[{"data":1,"prerenderedAt":334},["ShallowReactive",2],{"resource-trust-but-verify-what-last-weeks-security-headlines-mean-for-you":3},{"page":4,"related":315},{"id":5,"published":6,"title":7,"slug":8,"subtitle":9,"date":10,"author":11,"tag":16,"thumbnail":20,"hideMenu":22,"sections":23,"guide":314,"video":314,"footerBanner":314,"seo":314},"dM9f_F7tTU2caq4CBSj9-A","2026-10-24T12:53:23-07:00","Trust, But Verify: What Last Week's Security Headlines Mean for You","trust-but-verify-what-last-weeks-security-headlines-mean-for-you","Three major security vulnerabilities in one week reveal why protecting retirement plan data requires vigilance, trusted partnerships, and constant verification.","2026-10-24",{"name":12,"slug":13,"photo":14},"Cameron Sechrist","cameron-sechrist",{"src":15},"https://www.datocms-assets.com/146548/1752878181-dsc00757.png?auto=format&fit=max&h=200&q=85&w=200",{"id":17,"name":18,"slug":19},"earEvNRYSlKQgL9tSNI89g","Blog","blog",{"src":21},"https://www.datocms-assets.com/146548/1792871588-cybersecurity-shield-against-digital-threats.png?auto=format&fit=max&h=600&w=600",false,[24,45,100,149,177,197,240,294],{"id":25,"slug":26,"title":27,"content":28},"buNz1pb4QFm_k0EAmw8U7w","overview","Overview",{"value":29,"blocks":44},{"schema":30,"document":31},"dast",{"type":32,"children":33},"root",[34,40],{"type":35,"children":36},"paragraph",[37],{"type":38,"value":39},"span","In the span of a few days last week, security researchers announced three serious problems in the building blocks that much of the internet runs on. The headlines came with names like \"Node2Shell\" and \"PHP2Shell,\" which don't mean much to most people. They should still get your attention, because they're a reminder of how connected everything online really is.",{"type":35,"children":41},[42],{"type":38,"value":43},"Here's what happened, what we did about it, and what it means for anyone whose information lives online. (That's all of us.)",[],{"id":46,"slug":47,"title":48,"content":49},"CiHd7_MSTwWU1oMQxsDZ5g","what-happened","What Happened",{"value":50,"blocks":99},{"schema":30,"document":51},{"type":32,"children":52},[53,58,62,66],{"type":54,"level":55,"children":56},"heading",2,[57],{"type":38,"value":48},{"type":35,"children":59},[60],{"type":38,"value":61},"Think of a website like a house. When you log in, you only see the front door. Behind it are pipes, wiring, and locks that the owner didn't build. They bought them, installed them, and trusted they'd work.",{"type":35,"children":63},[64],{"type":38,"value":65},"Software is built the same way. Last week, defects turned up in three of those store-bought parts:",{"type":67,"style":68,"children":69},"list","numbered",[70,81,90],{"type":71,"children":72},"listItem",[73],{"type":35,"children":74},[75,79],{"type":38,"marks":76,"value":78},[77],"strong","A faulty unpacking tool (\"Node2Shell\").",{"type":38,"value":80}," Websites often shrink information before sending it, a bit like vacuum-sealing clothes to fit in a suitcase. A flaw in a very common unpacking tool meant a booby-trapped package could break it, and in some cases hand control of the computer to an outsider.",{"type":71,"children":82},[83],{"type":35,"children":84},[85,88],{"type":38,"marks":86,"value":87},[77],"A door that opens if you knock just right (\"PHP2Shell\").",{"type":38,"value":89}," PHP powers millions of websites. Two flaws let an attacker take over a site with a single request. No password needed. Criminals were already using it four days before a fix existed.",{"type":71,"children":91},[92],{"type":35,"children":93},[94,97],{"type":38,"marks":95,"value":96},[77],"A counterfeit ID problem (the eMudhra incident).",{"type":38,"value":98}," The little padlock in your browser means a trusted company has vouched that a website is real, like a notary stamping a document. One of those companies created master keys so weak they could be guessed in seconds. Anyone holding them could have made a convincing fake of almost any website. Chrome, Firefox, and Safari blocked the bad keys within days.",[],{"id":101,"slug":102,"title":103,"content":104},"ajQKufqjR7yo8zuxfUXVBw","our-security-teams-response","Our