Patched or Just Assuming? Four Cyber Checks Your Business Should Make Now

Your website is online, the VPN still connects and suppliers say your data is protected. None of those statements proves the underlying security controls work.

This week’s alerts connect four familiar business concerns: websites, remote access, outsourced information and compromised identities. The management task is to replace reassuring assumptions with evidence, named owners and tested response procedures.

1. Your website works. Did its security update install?

WordPress 7.1.4 fixes a weakness in the upgrade process that can allow remote code execution during the upgrade window. Canada’s Cyber Centre confirmed that CISA added the relevant vulnerability to its Known Exploited Vulnerabilities catalogue on 3 November.

That makes this more than routine housekeeping. A website can remain available while an exploitable weakness remains underneath.

• Ask your website owner: Verify the installed version on every production site. Apply 7.1.4 or the applicable patched release for an older branch, checking availability rather than assuming backports have arrived.
• Keep evidence: Record the version, completion time and functional checks. An enabled automatic-update setting is not confirmation of success.

2. You patched the VPN. Was it the latest fix?

Ivanti’s 29 October update addresses two additional flaws in an exploited Connect Secure attack chain. Earlier releases 25.1.1.2 and 22.8R2.5 do not fix those additional vulnerabilities.

Ivanti lists 25.1.1.3 and 22.8R2.6 as resolved versions for the affected branches. Hardware and migration requirements differ, so use the current vendor matrix rather than treating one version number as universal.

• Ask IT: Match each appliance and branch to the current advisory, then plan urgent remediation.
• Investigate separately: Rapid7 recommends checking for compromise after patching. A clean Integrity Checker result does not conclusively exclude intrusion. Preserve relevant evidence and arrange specialist response where needed.

3. Your supplier signed the contract. Who actually accessed the files?

On 4 November, the OAIC reported that three employees of an India-based subcontractor accessed a limited number of Australian court recordings between September 2025 and February 2026. The access occurred outside the courts’ privacy-preserving contractual arrangements.

The OAIC decided further regulatory action was not proportionate in the circumstances, including the provider’s liquidation. That is not a general endorsement of offshore access.

• Ask the supplier owner: Compare approved subcontractors and data-location commitments with actual accounts, permissions and access logs.
• Close the gap: Remove unnecessary access through authorised processes and require approval before access arrangements change.

4. Your alerts fire. How quickly can someone contain the account?

CrowdStrike reports four previously unreported threat actors using AI agents in real intrusions. In one observed case, an agent moved laterally and harvested domain-controller credentials in approximately 20 minutes.

This is vendor research, not a measure of attack prevalence or a universal timetable. It nevertheless raises a practical question: can your response process act before compromised access spreads?

• Test the handover: Run an authorised exercise from an identity alert to account containment. Measure escalation, session revocation and endpoint isolation.
• Assign authority: Establish who can act after hours and what evidence they need. Buying another alerting tool does not resolve an unowned response.

Prioritise internet-facing systems and accounts with access to sensitive information. For each item, request a clear status, supporting evidence and a realistic deadline. Keep patch completion separate from compromise assessment; installing a fix does not establish that earlier unauthorised access never occurred.

How Xpansion can support your next step

Xpansion Technologies can help review website updates, Microsoft 365 and cloud permissions, endpoint protection and incident escalation. Start with the systems your customers and staff depend on, identify the accountable owners and document the next verification action.

For your wider business IT environment, explore Xpansion's managed IT and security services.

References

• Canadian Cyber Centre: WordPress advisory, 3 November 2026
• WordPress: 7.1.4 security release and backport status
• Ivanti: Updated Connect Secure security advisory
• Rapid7: Additional Ivanti flaws and investigation guidance
• OAIC: VIQ Solutions preliminary inquiry findings, 4 November 2026
• CrowdStrike: Agentic AI campaign findings

Sources checked 5 November 2026. WordPress, Ivanti, Rapid7 and CrowdStrike are project or vendor sources, not government guidance. Version matrices and investigations may change. This briefing is general information, not evidence of compromise at any client.