Palo Alto PAN-OS flaw exploited in attacks, a new Cisco Secure Email zero-day and critical Drupal: what to patch today in your Mexico operation

On October 14, Palo Alto Networks warned that a PAN-OS flaw, the operating system on its firewalls, is being exploited in attacks. It is a remote code execution bug: the attacker runs their own commands on your device. According to BleepingComputer, a patch is out.

The same day Cisco patched a new exploited zero-day in Secure Email Gateway. On the 15th, Drupal fixed a critical flaw in its core. If your Mexico plant, warehouse or office runs a Palo Alto firewall, Cisco email filtering, or a Drupal or Nextcloud server, this week is yours.

Palo Alto PAN-OS: “requires login” does not mean “safe”

Palo Alto is the default choice for a lot of foreign companies with plants in Mexico. Typically HQ chose it, a global team manages it, and nobody on site touches it.

This flaw is authenticated: the attacker needs a username and password. That sounds reassuring. It is not, for two reasons we see often:

• Stolen or reused credentials. An admin password unchanged since the rollout, or an account from an integrator who left years ago.
• A management interface reachable from the internet. If it opens from anywhere, anyone can try passwords.

Put those together and a “login required” bug becomes an open door. And it is already being exploited.

Cisco Secure Email Gateway: another zero-day, a different one

A few weeks ago we covered an earlier zero-day on this same appliance. This one is new. Cisco patched it on October 14 and attacks are already happening, according to BleepingComputer.

Secure Email Gateway is the filter that inspects email before it reaches the inbox. Compromise it and the attacker sees mail, attachments and invoices go by. Often the Mexico team does not even know whether their mail flows through a corporate Cisco gateway, so ask.

Drupal and Nextcloud: the website and the file cloud

On October 15 Drupal fixed a critical remote code execution flaw in its core. The tricky part: with certain contributed modules installed, it can be exploited without logging in, according to The Hacker News.

Separately, attackers planted backdoors on Nextcloud servers through a critical flaw in CODE, Collabora’s app for editing documents inside Nextcloud. Local Mexico sites sometimes run their own Nextcloud outside the HQ stack. Find out whether that app is installed and update it.

Product	What it is	What to do today
Palo Alto PAN-OS	Firewall OS	Patch, take management off the internet, rotate passwords
Cisco Secure Email Gateway	Email filter	Patch and review admin logins
Drupal	Website CMS	Update core and review modules
Nextcloud with CODE	Self-hosted file cloud	Update the app and look for odd files

Today’s checklist, in this order

1. Version. Write down what each device runs. Without it you cannot know if you are exposed.
2. Patch. Install the vendor’s fixed release. If the firewall sits in a plant, book a short window and warn production.
3. Management off the internet. Firewall and email filter consoles reachable only from the internal network or VPN.
4. Rotate credentials. Change admin passwords, remove former staff and old vendor accounts, enable MFA where possible.
5. Review logs. Look for admin logins at odd hours or from countries where you do not operate, and config changes nobody requested.

Who does it, and why it cannot wait

In our experience, the firewall at a Mexico site is the device with the least clear owner. HQ assumes the local team patches it; the local team assumes HQ does. Meanwhile, nobody does.

Attacks now follow disclosures very quickly. If HQ is in another time zone, agree today on who applies the patch and who confirms it. The same goes for other perimeter flaws.

Let’s talk

What about your Mexico operation?

Do you know which version your local firewall runs today? If you hesitated, it is worth checking this week.

At ProcessBi we review and patch firewalls, email gateways and hosting as part of the support plan, with a written SLA, on site or remotely, in Spanish or English.

Tell us what you run in Mexico — we reply the same business day.