Between September 27 and October 16, 2026, federal cyber officials warned about attackers breaking into six different products that sit at the edge of business networks. The list reads like an inventory of a typical office closet: Palo Alto Networks firewalls, Citrix NetScaler gateways, Ivanti Connect Secure VPNs, Cisco email security appliances, BeyondTrust remote support servers, and the Ahsay backup console that many IT providers use to run client backups. Every one of them was being exploited before most owners heard a word about it.
If you run a law firm in Encino, a dental group in Pasadena, or a manufacturer in the San Fernando Valley, you may own one of these products without knowing its name. That is the real problem this month exposed: you cannot patch a box you do not know you have.
Three weeks, six products, one pattern
The run started on September 27, when the Cybersecurity and Infrastructure Security Agency published an alert on two critical Citrix NetScaler zero days that attackers were exploiting worldwide. CISA warned that either flaw on its own could let an attacker run code on the device, and it added a third NetScaler bug to its catalog of exploited vulnerabilities on October 4.
That same week, Ahsay disclosed two flaws in AhsayCBS, the management console for its backup software. Security firm Huntress reported that it saw attackers chaining the two flaws starting October 7, bypassing the login, running code with full system rights, planting web shells, and installing cryptocurrency miners disguised as Microsoft Edge. Huntress notes the console is used mainly by managed service providers and system integrators. On October 12, Ahsay acknowledged that its first patches had not fully closed the hole and released new hotfixes.
On October 13, CISA urged patching of an Ivanti Connect Secure zero day, an authentication bypass that lets an attacker run commands on the VPN without logging in. CISA said threat actors were using it to steal credentials and copy data out.
On October 14, CISA added four more exploited flaws to its catalog: the two Ahsay bugs, a code injection flaw in Palo Alto Networks firewall software, and a path traversal flaw in Cisco Secure Email Gateway. Cisco's advisory rates its bug 9.8 out of 10 and explains that a single crafted email attachment can let an attacker write files and run commands as root on an affected appliance. Cisco also states plainly that no workaround exists.
Two days later, on October 16, CISA warned about BeyondTrust Remote Support, a tool help desks use to take control of employee computers. Attackers were using a critical authentication bypass to get in, stay in, raise their privileges, and move to other machines on the network.
Why attackers keep going after the edge of your network
Each of these products faces the internet by design. A VPN has to accept connections from home offices, a remote support server has to be reachable by technicians, and an email gateway has to receive mail from strangers all day long. That exposure is the whole point of the device, and it is also why criminals study these products so closely.
These appliances also tend to live outside the protection your laptops get. Endpoint security software usually is not running on a firewall or a VPN box, and many small offices never send those devices' logs anywhere. CISA's Citrix guidance warns that local logs may rotate quickly and recommends forwarding them to a log system before evidence disappears. Cisco goes further, cautioning that an attacker with root access may remove or hide evidence on the device itself, so the clues have to be found in network and firewall logs elsewhere.
Breaking into one remote support server or backup console can also open many doors at once, and when that tool belongs to an IT provider, the doors can belong to many client companies.
What was missed: patching is only half the job
Most owners treat a security warning as a simple chore: a patch comes out, someone installs it, done. This month's alerts show why that falls short.
First, a patch does not remove an intruder who arrived before it. CISA's Ivanti alert warns that Ivanti's own integrity checking tool may not detect exploitation, because the attacker's commands run in memory. BeyondTrust and Citrix guidance both tell owners to look for signs of compromise, and to preserve evidence, before or alongside the update. Patching a device that is already compromised can lock the attacker in with you while erasing the trail.
Second, many of these attacks depended on management screens being reachable from the internet. Palo Alto's guidance, as summarized by Help Net Security, is that restricting the firewall's management interface to trusted internal addresses reduces the risk. Huntress gives the same advice for the Ahsay console: allow only trusted addresses or require a VPN. If a login page for your firewall's admin screen can be found from a coffee shop, that is a setting worth changing today.
