Good morning, Fargo-Moorhead. Two things on my mind this week: a huge pile of Windows updates, and the software behind a big chunk of the websites you visit every day.

Patch Tuesday was a big one

Tuesday was Patch Tuesday. If you use Microsoft Windows, here is what you should know.

Microsoft released updates fixing more than 1,400 security vulnerabilities across Windows and other products. At least 78 are rated critical, and one Windows Shell zero-day is already being exploited in the wild. A .NET Framework flaw was also publicly disclosed before the fix, but Microsoft says there is no evidence it has been exploited.

That is bigger than September’s nearly 1,000 fixes. Now, 1,400 flaws does not mean 1,400 active attacks. But you should still patch promptly.

Part of what is driving these big numbers is Microsoft using AI to find vulnerabilities. It is a good reminder that there is no such thing as a fully secure Windows PC, or a fully secure computer of any kind. Security is your responsibility.

Use layers of security

This is especially true for Windows, but it applies to every operating system. We all need layers:

  • Firewalls
  • EDR (Endpoint Detection and Response)
  • ITDR (Identity Threat Detection and Response)
  • ISPM (Identity Security Posture Management)
  • Patch management
  • The 3-2-1 backup rule, with one copy offline or immutable and safe from ransomware
  • Inline email scanning, like Proofpoint or Avanan
  • Strong, unique passwords of 32 characters or longer, with strong 2FA. Not email or text message codes.
  • Passkeys wherever you can, and delete the password when possible
  • A password manager. Do not store passwords in your browser, in Excel, or in documents.
  • A healthy dose of doubt. Don’t believe everything you see or hear, and don’t fall for scam pop-ups, emails, phone calls, or texts.

And this one bears repeating. Nobody, and I mean absolutely nobody, from Microsoft, McAfee, Norton, Geek Squad, AVG, Trend Micro, Yahoo, Google, Amazon, the IRS, Apple, Samsung, Facebook, Instagram, or TikTok will call you. If they do, you can be 100% sure it is a scammer.

What to do today

If you have a Windows computer, check Windows Update, install what is waiting, and restart. Businesses should take care of the actively exploited vulnerabilities first.

Now let’s talk about WordPress

WordPress powers roughly 40% of all websites, and about 60% of sites that use a known content management system. It got that big because almost anyone can build a site with very little technical skill. You get drag-and-drop pages plus a huge library of plugins for forms, galleries, SEO, online stores, and just about everything else.

There is a structural problem, though. WordPress is not secure by design, and the plugin model makes that hard to fix. Every plugin runs with the full privileges of the site. And plugins can be made by anyone: legitimate developers, small teams, and also people working for nation states or criminal groups.

Legitimate plugin authors often do thankless work. They spend years building and maintaining tools, sometimes for free or for a small fee, and mostly hear complaints. Meanwhile, buyers, including groups linked to North Korea, Russia, China, and others, have paid significant money to buy popular plugins. One compromised plugin with hundreds of thousands of installs can give an attacker a foothold on that many sites at once. Those sites then become a path to visitors, customer data, or internal networks.

Attackers also like WordPress because the login page is easy to find, and the platform often gives away useful details by default, like the WordPress version and PHP version. Many sites still run old versions of PHP that no longer get security patches.

If your business website runs on WordPress

Find out exactly what you are running, and start planning a longer-term migration path. As automated and AI-assisted attacks get better, the easiest, highest-volume targets get hit first. Right now, WordPress sits at the top of that list for websites.

Not sure what your site is running? Try our free DarkHorse IT domain security scanner. It checks the security of your whole domain, including your email security, and it tells you whether the internet can see which version of WordPress, PHP, or other software your website is running.

Stay informed and stay patched

If you want a second set of eyes on your computers, your backups, or your website, reach out to DarkHorse IT.

We talk through this kind of thing every week. Join us Thursdays at 7:40 AM on KFGO 790 AM.