https://xotavo.com/blog Plain-language notes from XOtavo on AI visibility, owner-side technology advisory, security, and business infrastructure. en-us Sun, 01 Nov 2026 17:30:00 GMT https://xotavo.com/blog/wordpress-7-1-4-upgrade-rce https://xotavo.com/blog/wordpress-7-1-4-upgrade-rce Sun, 01 Nov 2026 17:30:00 GMT WordPress 7.1.4 fixes an upgrade-process flaw that attackers are already trying to exploit. How to confirm your business website is updated and what signs of trouble to look for. https://xotavo.com/blog/binance-6-3-billion-security-incident https://xotavo.com/blog/binance-6-3-billion-security-incident Sun, 01 Nov 2026 15:00:00 GMT On October 29, 2026, about $6.3 billion left Binance hot wallets across about ten blockchains in roughly 20 minutes. What Binance reported, how much is frozen, who investigators name, and the employee-laptop lesson for businesses. https://xotavo.com/blog/ivanti-connect-secure-vpn-exploit-chain https://xotavo.com/blog/ivanti-connect-secure-vpn-exploit-chain Fri, 30 Oct 2026 21:00:00 GMT Attackers are chaining three Ivanti Connect Secure VPN flaws to take over the appliance and steal network passwords. Ivanti's October 29 update (25.1.1.3 or 22.8R2.6) closes the chain. What to check now. https://xotavo.com/blog/synology-nas-ransomware https://xotavo.com/blog/synology-nas-ransomware Fri, 30 Oct 2026 17:00:00 GMT Synology warns that ransomware is hitting NAS devices running outdated DSM software, encrypting files and backups. Who is at risk, the warning signs, and the steps to take this week. https://xotavo.com/blog/cisco-asa-ftd-vpn-dos-zero-day https://xotavo.com/blog/cisco-asa-ftd-vpn-dos-zero-day Thu, 29 Oct 2026 21:00:00 GMT Cisco says attackers are exploiting CVE-2026-76418, an SSL VPN flaw in Secure Firewall ASA and FTD software that can force the firewall to restart. Fixed versions are out. What to check now. https://xotavo.com/blog/php2shell-fragnesia-linux-flaw https://xotavo.com/blog/php2shell-fragnesia-linux-flaw Thu, 29 Oct 2026 17:00:00 GMT Dream Research's October 29, 2026 update named Palo Alto Networks PAN-OS in the PHP2Shell + Fragnesia campaign against internet-facing management interfaces. Who is at risk and what to check this week. https://xotavo.com/blog/node2shell-brotli-flaw https://xotavo.com/blog/node2shell-brotli-flaw Wed, 28 Oct 2026 12:00:00 GMT Node2Shell (CVE-2026-111497) is a critical flaw in the Brotli compression library that can let an attacker run code without logging in. CISA added it to its actively exploited list on October 27, 2026. Who is at risk, what to update, and what to ask your IT provider. https://xotavo.com/blog/fortinet-security-hardening-update https://xotavo.com/blog/fortinet-security-hardening-update Mon, 26 Oct 2026 21:00:00 GMT Fortinet released critical and high-severity fixes for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with details due November 10. Which versions to install and what to do this week. https://xotavo.com/blog/palo-alto-globalprotect-ransomware https://xotavo.com/blog/palo-alto-globalprotect-ransomware Sat, 24 Oct 2026 21:00:00 GMT Palo Alto Networks says ransomware groups are now using CVE-2026-0257, a GlobalProtect VPN flaw that can let an attacker connect without a password or MFA. Fixes have been available since May. What to check this week. https://xotavo.com/blog/nextcloud-built-in-code-flaw https://xotavo.com/blog/nextcloud-built-in-code-flaw Sat, 24 Oct 2026 17:00:00 GMT A critical, actively exploited flaw in Nextcloud's Collabora Online Built-in CODE Server app lets an attacker run commands without logging in. Which versions are affected, who is safe, and what to do this week. https://xotavo.com/blog/nvidia-vera-rubin-cable-free-liquid-cooled-rack https://xotavo.com/blog/nvidia-vera-rubin-cable-free-liquid-cooled-rack Sat, 24 Oct 2026 16:00:00 GMT Nvidia's Vera Rubin NVL72 rack uses cable-free, fanless compute trays and warm-water liquid cooling that Nvidia says lets many sites skip chillers. Figures as of Oct 24, 2026, with a diagram. https://xotavo.com/blog/connectwise-cloud-backup-m365 https://xotavo.com/blog/connectwise-cloud-backup-m365 Fri, 23 Oct 2026 20:30:00 GMT Attackers obtained credentials for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 apps; Microsoft says a China-aligned group used AI tools to try more than 2,250 tenants. Who is affected and what to check in Microsoft 365 this week. https://xotavo.com/blog/safepay-ransomware-advisory https://xotavo.com/blog/safepay-ransomware-advisory Fri, 23 Oct 2026 17:00:00 GMT The FBI, CISA and partners warn that SafePay ransomware has hit at least 600 victims, getting in through stolen passwords, VPNs and known flaws in Cisco firewalls, Veeam backup servers and SonicWall devices, then wiping backups. What to check this week. https://xotavo.com/blog/php2shell-php-flaw https://xotavo.com/blog/php2shell-php-flaw Fri, 23 Oct 2026 12:00:00 GMT PHP2Shell is a pair of critical PHP flaws that let an unauthenticated attacker run code on a web server. Who is at risk, which PHP versions fix it, what to do about PHP 8.1 and older, and what to ask your web host or IT provider. https://xotavo.com/blog/ai-ready-business-infrastructure https://xotavo.com/blog/ai-ready-business-infrastructure Thu, 17 Sep 2026 19:30:00 GMT AI arrived inside tools businesses already pay for. The network, security, identity, and support structure behind it decide whether it creates value or risk, and the steps to take before scaling AI. https://xotavo.com/blog/why-ai-assistants-cant-find-your-business https://xotavo.com/blog/why-ai-assistants-cant-find-your-business Wed, 17 Sep 2026 12:00:00 GMT AI assistants now name a short list of businesses instead of handing back links. Here is why a site that looks perfect to a person can be invisible to the systems doing the recommending, and how to fix it. https://xotavo.com/blog/hidden-costs-in-a-low-voltage-proposal https://xotavo.com/blog/hidden-costs-in-a-low-voltage-proposal Wed, 17 Sep 2026 12:00:00 GMT A cable plant is more permanent than the walls around it, and you only get to price it once. What owners should understand about total cost of ownership, warranties, certification, and design before they sign.