Third, old versions do not always get fixes. BeyondTrust says customers running versions older than 24.3.1 must upgrade before they can apply the patch. CISA notes that Ivanti Connect Secure 22.8 reaches end of life on January 31, 2027. A device that is one or two versions behind may need a planned upgrade rather than a quick update, and that takes scheduling.
What to do this week
Start with a short inventory. Ask whoever manages your network to list, in writing, every device and service that faces the internet: the firewall, any VPN, the remote support tool, any email security appliance, and the backup console. Get the brand, the model, the software version, and the date it was last updated. If the answer takes more than a day, that tells you something about how your network management is being handled.
Next, compare that list against this month's alerts and against CISA's Known Exploited Vulnerabilities catalog. Anything that matches gets updated first, ahead of routine work on laptops and servers. A steady patch management process should already rank fixes by exposure, and the internet facing devices belong at the top of that queue.
Then close the management doors. Your firewall's admin page, your backup console, and your remote support administration screen should be reachable only from inside your network or through a protected connection. Our guide to secure remote access covers how to give staff and technicians what they need without leaving admin screens exposed.
If any affected product was exposed before it was patched, treat it as possibly compromised. CISA's BeyondTrust guidance is a good model even for other products: isolate the appliance, collect its logs and the logs from your perimeter firewall, look for unfamiliar administrator sessions, rotate every password and key the device stored, end all active sessions, and review recent multifactor enrollments on privileged accounts. That is real incident work, and it goes faster when an incident response plan already names who does what.
Finally, ask your IT provider about their own tools. Two of this month's six products, the Ahsay backup console and BeyondTrust Remote Support, are tools that IT teams use to manage other people's computers. Ask your provider plainly whether they run either one, whether it was patched, and whether they checked it for signs of intrusion. A good provider will answer within the day.
How GlobeVM handles weeks like this
GlobeVM has supported businesses in Los Angeles for 30 years, and right now we look after more than 75 organizations across Southern California. Firewall management, endpoint protection, email filtering, and multifactor authentication are standard in every plan we offer, so the firewall is managed from day one instead of left alone in a closet.
We provide 24/7 monitoring, and when you call, a person in Los Angeles answers in under 15 minutes. Often that person is George or Nazy, the owners. We support clients in English and Farsi. If you want to know whether any device in your office matches this month's alerts, our threat detection service and a short review will tell you.
The simplest first step is a free IT and security assessment. We will list your internet facing devices, check their versions against current alerts, and tell you in plain language what needs attention. You can also call us at (818) 405-9930.
Questions business owners are asking about this month's alerts
Do CISA's deadlines apply to a private business?
Not directly. CISA's deadlines, such as October 17 for the four flaws added on October 14, bind federal civilian agencies. CISA does encourage every organization to prioritize the flaws in its catalog, and the catalog is one of the best free signals a small business has. If a product you own appears there, attackers are already using that flaw.
How do we know if one of our devices was already hit?
You usually cannot tell by looking at the device's own screen. The vendors and CISA recommend reviewing logs from the device and from systems around it, looking for unknown administrator accounts or sessions, unexpected files, gaps in logging, and unusual outbound traffic. If you do not keep those logs anywhere outside the device, that gap is worth fixing even if nothing happened this time.
Our firewall updates itself. Are we covered?
Maybe, maybe not. Automatic updates often cover security signatures but not the operating system of the device itself, and some fixes require moving to a newer major version first. Ask for the exact software version and compare it with the fixed version in the vendor's advisory. Our article on choosing and maintaining a network firewall explains what to ask.
Is a cloud hosted version of these tools safer?
Sometimes. CISA says BeyondTrust had already patched the versions it hosts for customers, and Palo Alto says its Cloud NGFW and Prisma Access services were not affected by its flaw. Cloud hosting moves the patching job to the vendor, which helps a small office. It does not remove the need to protect the accounts that log in to those services.