Security Team's Response",{"value":105,"blocks":148},{"schema":30,"document":106},{"type":32,"children":107},[108,111,115,119],{"type":54,"level":55,"children":109},[110],{"type":38,"value":103},{"type":35,"children":112},[113],{"type":38,"value":114},"As of today, we have found no evidence that any of these issues affect Stax.ai's systems or the outside vendors we rely on. That is our assessment based on everything known right now, and we'll keep testing it as new details come to light.",{"type":35,"children":116},[117],{"type":38,"value":118},"Getting to that answer quickly takes preparation. As soon as each issue went public, our team went to work:",{"type":67,"style":68,"children":120},[121,130,139],{"type":71,"children":122},[123],{"type":35,"children":124},[125,128],{"type":38,"marks":126,"value":127},[77],"Took inventory.",{"type":38,"value":129}," We checked every system we run for the affected parts.",{"type":71,"children":131},[132],{"type":35,"children":133},[134,137],{"type":38,"marks":135,"value":136},[77],"Asked the hard questions.",{"type":38,"value":138}," We contacted the vendors we depend on and reviewed their own assessments.",{"type":71,"children":140},[141],{"type":35,"children":142},[143,146],{"type":38,"marks":144,"value":145},[77],"Kept watching.",{"type":38,"value":147}," In a week like this, the facts change daily. We're monitoring every update and will reach out directly if our assessment changes.",[],{"id":150,"slug":151,"title":152,"content":153},"fY76ae7MQx2at-1jTWSmnQ","security-is-a-team-sport","Security Is a Team Sport",{"value":154,"blocks":176},{"schema":30,"document":155},{"type":32,"children":156},[157,160,164,168,172],{"type":54,"level":55,"children":158},[159],{"type":38,"value":152},{"type":35,"children":161},[162],{"type":38,"value":163},"The biggest advantage we have in a week like this isn't a piece of software. It's relationships.",{"type":35,"children":165},[166],{"type":38,"value":167},"Our Security Operations team works hand in hand with public and private sector partners: government and law enforcement agencies, information-sharing communities, security researchers, and peers across the financial services industry. Think of it as a neighborhood watch for the internet. When someone spots trouble on their street, the whole block hears about it.",{"type":35,"children":169},[170],{"type":38,"value":171},"That matters more than ever. As PHP2Shell showed, the official announcement isn't always the first warning. Our partners share what they're seeing as it happens, often before it makes the news. And it goes both ways. When we learn something useful, we pass it along so the next organization is a little better prepared.",{"type":35,"children":173},[174],{"type":38,"value":175},"For the TPAs and plan sponsors we serve, and the participants who count on them, that network is an extra layer of protection most people will never see. That's exactly how it should be.",[],{"id":178,"slug":179,"title":180,"content":181},"Jrggq8Q2Rb-ryjBvZHNKFA","why-this-matters","Why This Matters",{"value":182,"blocks":196},{"schema":30,"document":183},{"type":32,"children":184},[185,188,192],{"type":54,"level":55,"children":186},[187],{"type":38,"value":180},{"type":35,"children":189},[190],{"type":38,"value":191},"Your retirement plan information passes through a lot of hands: your employer, payroll, your plan administrator, the recordkeeper, and the technology behind each of them. The whole chain is only as strong as its weakest link.",{"type":35,"children":193},[194],{"type":38,"value":195},"That's why checking our own work is only half the job. When something breaks in a part everyone uses, the real question is whether every company in the chain knows if they're exposed. And how fast.",[],{"id":198,"slug":199,"title":200,"content":201},"Rn1oez90T76N9RCvMXP_tw","what-we-learned","What We Learned",{"value":202,"blocks":239},{"schema":30,"document":203},{"type":32,"children":204},[205,209],{"type":54,"level":55,"children":206},[207],{"type":38,"marks":208,"value":200},[77],{"type":67,"style":210,"children":211},"bulleted",[212,221,230],{"type":71,"children":213},[214],{"type":35,"children":215},[216,219],{"type":38,"marks":217,"value":218},[77],"No