u/FatBook-Air

I honestly did not know this feature existed until recently, but we have noticed a significant uptick in users complaining about a Chrome feature called "split view." We ran a basic analytics report from our ticket submissions, and this appeared as a complaint that has come up a lot lately.

From what I can see, there is no way to disable this feature. The closest I have seen is configuring "Allow split view drag-and-drop on left or right edge of window" to Disabled.

Has anyone else seen this as a trend from their users?

We have iPad devices supervised by Apple Business Manager and enrolled into Intune as their MDM.

As far as I can tell, we are managing OS updates "the new way" (I believe it's called DDM?). But looking in Intune, I see only one iPad that has gotten an OS update within the past 12 months; the remainder are drastically behind. But they are checking into Intune at least once per week.

I also noticed that the update button is gone in the Settings app, so users (apparently) cannot manually update.

Is there anything I should look for? I am relatively new to managing iPad devices, but I would still assume this is abnormal behavior.

I am completing practice questions based on Security+. I came across this one:

>A security auditor discovers that a company has two firewalls of the same model protecting their internal network. What should the auditor recommend for their security architecture?

>A. Change one of the firewalls to a different platform

>B. Add a firewall of the same model

>C. Only use one firewall

>D. Remove firewalls in front of the internal network

Regardless of what the Security+ says, do you agree that A is the right answer?

I ask because just about every security professional I have ever met would say C is the right answer, so I am just gathering real-world opinions (while apparently still remembering answer A for the Security+ exam.)

We have been doing some testing, and we have noticed that regular, standard, non-privileged users can add local TCP/IP printers through the Windows 11 Settings app. (Disclaimer: I am not talking about printer drivers; I am talking only about adding the printer itself to Windows as a queue.)

When the printer is added, other users on the computer can see it, and those same users can delete it.

I swear, this feels like different behavior from the past. In the past, I thought a locally created TCP/IP printer was a computer-level print queue, which would require administrator rights to add, update, or delete.

So I see two possibilities:

1. It was always like this, but when we moved from on-prem Active Directory/GPO to Entra/Intune, we missed migrating a setting that previously required admin rights to add or delete local TCP/IP printers; OR
2. This is new-ish behavior that we are only now noticing.

I was reading a Huntress blog about the recent PaperCut exploit, and they detected it based on unusual commands like whoami and enumeration of the local administrators group.

I ran a series of "weird" commands in my environment, and I noticed that Defender for Endpoint did not blink an eye. Some were AD information gathering commands. That was a little surprising to me. In fact, I actually thought maybe MDE was broken, so I ran an EICAR test, and it did detect that.

So it seems like MDE does not have built-in detection for a lot of behavioral stuff, so we are now building it. We used to have CrowdStrike, and I don't remember having to build very much.

Are you building your own detections if you have Defender for Endpoint?

Every day, multiple users have one issue or another with the OneDrive sync client.

Today: multiple users (about 15%) are reporting that they cannot open files that are stored only on the cloud. The fix, as per normal, is to restart the client.

But users shouldn't have to expect that to be a fix so often. This shit ought to be written better than this.

Why isn't the OneDrive sync client just written as a robust Windows-level service, anyway? The GUI the user sees ought to be only a window into what the background service is doing. If the GUI client dies, the service should happily chug along and sync files. But then again, Microsoft's employees would probably screw that up, too.

Usually, when we need additional free Google Workspace licenses in our EDU Google tenant, we submit a support ticket to Google, and within about 5 business days, it's approved. They'll usually ask what's changed, etc.

Well, now, they have begun to deny us. At first, I thought it was something specific to us, but it apparently impacts everyone. Here is what they said:

>We understand you are looking to expand your capacity from the current maximum seats. We acknowledge your need for this additional capacity. However, due to internal policies and procedures governing license cap adjustments, the team has now paused processing all new requests for increasing the Fundamentals license cap. This is currently indefinite and has no definitive end date.

>We completely understand the difficult position this puts you in, but because the process for increasing the license cap is currently paused globally, this support team has no ability to process manual increases or grant exceptions.

>Going forward, we encourage you to explore the benefits of our paid Google Workspace for Education editions.

