The short version
- Cisco firewalls: attackers are using a flaw in the remote-access VPN of Cisco ASA and Firepower (FTD) firewalls to make them reboot. Upgrade to Cisco's fixed release.
- Ivanti VPNs: CISA says two more Connect Secure flaws are being exploited and can be chained with the October zero-day. Patch and check the appliance.
- PHP: the FBI wants two critical PHP flaws patched now. Ask whoever hosts your website.
- Magento and Adobe Commerce: a file upload flaw is now being exploited. Stores that haven't patched are exposed.
- Apple: older iPhones and iPads got an update for a flaw Apple says may have been used in targeted attacks. Update them too.
- Fake ads: the FTC is asking for comments on making platforms act on ads that impersonate real businesses. Search your own name this week.
Patch watch
A Cisco firewall bug is knocking VPN firewalls offline
Cisco published an advisory on October 28 for a high-severity flaw in the remote access VPN of its Secure Firewall ASA and Secure Firewall Threat Defense software. An attacker on the internet, with no login, can send a crafted request and make the firewall reload. Cisco says its security team became aware of active exploitation in October, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29. Only devices with the SSL remote access VPN reachable and secondary authentication set up on a tunnel group are affected.
An outage is the whole point here: repeat it and your office loses its internet and its VPN until someone gets there. Cisco says there is no workaround, though it does describe a mitigation that turns off secondary authentication and lowers VPN security, and it recommends upgrading instead.
What to do: Ask your IT provider whether you run a Cisco ASA or Firepower firewall with remote VPN. If so, have them upgrade to the fixed release in Cisco's advisory.
Two more Ivanti Connect Secure flaws are being exploited
On October 30, CISA added two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. CISA's entries say both can be chained with CVE-2026-104935, the authentication bypass it listed on October 13. One lets an attacker who is logged in escalate privileges, and the other lets one upload files to a known spot on the device. Chained, they are a way into the VPN box that sits at your front door.
What to do: If staff reach the office through an Ivanti VPN, have your IT provider apply Ivanti's latest update and follow its guidance on checking whether the appliance was already compromised.
The FBI says patch PHP now
PHP is the language behind a huge share of websites, WordPress included. On October 23 the FBI put out a public service announcement about two critical flaws, CVE-2026-109618 and CVE-2026-109619, that could let an attacker run code on a web server. It follows an FBI social media post on October 21, and CISA listed both flaws as exploited on October 26. The FBI says to update immediately, and if you can't, to take the system offline until it's fixed.
What to do: Ask your web host or developer which PHP version your site runs and whether it has the fix from php.net. Don't assume your host did it.
Magento and Adobe Commerce: a file upload flaw is under attack
CISA added CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento, to its exploited list on October 27. Its entry says it could lead to code running on the server.
What to do: If you sell online with Magento or Adobe Commerce, ask your developer this week whether the latest security patch is on.
Apple patched older iPhones and iPads
On October 26 Apple released iOS 18.7.11 and iPadOS 18.7.11 for the iPhone XS, XS Max, XR and iPad 7th generation. One fix covers a CoreGraphics flaw that a malicious file could use to run code. Apple says it's aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted people. That is not most of us, but these older devices are exactly the ones nobody updates.
What to do: On every work iPhone and iPad, go to Settings > General > Software Update and install what's offered.
Scams going around
Fake ads that use a real business's name
In a consumer alert on November 2, the FTC says scammers pay for ads on social media, search and shopping sites that impersonate well-known businesses and government agencies. The agency is considering changes to its Impersonation Rule that could hold platforms more accountable, such as vetting advertisers, giving people a way to report impersonation ads and removing the ones that turn out to be scams. Comments are due November 30, 2026.
For a small business, the risk runs both ways. Someone can run an ad as you and collect your customers' payments, or pose as a vendor to your staff.
What to do: Search your business name on Google and Facebook this week. Report any ad pretending to be you to the platform and at ReportFraud.ftc.gov, and tell customers the one website and phone number you use.
One thing to do this week
Make a list of everything of yours that answers to the internet: the firewall, the VPN, the website, the online store. Next to each, write who patches it and what version it's on. Three of this week's items are the same story, a front-door device that nobody was sure was updated. If you can't fill in a line, that's your answer. If a site gets hit anyway, our post on what to do when a WordPress site is hacked has the first steps.
Related reading
- The Top 5 Cybersecurity Threats Facing Small Businesses in 2026
- Our Only IT Person Is Out. Who Answers a 2am Security Alert?
- WordPress Site Hacked or Redirecting to Spam? First Steps
Originally published November 2026.
No comments yet