Eng. Alessandro Mazzanti

Windows 10 # Consumer Extended Security Updates (ESU)

Windows 10 Extended Security Updates (ESU) - Summary

Windows 10 reached end of support on October 14, 2025. Devices can continue to operate, but they no longer receive standard security updates unless they are enrolled in the Extended Security Updates (ESU) program. ESU provides Critical and Important security updates, as classified by the Microsoft Security Response Center (MSRC), but does not include new features, general bug fixes, design changes or normal technical support.

https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates

Private / Home users

For private/home users, the Consumer ESU program is available for eligible Windows 10 22H2 devices. Users can enroll at no additional cost by syncing their PC settings, redeem 1,000 Microsoft Rewards points, or make a one-time $30 purchase (or local currency equivalent). A Consumer ESU license can cover up to 10 eligible PCs

Here they are more details

https://www.microsoft.com/en-us/windows/extended-security-updates?r=1

Microsoft currently states that Consumer ESU coverage can continue until October 12, 2027.

Business / Enterprise users

For business and enterprise environments, the Consumer ESU program cannot be used. Devices joined to Active Directory, Microsoft Entra ID, or managed through MDM require the separate Commercial ESU program, which provides organizations with a paid solution to continue receiving Windows 10 security updates while completing their migration to Windows 11.

About this latter case you can review full article, price estimation and taking in consideration that commercial ESU can provide security updates for up to three years after Windows 10 end of support, with the final commercial ESU year ending in October 2028

https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates

https://learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates

[blog written with AI that helped me to speed up article preparation]

Server #ENTRUST 5.47 Pb. #REREGISTRATION AND FIX

Entrust appliance upgrade to 5.47 version fail.

This is due a known issue affecting upgrades to Gateway version 5.47 when RPM dependency version conflicts are present on the appliance. In these situations, the upgrade process may fail because DNF cannot automatically resolve conflicting package versions.

You have to follow the steps mentioned below:

Problem:

Gateway upgrades install the target IDaaS-Gateway meta package, which pins the appliance RPM set to specific package versions. The upgrade script currently executes DNF without the --allowerasing option.

When upgrading an Enterprise Service Gateway to version 5.47, the upgrade can fail if an installed RPM package requires an older dependency version than the target Gateway version.

Sample log entry:

Installed grub2-tools-extra-1:2.06-114.0.1.el9_7 requires grub2-common = 1:2.06-114.0.1.el9_7. The target Gateway meta package requires grub2-common = 1:2.06-114.0.1.el9_7.1.

Cause:

The Gateway upgrade script invokes DNF package installation commands without the --allowerasing option. When existing RPMs require package versions that differ from those required by the target Gateway release, DNF cannot automatically remove or replace conflicting packages and therefore aborts the transaction.

Solution:

The approach to solving the upgrade failure consists of the following three steps.

Step 1: Re-register the Gateway

Login to IDaaS Admin Portal
Navigate to GATEWAYS
Select the Eclipsis (Three vertical dots)
Select Re-Activate, and RE-ACTIVATE again
Copy the generated Registration Code
Login to the ESG Cockpit
Click Re-Activate.
Select Register, leaving options 1,2 and 3 as-is
Paste the copied Registration Code in the respective field.
Click Register.
Wait for the registration to complete.

Step 2: Modify the Upgrade Script

Select Terminal
Navigate to tools directory:

cd /home/entrust/tools

Verify and note the current permissions and ownership of the upgrade script:

ls -la upgrade.sh

Edit the gateway upgrade script:

vi /home/entrust/tools/upgrade.sh

Locate the following line:

if ! dnf install -y "${META_PACKAGE}"; then

Replace it with:

if ! dnf install -y --allowerasing "${META_PACKAGE}"; then

Locate the following line:

if ! dnf install -y "${META_PACKAGE}-${TARGET_GATEWAY_VERSION}"; then

Replace it with:

if ! dnf install -y --allowerasing "${META_PACKAGE}-${TARGET_GATEWAY_VERSION}"; then

