# Am I affected? > Hacked Yet? · Neighbourhood watch for the stuff your business runs on Dozens of security holes are confirmed under attack every month. Most businesses never hear about the ones in their own gear. Hacked Yet? reads the lists so you don't, then tells you in plain English what to fix and by when. Free · Nothing scanned or installed · Report within a business day. [Run my free check](https://hackedyet.com/#check) ## This week in exploited flaws - Confirmed under attack in the last 7 days: 8 - In the last 30 days: 35 - Year this week's oldest flaw was first reported: 2026 On this week's list: Arista VeloCloud Orchestrator, Collabora Online – Built-in CODE Server, EG Secure Solutions SiteGuard Server Edition, Plex Media Server, Siemens Software Center. Source: CISA Known Exploited Vulnerabilities catalogue, to 23 October 2026. ## One email. What to fix, and by when. No jargon and no 40-page report. One thing that matters, what it means for you, what to do, and who to forward it to. ``` HEADS UP · Wed 22 Oct · 7:42am · FIX TODAY Your website needs an emergency PHP update. PHP, the language behind your website and most of the web, shipped emergency fixes this week for two critical flaws (CVE-2026-109618 and CVE-2026-109619). Attackers were using them before the fix came out, and exploitation is now widespread. WHAT IT MEANS FOR YOU A site that hasn't been updated can be taken over: defaced, used to steal customer details, or used as a quiet way into your email. WHAT TO DO · ABOUT 15 MINUTES 1. Forward this to your web host or developer. 2. Ask them to update PHP to this week's patched release. 3. Reply "done" and we'll re-check within the hour. NEIGHBOURHOOD 11 other businesses near you run a PHP site. All of them got this heads up at 7:42am. 3 have already fixed it. Checked yourbusiness.com.au at 7:40am: still on an unpatched PHP version. Next check 5:00pm. [Forward to my web host] [Mark as fixed] [Source: vendor advisory] ``` ## Three steps. No security homework. 01. **Tell us what you run.** Your website, firewall, email, file server and accounting software. It takes about four minutes. Not sure what something is? We'll help you work it out. 02. **We watch the lists you'll never read.** We start with CISA's list of flaws attackers are confirmed to be using. CISA is the US government's cyber security agency. Vendor advisories come next. Only confirmed attacks make the cut, so you hear about what matters and nothing else. 03. **You get a verdict, in plain English.** Every heads up opens with Fix today, Fix this week or All clear. Then what it is, what it means for you, what to do, and who to forward it to. ## Watching together beats watching alone. Each business shares one thing: an anonymised list of what it runs. No names, no domains, no contacts. In return, once enough neighbours join, each heads up shows how many businesses nearby run the same gear, and how many have already fixed it. - **Same gear, same heads up.** When a flaw turns up in something you run, everyone nearby who runs it hears at the same time. Nobody finds out last. - **Local by default.** Counts are grouped by area, like the Tweed or the Gold Coast. If an area is too small, it rolls up into a bigger one, so no business can be picked out. - **Bring your street.** Invite your accountant, your web host, your suppliers. Every business that joins makes the local picture clearer for everyone. ## Built for businesses with no security team. Enterprise security tools are priced and built for security teams. If you're 20 to 200 people with an office manager, a web host and an IT person you call when the printer breaks, this is for you. - **Builders and trades:** The site-office firewall, job management software, Xero and a WordPress site. - **Clinics and allied health:** Practice management software, a patient portal and a file server full of patient records. - **Law and property firms:** Document management, trust accounting and inboxes full of client matters. - **Manufacturers and wholesalers:** The ordering system nobody has updated since 2019, a network drive (NAS) and the VPN box on the wall. ## Open code. Private data. We host it, or you can. - **MIT licence, public code.** Read it, run it, fix it, fork it. Use Claude or another AI assistant? Connect it to hackedyet.com/mcp, our free, read-only link for AI assistants (an MCP server), and ask "am I affected?" yourself. The code goes public on GitHub soon. - **Runs where you want.** Let Flowtivity host it, with your data kept in Cloudflare's Oceania region, or run it yourself from the public code. A ready-to-run self-host package is on the way. - **Nothing installed, nothing scanned.** No software on your machines and no probing of your network. It matches the exploited list against what you tell us you run. The only outside look is at your public website, the same view any visitor gets. ## Find out what needs fixing, and what can wait. Four questions. Within a business day, a person at Flowtivity writes you a one-page report: anything in your gear that's under attack, and what to do first. All clear? It ends with two words: Not today. Run it at https://hackedyet.com/#check. We'll email you about this check. Nothing else unless you tick the box above. No sales call unless you ask for one. ### Want it watched for you? Hand it to us and get back to work. We keep watch, chase your web host or IT person when something needs fixing, and confirm it's done. A person signs off on anything that touches your systems. One fixed monthly price in AUD, quoted on a 20-minute call. ## The short answers. ### Is it safe to tell you what we run? Yes. We only need the names of the products you use. Never passwords, never access to your systems. If we host it, your list sits in a private database in Cloudflare's Oceania region. If you run it yourself, it never leaves your own setup. ### Does it scan or probe our network? No. It reads public lists of exploited flaws and matches them against the gear you tell us about. Nothing is installed and nothing is scanned. The only outside look is at your public website, the same view any visitor's browser gets. ### What does it cost? The free check and the open-source tool cost nothing, forever. The managed service, where we do the watching and chasing for you, is one fixed monthly fee in AUD, quoted up front. ### Will it fix things for us? It tells you what to fix, by when, and who to ask. The managed service goes further: we chase your web host or IT person and confirm the fix, and a person signs off on anything that touches your systems. ### What does the neighbourhood actually share? Only an anonymised list of what each business runs, so a heads up can say how many neighbours are affected and how many have fixed it. Never names, domains or contact details. Counts only appear once enough businesses in an area take part, and you can switch sharing off. ### How is this different from antivirus? Antivirus watches your laptops. This watches what antivirus never sees: your firewall, your website, your file server and the software your business runs on. --- Flowtivity. Make room for better work. An AI consultancy for small and mid-market Australian businesses. aj@flowtivityconsulting.com · flowtivity.ai · Gold Coast and Tweed, Australia Hacked Yet? is open source under the MIT licence. Exploited-vulnerability counts come from the CISA Known Exploited Vulnerabilities catalogue.