THE DALLES — Owners, employees and patrons of the Bargeway Pub & Catering packed The Dalles City Council meeting on April 27, addressing business impacts tied to the ongoing closure of Webber Street, which has significantly halted traffic in the…
Author: Robert Timlick
-
Candidates for Oregon House, Senate speak
THE DALLES — All the candidates for Wasco County positions, from county commission to U.S. Senate, were invited to a forum at The Dalles Senior Center on April 28. Most attended, though three candidates ended up answering the moderator’s questions… -
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including a severe vulnerability that could potentially lead to remote code execution (RCE).
The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of “double free and possible RCE” in the HTTP/2 protocol handling. This issue -
China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions
A sophisticated China-nexus advanced persistent threat (APT) group has been attributed to attacks targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025.
The activity is being tracked by Cisco Talos under the moniker UAT-8302, with post-exploitation involving the deployment of custom-made malware families that have been put -
The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed
Every AI tool, workflow automation, and productivity app your employees connected to Google or Microsoft this year left something behind: a persistent OAuth token with no expiration date, no automatic cleanup, and in most organizations, no one watching it. Your perimeter controls don’t see it. Your MFA doesn’t stop it. And when an attacker gets hold of one, they don’t need a password.
OAuth -
We Scanned 1 Million Exposed AI Services. Here’s How Bad the Security Actually Is
While the software industry has made genuine strides over the past few decades to deliver products securely, the furious pace of AI adoption is putting that progress at risk. Businesses are moving fast to self-host LLM infrastructure, drawn by the promise of AI as a force multiplier and the pressure to deliver more value faster. But speed is coming at the expense of security.
In the wake of the -
“Clean Desk” 2.0: Securing Your Home Office from Physical Data Leaks
In the traditional office, a “Clean Desk” policy was a simple habit: shred the sensitive stuff, lock it away, and don’t leave passwords where someone can see them.
In 2026, the same idea still matters but the “desk” has changed.
For many teams, the home office is now the default workspace, and that means physical access can quickly become digital access. An unlocked screen, a shared device, or a laptop left in the wrong place can expose the same systems your business runs on every day.
Clean Desk 2.0 isn’t about aesthetics. It’s about securing the physical-to-digital bridge.
If a houseguest, a delivery person, or a thief can sit down at your workstation, they don’t need to be a master hacker to cause real damage. They just need a few unattended minutes and an open session.
Why an Unlocked Screen is a Data Breach
Most small business owners treat multi-factor authentication (MFA) as the ultimate front-door lock. And it’s a great lock. The problem is that once you’re already inside, the “front door” isn’t the control that matters.
When you sign into a web app, your browser creates a session token (often stored as a cookie) so you stay logged in without being challenged on every click.
Kaspersky notes that session hijacking is “sometimes called cookie hijacking” because cookies commonly store the session identifier. Proofpoint says session tokens act like digital “keys.” If they’re stolen, attackers can impersonate legitimate users and bypass authentication measures “like MFA”.
That’s why physical access changes the game.
If someone can sit down at your workstation while you’re making a coffee, they don’t need to “crack” anything. They can reuse your already authenticated session and access the same cloud apps, CRM data, and financial tools you were just using, no MFA prompt required.
This is exactly why Clean Desk 2.0 needs an auto-lock culture. Set short screen-lock timers. Lock manually every time you step away. Treat an unlocked session the same way you’d treat a set of master keys left in the door.
Hardware “Legacy Debt” on Your Desk
Most people keep old tech for the same reason: it still works. But “still works” isn’t the same as “still safe”.
The same legacy debt that shows up in server rooms also shows up in home offices and often in the exact places that matter most, like routers, VPN gateways, and the “backup” laptop that hasn’t been updated in months.
The core problem is end-of-support. When a device reaches end-of-support (EOS), security fixes stop arriving.
The UK’s guidance on obsolete products notes, “Ideally, once out of date, technology should not be used,” and “the only fully effective way to mitigate this risk is to stop using the obsolete product.”
In other words, you can’t patch your way out of something that no longer gets patches.
This matters even more for edge devices. These are anything internet-facing that sits between your home network and the rest of the world.
A Clean Desk 2.0 habit is to audit your home-office “edge” the same way you’d audit a server room:
- Identify what’s internet-facing
- Confirm it’s supported and patchable
- Retire anything that isn’t.
Your Digital Employee Needs a Locked Door
As AI features get embedded into everyday tools, workstations aren’t just “where you work” anymore. They’re where automated actions happen.
An AI agent might update your CRM, draft client comms, schedule appointments, or move a workflow forward with minimal input once it’s been kicked off.
That creates a new physical risk because unattended sessions + automation don’t mix.
If an agent is running a process while you’re away from your desk, an unlocked screen turns into an open control panel. Someone doesn’t need to be technical to cause damage.
They just need to click, approve, change a destination account, or interfere with an in-flight task.
The fix isn’t banning automation. It’s treating AI-driven workflows like you’d treat any powerful business system: clear boundaries and clear approvals.
Decide upfront:
- What decisions can the AI agent make without a human present?
- What actions require an explicit approval step?
- What are its spending limits and escalation rules if money is involved?
- Which systems and data are the agents allowed to access, and which are off-limits?
Physical Efficiency and Cloud Waste
A Clean Desk 2.0 mindset isn’t only about security. It’s about operational discipline: knowing what you’re using, why you’re using it, and what should be switched off when it’s not needed.
Cloud waste is the digital version of leaving the lights on in an empty building. It shows up as underused servers, test environments that never power down, and storage that keeps growing because nobody owns the cleanup.
None of it looks dramatic day to day. It just quietly inflates your monthly bill.
The simple habit that fixes it is the same one that keeps a physical workspace under control: visibility and ownership.
Assign each environment and major resource to an owner, review what’s actually being used, and schedule non-production workloads to shut down outside business hours.
These “tidying” routines don’t just cut spending. They reduce clutter, limit exposure, and make your environment easier to manage when something goes wrong.
Building a 2.0 Foundation
Securing your home office from physical data leaks isn’t about paranoia. It’s about professionalism. In 2026, the home workspace isn’t a side setup. It’s part of your business perimeter.
Clean Desk 2.0 is really a set of modern defaults, like locked screens and supported devices. When those basics are consistent, small home-office lapses stop turning into bigger business problems.
Want help turning this into a simple, enforceable baseline for your team? Contact us for a technology consultation.
—
This Article has been Republished with Permission from The Technology Press.
-
ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCallto likely target ethnic Koreans residing in China.
While prior versions of the backdoor have primarily targeted Windows users only, the supply chain attack is assessed to have enabled the -
Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API
A critical security vulnerability in Weaver (Fanwei) E-cology, an enterprise office automation (OA) and collaboration platform, has come under active exploitation in the wild.
The vulnerability (CVE-2026-22679, CVSS score: 9.8) relates to a case of unauthenticated remote code execution affecting Weaver E-cology 10.0 versions prior to 20260312. The issue resides in the “/papi/esearch/data/devops/ -
Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools
An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management (RMM) software as a way to establish persistent remote access to compromised hosts.
The activity, codenamed VENOMOUS#HELPER, has impacted over 80 organizations, most of which are in the U.S., according to Securonix. It shares overlaps with clusters