Save the file.
Verify that the modifications were saved successfully.
Reconfirm that the permissions and ownership of upgrade.sh remain unchanged from the values recorded earlier:
Optional. If different, reset to default;

sudo chmod 755 upgrade.sh

sudo chown entrust:entrust upgrade.sh

Step 3: Run the Gateway Upgrade Again

Access the IDaaS Admin Portal
Navigate to GATEWAYS
Select the Upgrade icon on the intended gateway
Select UPGRADE

In case you want to view upgrades logs here it is command:

tail -100 /var/log/gateway_upgrade.log

PALO ALTO #EOL PAN-OS-PANORAMA, HW, VM, GLOBAL PROTECT #PALO ALTO CSIRT #COMPATIBILITY MATRIX

Preferred Release Guidance from Support Perspective

-PAN-OS Release Adoption and Preferred Releases for Firewalls and Panorama
-Preferred GlobalProtect Releases
-Preferred User-ID/Terminal Server Agents

https://live.paloaltonetworks.com/t5/customer-resources/pan-os-globalprotect-amp-user-id-preferred-release-guidance-from/ta-p/258304

End-of-Life - pan-os-panorama

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#pan-os-panorama

End-of-Life - Hardware

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates

End-of-Life - VM

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#vm-series-models

End-of-Life - globalprotect

https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#globalprotect

Compatibility Matrix

https://docs.paloaltonetworks.com/compatibility-matrix

🚨 Palo Alto PSIRT

The Palo Alto Networks website allows you to check which CVEs have been published for a specific software release and how many vulnerabilities affect that release.

For example, for version 11.0.13, the CVEs can be sorted by severity as follows:

https://security.paloaltonetworks.com/?version=PAN-OS+11.1.13&sort=-cvss

FIREWALL #How a Super User Creates a New Customer Support Portal User Account

A Super User on an account can create a new CSP (Customer Support Portal) user and add this user as a member to the account.

here it relative very "easy" article

How a Super User Creates a New Customer Support Portal User Acc... - Knowledge Base - Palo Alto Networks

FIREWALL #VM-Series on ESXi Server

It is important to do not create snapshots regarding Palo Alto VM-Series firewall on virtualized environment, here it is relative article and section

"The VM-Series firewall functionality is very similar to the Palo Alto Networks hardware firewalls, but with the following limitations:

Do not use the VMware snapshots functionality on the VM-Series on ESXi. Snapshots can impact performance and result in intermittent and inconsistent packet loss.See the VMware best practice recommendation for using snapshots.
If you need configuration backups, use Panorama, or from the firewall, use Export named configuration snapshot (Device > Set up > Operations). Using Export named configuration snapshot exports the firewall’s active configuration (running-config.xml) and allows you to save it to any network location."

https://docs.paloaltonetworks.com/vm-series/deployment/private-cloud/set-up-a-vm-series-firewall-on-an-esxi-server

HACKER #Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers

Unfortunately this news is a "normal" consequence on how internet (and IT) "work".
It meansto have all devices interconnected between them (not only referring to LANs but meanly when they rely to internet, exposing delicated services or referring to the cloud).

Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers.

Danfoss told AFP that most of the units hit were older products that no longer get software or security updates (the AK-SM 800 and the AK-SC 355).

Danfoss declared the AK-SM 800 end-of-life in May 2021 and phased out the AK-SC 355 in 2016. In an October 2025 newsletter, it said it would end all services for such older products and urged customers to plan replacements.

For the moment the "fix" is to disconnect these devices from lan/Internet. (or other less invasive workarounds, in any case full articles have more technical details there indicated)

These are impacted retailers.

Original article

Here they are some italian articles too

https://www.cybersecurity360.it/nuove-minacce/attacco-ai-supermercati-francesi-la-vulnerabilita-ot-che-mette-a-rischio-la-catena-del-freddo/

https://www.tomshw.it/altro/attacco-informatico-ai-supermercati-europei-gli-hacker-attivano-lo-sbrinamento-e-bloccano-i-frigoriferi