Emry Networks

Emry Networks delivers managed and custom IT and Cybersecurity Solutions for the New England area.
(1)

11/05/2026

Could a fake IT call open your practice's cloud apps? 🔐

Marathon Health is notifying nearly 5.7 million people after an attacker posed as an IT worker, stole an employee's credentials on August 24th, 2026, and exported data from a cloud app within hours. California notices include Social Security numbers. Texas and Vermont also list medical and insurance details.

Your checklist this week:
✅ Phishing-resistant MFA (hardware keys or passkeys) for anyone who can reach patient data
✅ Scoped cloud roles and short sessions
✅ No shared "IT helpdesk" passwords
✅ Ask who answers a credential-abuse alert at 2 a.m.

Standard IT resets the password in the morning. Defensible IT has a person watching 24x7.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving regulated businesses nationwide

The full brief and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

11/04/2026

Got a Synology NAS in the office? Check it today. 🔐

Ransomware called C3RB3R is encrypting files on Synology NAS devices that run outdated DSM software. Synology posted its warning on October 29th and says the attackers are using a flaw it patched in December 2024. Locked files end in .L0CK3D, and updating afterward does not bring them back.

Your checklist this week:
✅ Update DSM to the latest build for your model and turn on automatic updates
✅ Make sure the DSM login page cannot be reached from the internet
✅ Keep a backup copy the NAS cannot reach or delete
✅ Restore a test file from that copy and write down the date

Standard IT sees a green backup job. Defensible IT proves the restore works.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving regulated businesses nationwide

The full brief and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

11/04/2026

Is your practice website on WordPress? Check it today. 🔐

CISA says attackers are exploiting a WordPress flaw that opens while a site installs an update. It affects every version from 4.7 through 7.1.3, and no login is needed to try it. The fix, WordPress 7.1.4, came out on October 28th. Updates can run overnight, so nobody may be watching when the attack lands.

Your checklist this week:
✅ Block web access to the wp-content/upgrade folder
✅ Confirm every site runs 7.1.4 or the fix for its branch
✅ Look for admin accounts, plugins, and files nobody on your team added
✅ Ask who answers an alert on your website at 2 a.m.

Standard IT queues a ticket for the morning. Defensible IT has a person watching 24x7.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving regulated businesses nationwide

The full brief and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

11/02/2026

Patched your Ivanti VPN in October? Patch it again. 🔐

Attackers chained three Ivanti Connect Secure flaws to take full control of the VPN device. Investigators found they stole domain passwords, searched for admin passwords and BitLocker recovery keys, and deleted log entries to hide. The final fix shipped on October 29.

Your checklist this week:
✅ Upgrade to 25.1.1.3 or 22.8R2.6
✅ Check for signs of compromise as well as the version number
✅ Reset domain, admin, and local passwords if anything looks off
✅ Keep VPN logs somewhere attackers cannot erase them

Standard IT installs the patch and closes the ticket. Defensible IT proves the VPN is clean.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving regulated businesses nationwide

The full brief and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

11/01/2026

Does your HIPAA risk analysis cover every clinic you own? 🏥

A health network just paid $800,000 to settle a HIPAA case after a ransomware attack affected 248,359 people. Regulators cited no accurate risk analysis, no regular audit log review, and late breach notices. The attackers came in through IT tied to a company the network had acquired.

Your Monday 15-minute check:
✅ A date: when was your risk analysis last updated?
✅ A number: how many log reviews were closed last week?
✅ A screenshot: EDR and MFA coverage at every location
✅ Acquired practices included from day one

Standard IT says "we have logs." Defensible IT shows who reviewed them.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving medical groups nationwide

The full brief and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

10/31/2026

Defense suppliers: CMMC Phase 2 is paused, but your NIST 800-171 obligations are not. 🛡️

The Department of War suspended the CMMC Phase 2 third-party certification requirement in July. DFARS 7012 still applies, and your SPRS self-assessment score is still a statement to the government. This year, two contractors agreed to False Claims Act settlements over alleged NIST 800-171 gaps, one for $507,144 and one for $2,042,518. Both resolved allegations only.