FWIW, there is exactly zero chance that we will be paying for licenses due to budget cuts. Above my pay grade.

I know there have been numerous reported WordPress vulnerabilities recently, and a lot of those are the result of more advanced AI scanning, but I was wondering if those were mostly reported by outside researchers or by internal maintainers?

I like Linux's approach, where kernel maintainers have built their own machines to intelligently rove over the kernel code to (hopefully) find vulnerabilities before attackers do. They are finding hundreds of real Linux vulnerabilities every week, some of which have existed for 20 years. I have wondered if the same is being done by WordPress maintainers.

Since about 2015 or so, I really have not visited McDonald's very much. In the rare cases I have visited, I always used the drive through. I have not actively avoided going inside or anything; for me, I think it may have actually been a remnant of my changed behavior as a result of the pandemic.

Last week, I needed to get something to eat while at work, and I wasn't having a great day, so I thought I would be a little spontaneous by going inside a McDonald's store and just sit and relax for a while, since I had not been in a long time.

Holy fuck, this is the most depressing fastfood store I have ever visited. First, I noticed the kiosks. I had heard about this but had not really seen it myself. There were almost no humans behind the counter. I think if I had went to the counter someone may have come to talk to me, but it otherwise had an empty look to it. I could hear people talking in the back of the store.

There were no other customers in the dining area, so that looked empty, too. There was a single employee in the dining area laying in a booth with their eyes closed, presumably during their break (or maybe they had not started their shift yet).

The table I sat at was nasty as hell. It's obvious that nobody is cleaning it, anymore. I looked around at the other tables, and almost all of them had dried ketchup or Coke stains on them. The floors were sticky and gross, too. I eventually decided to just get up and take the food to my car.

I don't know if this is representative of modern McDonald's stores in general, but just wow. The area where the store is located isn't "in the bad part of town." Back in 2010, this was a decent store. I don't ever remember being blown away by it, but I remember there being actual humans inside it, and it was generally clean. It feels kind of like the state of the U.S. in general.

For wp2shell and major vulnerabilities like this, do the major WordPress hosts like WP Engine do anything to help with these, even before WordPress is updated? Or, does the host not even really matter?

WP Engine scooted us to quickly update, which is fine, but I have wondered if they are doing anything on their backend to pseudo-patch/block the vulnerability until WordPress can be properly updated. My gut feeling is that they are not doing anything -- otherwise, why would they be in such a hurry to get us on the latest version? But maybe I am reading too much between the lines.

This seems like something managed hosts should be doing, if they are not already.

Seems kind of serious?

• https://nvd.nist.gov/vuln/detail/CVE-2026-57807

CVE-2026-57807 is an authentication-bypass vulnerability in the miniOrange OAuth SSO WordPress plugin, affecting all versions through 38.5.8. An unauthenticated remote attacker can exploit an alternate password-recovery path that does not properly enforce authentication, allowing account takeover. It carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction.

The current mitigation seems to be to disable the plugin, unless I am misreading or misunderstanding.

I contacted miniOrange, and they indicated a new version would be released next week (although they did not say the exact words "this vulnerability will be patched in that new version"). But in context, I would take it to mean that the vulnerability will be fixed in next week's version.

For those of us nonprofits who have tiny budgets, few IT staff, and zero dedicated cybersecurity staff, are there any modern tools we can use to look for problems or vulnerabilities with IoT devices, like networked printers, cameras, HVAC systems, etc.?

I'm not thinking of something like Nessus. I'm thinking about more about finding issues that may not be commonly known as part of a big database, especially since we have some very esoteric, crappy hardware on our network.

Ideally, I'd like to give the tool an IP range and let it start fuzzing/checking the entirety of our IoT networks, running it 24/7. But rather than blindly fuzzing, it would be nice if it could pick up on certain signals it gets and then begin concentrating on higher likelihood possibilities based on those signals. In my experience, bruteforce fuzzing is very slow to find anything.

Do these tools exist in any open-source form? Or is this still far away?

In a classroom, I have 3 HDMI cables at the teacher's desk. Ultimately, they need to go to a computer as standard USB video (i.e., recognized as a webcam).

