Stay informed with the latest cybersecurity advisories, industry alerts, and news from Cyber One Solutions. This page collects security advisories on active threats and vulnerabilities, company updates and partnership announcements, and technology news that affects how businesses across Texas and Tennessee protect their operations.
PHP released emergency fixes on October 21, 2026 for two critical flaws, nicknamed "php2shell," that can let an attacker run code on any PHP web server without logging in. Attack traffic was observed before many servers could update. Here is who is affected, what cPanel servers need, and what to check now.
Microsoft Entra ID dynamic groups, administrative units, and access package policies that use the preview memberOf rule stop updating after November 3, 2026, freezing membership in whatever state it was in. Here is who is affected and how to check.
On October 20, 2026, the FBI, CISA, and the U.S. Secret Service, joined by German and UK agencies, published a joint advisory on the SafePay ransomware group, active since August 2024 and linked to at least 600 victims, detailing how it breaks in through five known, years-old vulnerabilities in edge devices and internet-exposed systems rather than new or undisclosed flaws. Here is what the advisory says, which products those flaws affect, and what to check now.
ConnectWise has suspended Cloud Backup, formerly SkyKick, after attackers used the app's own credential to sign in to customer Microsoft 365 tenants. Backups and restores are offline with no restoration date yet. Here is what is known, what to check if you use it, and what every Microsoft 365 business should review.
CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, the day after BeyondTrust and Google's Mandiant disclosed that a suspected China-nexus espionage actor exploited the flaw as a zero-day against BeyondTrust's Remote Support appliance in late August 2026. Here is who is affected, what BeyondTrust and Mandiant recommend beyond patching, and what to check now.
CISA added CVE-2026-21589, a critical unauthenticated file-access flaw in eight self-hosted Atlassian products, to its Known Exploited Vulnerabilities catalog on October 15, 2026, with an October 18 remediation date, ten days after Atlassian's own advisory said it could not confirm whether any self-hosted instances were affected. Here is who is actually affected, what Atlassian has fixed, and what to check now.
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 14, 2026, both with an October 17 remediation date: a critical, unauthenticated file-write flaw in Cisco Secure Email Gateway (CVE-2026-76519) and a code injection flaw in Palo Alto Networks PAN-OS firewalls and Panorama (CVE-2026-0322). Here is who is affected, what each vendor confirmed, and what to check this week.
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 13, 2026, both with an October 16 remediation date: an authentication bypass in Ivanti Connect Secure VPN appliances (CVE-2026-104935) and a Windows Shell flaw that lets crafted files slip past Mark of the Web protections (CVE-2026-96951). Here is who is affected, what attackers have done with the Ivanti flaw, and what to check this week.
Extended Security Updates for Windows Server 2012 and 2012 R2 ended with Microsoft's October 13, 2026 security update, the final one the program provides, and no further year is listed anywhere. That includes the free coverage Microsoft offered to workloads hosted in Azure for the same three years; it ended on the same date, not three years from whenever a workload actually migrated. If your business still has one of these servers in production, confirm it now and start moving off it.
Windows Server 2022 leaves Mainstream Support on October 13, 2026, a little over five years after its release, under Microsoft’s own published lifecycle. Security updates keep coming at no additional cost through October 2031, but Microsoft stops accepting design and feature-change requests and stops shipping non-security fixes. One edition’s hotpatching runs on its own separate timeline worth confirming directly. Here is what moves, what does not, and what to check this week.
Citrix disclosed a separate NetScaler ADC and Gateway vulnerability on October 3, 2026, a memory overflow that can crash the appliance’s SAML authentication service. CISA added it to its Known Exploited Vulnerabilities catalog the next day, October 4, listing an October 7 due date and directing federal agencies to remediate based on each affected asset’s internet exposure under Binding Operational Directive 26-04. It is a different flaw from the NetScaler zero-days Citrix disclosed on September 27, and only applies to a customer-managed appliance on a vulnerable build with SAML authentication configured; Citrix patches its own hosted cloud services. Updated October 11: Citrix’s October 8 bulletin for a further SAML flaw, CVE-2026-107406, moves the builds to target to 14.1-73.46 and 13.1-64.29 (14.1-73.46 FIPS and 13.1-37.283 for FIPS and NDcPP editions), and CISA warned on October 9 that CVE-2026-88779 can help run code planted through the September 27 zero-day.
Cisco disclosed a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that lets an unauthenticated attacker reach the management API with admin privileges, and confirmed its own security team found it being actively exploited. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with an October 3 federal deadline and no vendor workaround.
Citrix disclosed eight NetScaler ADC and Gateway vulnerabilities on September 27, 2026, and confirmed two of them, both allowing remote code execution, were already being exploited as zero-days before a patch existed. CISA added both to its Known Exploited Vulnerabilities catalog the same day, giving federal civilian agencies a September 30 remediation deadline; every organization running NetScaler should treat the timeline as urgent regardless.