company is an island.",{"type":38,"value":220}," Almost every problem last week lived in a part someone else built. Knowing exactly what's inside our systems, and our vendors' systems, is what let us answer quickly.",{"type":71,"children":222},[223],{"type":35,"children":224},[225,228],{"type":38,"marks":226,"value":227},[77],"Criminals don't wait for the announcement.",{"type":38,"value":229}," The PHP flaw was being used before a fix existed. Good security works in layers, like a home with locks, an alarm, and a neighbor who keeps an eye out. If one layer fails, the others still hold.",{"type":71,"children":231},[232],{"type":35,"children":233},[234,237],{"type":38,"marks":235,"value":236},[77],"Even the trusted parts need checking.",{"type":38,"value":238}," Most of us never think twice about that padlock. This week showed that even the companies behind it can make mistakes.",[],{"id":241,"slug":242,"title":243,"content":244},"DuVfl7blRXS_ERNdzugUCw","what-you-can-do","What You Can Do",{"value":245,"blocks":293},{"schema":30,"document":246},{"type":32,"children":247},[248,251,255],{"type":54,"level":55,"children":249},[250],{"type":38,"value":243},{"type":35,"children":252},[253],{"type":38,"value":254},"You don't need to be a tech expert to stay safe. A few habits go a long way:",{"type":67,"style":210,"children":256},[257,266,275,284],{"type":71,"children":258},[259],{"type":35,"children":260},[261,264],{"type":38,"marks":262,"value":263},[77],"Keep your devices updated.",{"type":38,"value":265}," Several of last week's fixes reach you through the ordinary updates on your phone, computer, and web browser. Don't hit \"remind me later.\"",{"type":71,"children":267},[268],{"type":35,"children":269},[270,273],{"type":38,"marks":271,"value":272},[77],"Be wary of surprise messages.",{"type":38,"value":274}," Unexpected emails or texts asking you to log in or confirm details deserve a second look, even if they look official.",{"type":71,"children":276},[277],{"type":35,"children":278},[279,282],{"type":38,"marks":280,"value":281},[77],"Go straight to the source.",{"type":38,"value":283}," If something feels off, close the message and type the website's address yourself.",{"type":71,"children":285},[286],{"type":35,"children":287},[288,291],{"type":38,"marks":289,"value":290},[77],"Ask the companies that hold your data how they handle moments like this.",{"type":38,"value":292}," A good one will have a clear answer.",[],{"id":295,"slug":296,"title":297,"content":298},"fRYP7c6DS0ae1XVgO6aDVQ","final-thoughts","Final Thoughts",{"value":299,"blocks":313},{"schema":30,"document":300},{"type":32,"children":301},[302,305,309],{"type":54,"level":55,"children":303},[304],{"type":38,"value":297},{"type":35,"children":306},[307],{"type":38,"value":308},"Being able to answer quickly last week wasn't luck. It's the result of a team that knows what's in our systems, stays shoulder to shoulder with our public and private sector partners, and treats every headline as a chance to double-check.",{"type":35,"children":310},[311],{"type":38,"value":312},"The next problem is already out there somewhere. We'll be ready for it. Security isn't just about technology; it's about people who take it personally.",[],null,[316,325],{"id":317,"published":318,"title":319,"slug":320,"date":321,"hide":22,"tag":322,"thumbnail":323,"guide":314},"IslF6GV8ROiKwGrdo1lCAA","2025-07-04T01:00:00-07:00","Securing America’s Future","securing-america-s-future","2025-07-04",{"id":17,"name":18,"slug":19},{"src":324},"https://www.datocms-assets.com/146548/1754958166-islf6gv8roikwgrdo1lcaa.jpg?auto=format&fit=max&h=600&w=600",{"id":326,"published":327,"title":328,"slug":329,"date":330,"hide":22,"tag":331,"thumbnail":332,"guide":314},"BKwDXf-cSBKf3aZcVETzdQ","2025-03-06T16:37:08-08:00","Crunching Data: 401(k) EBP Audits","crunching-data-401k-ebp-audits","2025-03-03",{"id":17,"name":18,"slug":19},{"src":333},"https://www.datocms-assets.com/146548/1754948334-bkwdxf-csbkf3azcvetzdq.jpg?auto=format&fit=max&h=600&w=600",1792871962073]