Rather than the going to the computer as 3 cameras, it would be ideal if they were recognized as a single webcam. And it would be best if there was a box on the teacher's desk with 3 big physical buttons: Cam1, Cam2, and Cam3. Each button would control which camera feed is going to the computer.

I also don't want a bunch of other buttons to confuse the teachers.

The cameras are all 4K, and it needs to output to the computer as 4K.

Does such a simple setup exist?

Each of our switchports feeding each U7 Pro XG wireless AP is configured with a trunk port allowing two VLANs: the native wireless-management VLAN and the tagged wireless-clients VLAN.

If a brazen attacker physically disconnected an AP and used the connection for their laptop, MAC filtering would kill the connection assuming the attacker didn't understand MAC spoofing. But I want to assume the attacker did understand MAC spoofing. So, they could get on our wireless-management network.

Is there a way to prevent this? I was thinking about 802.1x, but if I am reading correctly, I think Ubiquiti APs don't support 802.1x in this context? Or is my interpretation wrong?

We are currently on Microsoft 365 E5. We got our new quote yesterday (estimated), and my leadership have decided to migrate to E3.

I don't think anyone is thrilled, but it's the only way to stay somewhat budget neutral.

Disclaimer: part of the issue is that we (my company) are seeing across-the-board increases for *everything*, so while our revenue is actually higher, our costs increases are outpacing it, which means we have fewer real dollars in the coming year. That's putting a squeeze on all purchases.

Anyone else?

I am setting up firewall rules, and I currently have a firewall rule allowing our self-hosted UniFi OS server to initiate connections to our wireless APs. It seems to work fine.

Will there later be situations where UniFi OS itself needs to initiate connections to the wireless APs? I don't mind adding the additional rule, but I don't want to do so unnecessarily.

Where I work, we have a few places where -- for short periods -- temps can get up to 140 degrees or as low as -5 degrees. It usually lasts only 4 or 5 hours a time before returning to about 75 degrees. It can also be very dusty.

I want the power to the network switches to be clean. I am not really concerned about battery backup as I am surging or sagging voltages.

I have tried normal UPS's, but they last only 12 to 18 months.

I also don't have a lot of room. These areas have 19-inch racks, but I have only up to 2U and about 20 inches in depth available. I have some room on the floor below the racks where I could put a tower unit, if I were forced to.

Total peak wattage is only about 120 watts.

Any recommendations?

Disclaimer: I should have read docs *first* and deployed *second*. But I did not.

I have about 60 VLANs/subnets. They're mostly small (/24, /25), and we have that many only to fully segment different device types. The total device count is only about 800. So I need 60 DHCP scopes. We currently have a small Layer 3 switch doing DHCP without any issue, but we are trying to migrate DHCP functionality to the Palo Alto to do some consolidation.

I have migrated 10 so far to the PA-455 without any issue. But I have read in the docs that anything beyond 5 is unsupported.

Am I eventually going to run up against a limit?

We have a website for a nonprofit with about 600 pages, but only about 200 pages are "unique." (Those other 400 pages are template-based so we need to only check one to check them all.)

A professional company gave us a good baseline website with no known issues and was manually checked by accessibility pros, and we have a few in-house staff who have basic accessibility training who will do some basic checks, but we need something to get low-hanging fruit in case staff miss it.

Are there any automated services that will automatically crawl about 200 pages of our website that search for at least the easy WCAG 2.2 AA issues for about $2500 per year?

Back in 2019, we enabled automatic updates for Windows Servers. It has a 14-day deferral, and we update once per week. We have an update ring that automatically updates with a 3-day deferral for test machines and low-risk production machines. To my knowledge, we have run into only one significant issue that was a direct result of OS updates and was not caught in the 3-day deferral ring.

Last year, we deployed automatic updates for Linux servers (most are Rocky Linux and RHEL, and all are minimal installs with no GUI). It updates weekly. It prunes all kernels except the current one plus two older ones.

We do *not* currently auto-update most app software running on top of the OS. (There are a few we do, but we actually *have* been burned here.)

1. Are you automatically updating your server operating systems?

2. Is anyone aware of an official way to defer Linux updates? Is it even worth doing?