Microsoft updated its Copilot Cost Management documentation to confirm that "Auto-apply new services" ships turned on for every spending policy. For organizations using Copilot Credits for Cowork or the Work IQ API, newly supported Copilot services and agents are added to the policy as Microsoft makes them available, unless an admin turns the setting off.
Cisco disclosed a CVSS 10.0 authentication bypass in Identity Services Engine that lets an unauthenticated attacker take over the system that decides which devices and users get on your network. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a three-day federal remediation window.
Updated October 11, 2026: the September 30, 2026 Entra Connect Sync cutoff this article first reported has been replaced. Microsoft now requires version 2.6.84.0 or later and application-based authentication by April 7, 2027, after which synchronization stops on servers that miss either step, and version 2.5.79.0 reaches end of support on October 23, 2026. Here is who is affected and how to check your version.
Cisco disclosed a critical-severity, unauthenticated SQL injection flaw in Secure Email Gateway that lets an attacker gain root access with nothing more than a crafted email. CISA confirmed active exploitation the same day.
CISA added CVE-2026-19490, a critical authentication bypass in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities catalog on September 9, 2026. It is a separate, unrelated flaw from the NetScaler bug we covered in August.
CISA and Cisco confirmed active exploitation of CVE-2026-20079, a CVSS 10.0 bypass in Cisco Secure Firewall Management Center.
Cyber One Solutions joins our Sevier County neighbors and the East Tennessee community in mourning Dolly Parton, who died August 25, 2026, at the age of 80. From our office in Sevierville, we remember her Smoky Mountain roots, her kindness, her music, and the literacy legacy she leaves to children around the world.
Edouard made landfall near Johnson Bayou, Louisiana on September 1 with 60 mph winds, according to the National Weather Service post-storm summary, then moved slowly over Southeast Texas, where parts of Hardin County measured 17 to 25 inches of rain. A full timeline from formation through the National Hurricane Center's final advisory, and what businesses recovering from flooding should check first.
Tropical Storm Bertha tracked along the northern Gulf Coast and dissipated over the Houston area on July 23. A full timeline of NHC advisories from formation through the final advisory, plus what our EOC readiness posture looked like throughout.
Cyber One Solutions was selected as the Business Spotlight in the Bay Area Houston Economic Partnership (BAHEP) 50th Anniversary magazine. After six years as a member, we are honored by the recognition and congratulate BAHEP on a remarkable milestone.
Federal agencies have issued a joint advisory warning that Iranian state-sponsored threat actors are actively targeting water, energy, and healthcare organizations across the United States using a combination of known vulnerabilities and social engineering.
The 2024 Atlantic hurricane season caused significant disruptions across the Gulf Coast. Organizations that had tested their business continuity plans recovered in days. Those that had not faced weeks of downtime and, in several cases, permanent closure.
Anthropic's published responsible scaling policy and model card documentation represent a shift in how AI vendors are approaching enterprise accountability. We break down what matters for IT and security teams evaluating AI tools.
AI-powered voice agents are moving from novelty to production deployments in business phone environments. For organizations evaluating or already using VoIP systems, here is what the transition looks like and what questions to ask.
We have launched a redesigned website that better reflects our current service offerings, team capabilities, and the clients we serve. Here is what is new and what you can expect to find.
Most SMBs know they need cybersecurity but are overwhelmed by the vendor landscape. This is a practical guide to building a defense-in-depth posture that is appropriate for businesses with 10 to 500 employees.
This page collects short, timely posts from our team. You will find security advisories, vendor updates, company news, and practical guidance written for owners and operators, not only IT staff.
Advisory posts cover active threats, patch news, and scams we are seeing in the field. Each post explains the risk in plain language and lists steps you can take today.
We focus on threats that matter for small and midsize businesses in Texas and Tennessee, not every global headline.
Company posts track new locations, staff, partnerships, and service launches. These posts keep current clients in the loop without a separate newsletter.
Filter by category to narrow the feed to the topics you care about. Bookmark the page or follow us on social media to catch posts as they drop. For deeper reading, visit the main blog for long form articles, buying guides, and compliance breakdowns.
How often is the news and advisories page updated?
We post when there is something worth your attention rather than on a fixed schedule. Security advisories go up when an active threat or vulnerability warrants action, and company and service updates are posted as they happen.
Filtering by category is the fastest way to find what is relevant to you.
What is the difference between this page and the blog?
This page is for short, timely posts: security advisories on active threats, vendor updates, and company news. The main blog is for longer articles, buying guides, and detailed compliance breakdowns.
If you want a quick alert, start here; if you want depth on a topic, visit the blog.
Do these advisories apply to my business?
We focus on threats and changes that matter to small and mid-size businesses in Texas and Tennessee, not every global headline. Each advisory explains the risk in plain language and lists steps you can take.
If an advisory affects a service we manage for you, our team reviews it against your environment and contacts you if action is needed.
