Sponsored by
| Ransomware Watch
How SafePay Ransomware Gets In
Cybersecurity Awareness Month wraps up this week, and CISA and the FBI just gave us a timely reminder of why it matters. On October 20 they released a joint #StopRansomware advisory on SafePay, which they call one of the most active ransomware groups of 2026, with at least 600 victims so far.
What stood out to us is how ordinary the way in is. According to the advisory, SafePay gets into networks through:
Stolen or guessed passwords: exposed credentials and brute-force login attempts.
Phishing: phished accounts used to log in through the company VPN.
Unpatched firewalls, VPNs and backup servers: older flaws in Cisco, SonicWall and Veeam products that already have fixes.
Once inside, they take over or create admin accounts, move around with normal Windows admin tools, switch off security software, then encrypt files and demand a crypto ransom. None of it takes anything exotic. It takes one door left open.
| Close Out October
Four Doors to Check This Week
The advisory's recommended actions line up with what we look for in every risk assessment. If you do nothing else before November, do these:
Patch your firewalls, VPNs and other edge devices. Ask your IT provider for the current firmware version on each one, in writing.
Turn on multifactor authentication (MFA) everywhere you can, starting with VPN, remote access, email and admin accounts.
Limit admin rights and tools. Only the people who truly need administrator access should have it.
Protect your backups. Patch the backup server, keep a copy the rest of the network can't reach, and test a restore.
Phishing is still one of the main ways in, so train your people to spot it. We've trained thousands of people, and certificates are included with every course.
| This Week's CVEs from CISA
Each week we pull the CISA alerts and Known Exploited Vulnerabilities (KEV) catalog entries most likely to touch healthcare, energy, trucking and answering-service offices. If you run one of these, patch or apply the vendor's mitigation now. The older ones are on this list because SafePay is using them today.
CVE-2026-109618 and CVE-2026-109619 | PHP (websites built on PHP, including WordPress). Someone with no password can run code on your web server. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. KEV due date: October 29, 2026.
CVE-2026-114625 | Arista VeloCloud Orchestrator (on-premises). A SQL injection flaw lets attackers reach the system that manages your SD-WAN network. Patch or apply the vendor mitigation. KEV due date: October 26, 2026.
CVE-2026-110447 | Collabora Online built-in CODE server (used with Nextcloud). Attackers can run commands on self-hosted Nextcloud file-sharing servers. Patch or apply the vendor mitigation. KEV due date: October 26, 2026.
CVE-2020-3259 and CVE-2023-20269 | Cisco ASA and Firepower Threat Defense firewalls. Named in the SafePay advisory as a way in through the VPN. Patch or apply the vendor mitigation. KEV due dates: March 7, 2024 and October 4, 2023.
CVE-2023-27532 and CVE-2024-40711 | Veeam Backup & Replication. Attackers hit internet-exposed backup servers, the systems you count on to recover. Patch or apply the vendor mitigation. KEV due dates: September 12, 2023 and November 7, 2024.
CVE-2024-40766 | SonicWall SonicOS firewalls. An access control flaw named in the SafePay advisory as a way in. Patch or apply the vendor mitigation. KEV due date: September 30, 2024.
Also added to KEV this week: four Plex Media Server flaws, EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. If anyone runs Plex on a work network, patch it or take it off.
For our energy clients: CISA also published industrial control system advisories for Hitachi Energy MicroSCADA X SYS600, Hitachi Energy RTU500 and Moxa AIG-302. Check with your OT vendor.
Why it matters for HIPAA: your risk analysis should flag known exploited flaws on any system that touches patient data, and your patch management records should show when you closed them.
We Can Help
Not sure which of these you're running, or whether your IT provider has patched them? We'll help you check your firewalls, VPNs and backups against the advisory, get answers in writing from your vendors, and fold it all into your risk analysis. Reply to this email or book a time below.
Thanks for reading, and for building with us.
Rob and Dawn Van Buskirk
Co-founders, VanRein Compliance
Compliance, Elevated.
Find what’s slowing your GTM.
Most GTM problems aren’t one big failure. They’re one or two weak spots quietly dragging down the rest.
The free GTM Audit scores your go-to-market across four dimensions, then sequences a 90-day roadmap for your stage.
Drop your URL. Get your score in about 10 minutes.
