SOLOITPRO
TL;DR: This week in 60 seconds
• Playbook: how I audit a firewall I've inherited, starting with firmware and known exploits.
• Free download: the Firewall Review spreadsheet.
• Radar: PHP2Shell, two critical PHP flaws already under attack, a Palo Alto firewall flaw under active attack, and Windows 11 24H2 Home and Pro are out of updates.
• Quick win: back up your firewall's configuration.
Last week I laid out the 30-day roadmap for the one-person IT department. This week is check number one, and it's the one I do first in any network I've never seen: the firewall.
THIS WEEK’S PLAYBOOK
First Thing I'd Check: The Firewall
The short version, so you can act on it even if you never click:
Firmware and known exploits first. Look up the exact model and version against the vendor's advisories, the CISA Known Exploited Vulnerabilities catalog and Exploit-DB.
If something is actively compromised, gather the facts without changing anything, go to leadership, call the cyber insurer, and isolate the firewall instead of powering it off.
Pull the logs and let an AI tool take a first pass at flagging anything unusual.
Clean up rules safely: log the rule, tell the people affected, change one rule in a set window (the scream test), and wait a week before the next one.
Read the full article and grab the free Firewall Review spreadsheet.
Takeaway: look up your firewall's exact firmware version against the vendor's advisories before you touch a single rule.
I learned the patch-first habit the hard way. I used to be the first one in when the company I worked for acquired a medical practice, and the firmware question told me more about the real risk than anything else I found that day.
RADAR
PHP2Shell: two critical PHP flaws, and attacks have started
On October 21, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 that can let an attacker run code on a web server running PHP without logging in. That covers WordPress sites, hosting control panels and the internal web apps nobody remembers installing. Amazon's honeypots caught an exploit attempt on October 17, four days before the fixes went public. I sent a special edition on this one: read the full PHP2Shell rundown. Source: Rapid7
Takeaway: Find every place PHP runs, patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's update), restart the web server, and email your hosting company to confirm they've patched.
My Take: The website is the easy one. It's the old intranet page or vendor portal nobody has logged into in two years that gets you. Put those at the top of your list.
RADAR
Palo Alto firewall flaw under active attack
On October 14, Palo Alto Networks disclosed CVE-2026-0322, a bug in the PAN-OS management interface that lets an attacker with valid credentials and network access run code as root on PA-Series and VM-Series firewalls and Panorama. Palo Alto says it has seen very limited exploitation and there is no workaround, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three-day deadline for federal agencies. If you inherited a Palo Alto, this is exactly the firmware check from this week's playbook. Source: Palo Alto Networks advisory
Takeaway: Look up your PAN-OS version in the advisory's fixed versions table and upgrade, and make sure the management interface only answers to trusted internal IP addresses.
My Take: If your management page answers from the internet, close that today, before you even schedule the upgrade. The patch needs a maintenance window. Locking down who can reach the login page takes five minutes.
RADAR
Windows 11 24H2 Home and Pro stopped getting updates
As of October 13, Windows 11 version 24H2 Home and Pro editions reached end of updates, so the October 2026 security update was the last one they will get. Microsoft recommends moving them to version 25H2 or 26H2 (24H2 Enterprise and Education are supported until October 12, 2027). Most small offices run Pro, and a laptop that never took the feature update is now an unpatched laptop. Source: Microsoft Windows message center
Takeaway: Run winver on every Pro machine this week and move anything still on 24H2 to 25H2 or 26H2 through Settings > Windows Update.
My Take: Don't assume auto-update took care of it. The machines still on 24H2 are the laptops that never get updates or never get rebooted. Run winver on every PC, not just the ones you see every day.
QUICK WIN
Back up your firewall configuration
Export your firewall's configuration file today, name it with the date, and store it somewhere other than the firewall itself, like a secure share or your IT vault. Config files can hold sensitive settings, so keep it somewhere locked down.
Takeaway: if the firewall dies or a firmware update goes wrong, a config backup turns a day of rebuilding into an hour of restoring.
GEAR & TOOLS
Shodan (free lookups)
A search engine for internet-connected devices. Look up your office's public IP address to see which ports and services the internet can see. If something shows up you didn't expect, that's the next firewall rule to look at. Only look up addresses you're responsible for. shodan.io
This one can be really fun, look online and you can find examples of lots of IOT devices attached to the internet with no authorization at all. I highly recommend spending some time to see if any of your addresses are on there.
Disclosure: no affiliation.
Coming up next week: Part 2, Backups. Has anyone ever actually tested a restore?
Know another one-person IT department? Forward this to them. They can subscribe free at soloitpro.com.
Hit reply and tell me what’s eating your time right now. I read every one.
Talk soon,
~Patrick
