What to look out for today
- Internet-facing firewall/VPN and other network appliances under active attack via flaws affecting web management interfaces.
- Microsoft Entra ID (Azure AD) sign-in changes coming: SMS and voice authentication retirement is approaching, pushing organisations towards phishing-resistant sign-in (e.g., passkeys).
- Breach headlines likely to trigger scam waves ("your account was affected" lures), including a large ISP-related breach.
- Business app risk for HR/finance teams: reports of exploited Oracle PeopleSoft issues (relevant if you or a supplier host or access PeopleSoft).
- Android mobile risk is changing: Google is enabling one-tap installs from approved third-party app stores in some regions, which may affect how you manage staff devices.
Why this matters to smaller businesses
SMEs are often targeted because they rely on a small number of critical systems (Microsoft 365/Entra ID, a single firewall/VPN, and a handful of key suppliers). If a firewall/VPN is compromised, attackers can gain a foothold that leads to ransomware and business disruption. At the same time, identity changes (like retiring SMS/voice MFA) can create last-minute access problems if not planned. Finally, high-profile breach stories frequently drive convincing phishing and phone scams aimed at finance and admin staff.
Warning signs
- Firewall/VPN: unexpected reboots, new admin accounts, configuration changes you didn’t authorise, unusual outbound connections, or remote access being enabled/changed.
- Microsoft sign-ins: users reporting repeated MFA prompts, new device registration prompts they didn’t start, or being told to “re-verify” by email/phone.
- Scam activity: emails/SMS claiming to be from an ISP, Microsoft, or “security team” urging urgent password resets or invoice/payment changes.
- Business systems: unusual login activity to HR/finance portals (including PeopleSoft), new integrations, or unexpected data exports.
- Mobile: employees installing apps from unfamiliar app stores, or “one-tap install” prompts outside your normal app deployment process.
How attackers may exploit the situation
- Compromise an exposed device (firewall/VPN/ADC) via its web management interface, then move laterally into file shares, backups, or cloud admin accounts.
- Use MFA disruption and user confusion (especially around authentication changes) to socially engineer staff into approving sign-ins or handing over verification codes.
- Leverage breach news as a pretext: “We detected suspicious activity on your ISP/Microsoft account—click to secure it,” leading to credential theft.
- Target HR/finance platforms to steal staff data, payroll details, or to enable payment diversion.
What to do today
- Confirm your internet-facing devices are not exposed unnecessarily: ensure admin interfaces for firewall/VPN and similar appliances are not openly reachable from the internet unless there is a clear, documented need.
- Check for unusual changes: review recent admin logins and configuration changes on firewall/VPN and your main cloud tenant (Microsoft 365/Entra ID).
- Prepare for Entra ID MFA changes: identify users still using SMS/voice MFA and plan a controlled move to phishing-resistant options (e.g., passkeys) ahead of February 2027.
- Brief staff (especially finance/admin): today’s likely scam theme is “security alert / breach notice / re-verify your account” plus payment-change requests. Reinforce call-back to known numbers and no credential entry from email links.
- Mobile policy check: if you allow BYOD or unmanaged Android, remind staff to install apps only via your approved method/store and to be wary of third-party app stores.
Ask your IT provider
- Which of our systems are internet-facing (firewall/VPN/admin portals), and which of those have web management exposed?
- Do we have central logging and alerting for firewall/VPN admin logins and configuration changes? Who reviews it, and how often?
- What is our Entra ID MFA transition plan (who is still on SMS/voice, timelines, user comms, and support plan)?
- Do any of our suppliers use or host Oracle PeopleSoft for us (HR/payroll/finance), and what assurance have they given about remediation and monitoring?
- What is our stance on Android app installation (MDM in place, allowed stores, and blocking unknown sources)?
Patch watch - only one short paragraph, and only if relevant
There are reports of active exploitation affecting network infrastructure web management interfaces (“PHP2Shell”) and reported exploitation of Oracle PeopleSoft (patched under a single identifier). For SMEs, the key action is to urgently review any internet-facing appliances and business apps (including those run by suppliers) and confirm your IT provider has a documented process to apply vendor fixes quickly and verify there are no unauthorised configuration changes afterwards.
One action today
Get your IT provider to confirm today whether any firewall/VPN/web admin interfaces are exposed to the internet and to review the last 7 days of admin logins/config changes for anything unexpected.
Related Actions On Cyber resource
Actions On Cyber checklist: Phishing-resistant sign-in (passkeys/MFA) rollout plan for SMEs
Sources
- InfraTrust report warns of exploited flaws in critical network infrastructure (BleepingComputer)
- Microsoft urges Entra ID admins to migrate users to passkeys (BleepingComputer)
- Sony ISP subsidiary data breach exposes 2.5 million customer records (BleepingComputer)
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (The Hacker News)
- Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. (The Hacker News)
- PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.