” message you saw last week.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources and Further Reading
- CISA: Four additions to the Known Exploited Vulnerabilities catalog
- Palo Alto Networks advisory for CVE-2026-0322
- Cisco Secure Email Gateway advisory for CVE-2026-76519
- Ahsay’s updated hotfix instructions
- Huntress: observed AhsayCBS exploitation and indicators
- Eleventh Circuit opinion in CCIA v. Uthmeier
- Reuters: Florida can enforce its under-14 social-media ban
- Justice Department: North Korean remote IT worker enforcement actions
- FBI/IC3 guidance for employers
- Google Chrome 155 desktop release notes
- Mozilla Firefox 158 security advisory
Photo by panumas nikhomkhai on Pexels.