Before Monday:
✅ Patch your Cisco ASA and FTD firewalls (CVE-2026-76418 is being exploited)
✅ Re-check your SPRS score against your security plan
✅ Give every open POA&M item an owner and a date
✅ Turn on phishing-resistant MFA for remote access

Standard IT waits to see what happens to CMMC. Defensible IT makes sure the score holds up.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving defense suppliers nationwide

The full brief and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

10/30/2026

Does your software company know which laptops can reach production? 💻

Binance has linked a $6.3 billion theft to one DevOps engineer's compromised laptop. Most of the money moved in about 20 minutes. The same week, CISA flagged an exploited GitLab flaw rated 10.0, and a researcher found 26,400 working keys left in public code.

Quick checks for this week:
✅ Patch any self-hosted GitLab to a fixed version
✅ List everyone who can reach production from a laptop, then cut it down
✅ Scan old commits for keys and revoke them at the provider
✅ Make sure every engineering laptop runs EDR, contractors included

Standard IT says "we have SOC 2." Defensible IT can prove which laptops reach production and who is watching them.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving software companies nationwide

The full breakdown and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

10/29/2026

Law firm owners and office managers: if someone calls tomorrow and says "this is IT," would your team let them in? 👇

CrowdStrike's new 2026 legal report says attacks on the legal sector nearly doubled between 2023 and 2026. One crime group targets U.S. law firms almost exclusively. Its callers pretend to be the IT help desk, open a remote session, and take files within minutes. Another group used a VMware flaw to run commands that never showed up in the logs. CISA added that flaw to its exploited list on October 28.

Quick checks for this week:
✅ Call back any "IT" caller on a number you already have
✅ Block remote access tools your IT provider did not approve
✅ Keep a copy of your logs where an attacker cannot change them
✅ Get an alert any time a new MFA device is added

Standard IT trusts whoever calls. Defensible IT verifies the caller and keeps the proof.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving law firms nationwide

The full breakdown and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

10/29/2026

Does your practice or firm use Microsoft 365? Ask your IT provider one question today: was ConnectWise Cloud Backup, formerly SkyKick, ever connected to our account? 👇

On October 15, attackers used a stolen key for that backup app to sign in to customer Microsoft 365 accounts. Huntress confirmed 162 affected tenants. Because the attacker signed in as an app, MFA never came into play. ConnectWise shut the service down on October 17, so many small businesses have had no new Microsoft 365 backups since.

What to ask for this week:
✅ A list of every outside app that can read your email and files
✅ Proof that no new admin accounts or app passwords were added since October 13
✅ Sign-in logs saved before Microsoft deletes them
✅ Your last good backup date and a second backup until restores return

Standard IT says the vendor is handling it. Defensible IT shows you the proof.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving regulated businesses nationwide

The full breakdown and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

10/27/2026

Does your advisory firm use a website, a client login portal, or an online document upload form? Then this week's PHP2Shell alert applies to your firm. 👇

On October 26, CISA confirmed attackers are actively exploiting two critical PHP flaws (CVSS 9.2) that let them take over unpatched web servers without logging in. PHP powers roughly 70% of websites, including many wealth management sites and the third-party vendors behind them.

Under amended SEC Regulation S-P, your firm is responsible for overseeing those service providers in writing. What to do this week:
✅ Map every website, client portal, and upload tool that touches client data
✅ Ask each vendor in writing which PHP version they run and when they upgraded to a patched release (8.5.12, 8.4.27, 8.3.36, or 8.2.35)
✅ Confirm whether they checked exposed servers for signs of a break-in
✅ File the dated vendor answers in your Regulation S-P oversight records

Standard IT assumes the vendor patched. Defensible IT has the dated written proof ready for an SEC examiner.

Emry Networks | Jacksonville, FL & Manchester, NH | Serving regulated firms nationwide

The full RIA breakdown and the link to book a 30-Minute Risk Assessment are in the first comment. 👇

Address

Manchester, NH

Website

http://emrynetworks.com/

Alerts

Be the first to know and let us send you an email when Emry Networks posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.