FIX256

Using AI to summarize your inbox? Keep its permissions small. Summarizing shouldn't come with the power to send, pay or forward. Any payment change it flags still needs a human check and a call to a number you already have (via @Malwarebytes).

FBI/CISA on SafePay ransomware: it resets network backup drives to factory settings before encrypting. Is one backup copy offsite or offline, out of reach of your network and admin logins? When did you last test a restore?

PHP2Shell: CISA added two PHP flaws to its exploited list Oct 26, and the FBI issued a warning. Many small business websites run on PHP, including WordPress. Ask your web host which PHP version your site runs and confirm in writing that it has the fix.

New phishing trick: emails posing as a state business-filings office, with a "secure document" and an access code. Check the exact domain, and go to the agency's site yourself.

Cisco ASA or Firepower firewall with VPN at your office? A bug that can knock it offline is being exploited right now. Ask whoever manages it to update this week. Same week, WatchGuard Firebox fixes too. Know your firewall's model, its version, and who updates it.

A NY CPA firm's breach letters went out 13 months after the attack, partly because it took that long to learn whose data was taken. Can your firm say where client SSNs live today?

New Outlook for Windows won't open attachments? It's a known Microsoft issue and the fix is still rolling out. For now, use Save as, then open the saved file. Once the fix reaches you, close and reopen Outlook.

Small-office automation wins: intake forms that file themselves, new-hire/leaver checklists that actually remove access, invoice reminders that send themselves. Want one of these in your office? Call FIX256 at 845-210-1677.

WatchGuard Firebox owners: update this week. WatchGuard fixed 17 flaws, several reachable without logging in. Fixed versions: Fireware OS 2026.4 or 12.12.4 (12.5.22 for T15/T35). Not sure what you're running or who manages it? Worth finding out.

Law offices: one extortion group poses as "internal IT" to get remote access, then steals files. 42 of its 50 latest observed victims were law firms (Check Point, via Legal Futures). Rule: no remote access from a surprise call. Call IT back on a known number.

When did your office last test a restore? A backup you've never restored is a guess. Once a quarter: restore one file and one mailbox, and write down how long it took. Want a second set of eyes on your backups? Call FIX256 at 845-210-1677.

"Download ChatGPT" from a search ad may not be ChatGPT. Researchers tied 1,258 malware sandbox analyses since April to fake AI tool campaigns (via The Hacker News, Oct 15). Small-office fix: one short list of approved AI tools, and where to get them.

FBI warning for law firms: scammers pose as your IT support, get staff on a call, and talk them into a remote session. Free fix: agree on how real IT contacts you and proves it, and never give remote access to an unplanned caller.

Attackers got into Microsoft 365 tenants this month without phishing anyone, using a backup vendor's stolen app credentials. Ask your IT provider which apps can get into your M365, what they can do, and which you can remove.

Your domain registrar login might be the most important password in your office. Whoever controls it controls your website and your email. Turn on MFA there today and make sure it isn't tied to a former employee's email.

We're now on Facebook and Instagram too, with the same practical IT and security tips for small offices. Search "Fix256 LLC" on Facebook and "fix256llc" on Instagram to follow along.

Quick office check: when someone leaves, who turns off their email, laptop and shared logins, and how fast? Write it down as a checklist with one owner. Old accounts that stay active are an easy way in.

Small law & CPA offices: start AI automation with the boring stuff. Intake forms that file themselves. Leaver checklists that really remove access. Invoice reminders that send on time. Keep a human sign-off on anything that moves money. Free fit call: link in our bio.

CISA and NSA say patch PHP now. It runs behind WordPress and lots of small-business sites and client portals. One email to your web host today: "Are we on a fixed PHP version?" Get it in writing.

Tax & accounting offices: coming soon (planned Oct 27), the CPA & Tax Firm WISP Kit (FTC Safeguards Rule), $59. A fill-in WISP intended to help address the FTC Safeguards Rule and IRS Pubs 4557 & 5708. Using it doesn't make you compliant. Educational template, not legal advice.