The threats and deadlines that actually affect a small or midsize business — in plain English, with what to do about each. Government advisories straight from CISA (the U.S. government’s cyber-defense agency), the attack stories that matter, and the IT deadlines heading for your calendar. No fear-mongering, no email gate.
Dates when something your business relies on stops working, changes behavior, or becomes an obligation. Every date is verified against the primary source linked on the card — not against someone’s blog post.
Sep 11, 2026outcome pending
CMMC: 60-day review window closed — no outcome published yet
What happens: On July 13, 2026 the Department of War suspended CMMC Phase 2 and ordered a 60-day program review. That window closed on September 11. As of October 5, 2026, the Department has published no review outcome and no new date, and its standing contracting class deviation (2026-O0025, Revision 3, September 3) still directs contracting officers to accept only CMMC self-assessments. What has NOT changed: Phase 1 self-assessment requirements remain in place, DFARS 252.204-7012 still requires NIST SP 800-171, and where a contract carries a CMMC Level 1 or Level 2 (Self) requirement you must still post your self-assessment in SPRS and affirm continuing compliance every year (32 CFR 170.22; DFARS 252.204-7021).
Who it affects: Defense suppliers, machine shops, and subcontractors handling federal contract information or CUI — at any tier.
Do this: Do not stand down. Keep your NIST 800-171 self-assessment and SPRS score current. An affirmation is a legal statement, and the Department of Justice pursues contractors under the False Claims Act over misrepresented cybersecurity compliance, with settlements as recent as September 2026, whether or not a certification deadline is pending. We will update this entry when the Department publishes the outcome.
Windows 10: business Extended Security Updates, Year 1 ended — Year 2 runs to October 12, 2027
What happens: Paid business ESU coverage for Windows 10 is sold in yearly blocks; Year 1 covered updates through October 13, 2026. From October 14, a business PC gets security patches only if Year 2 (October 14, 2026 to October 12, 2027) has been bought and activated for it. Microsoft lists the business price as $61 per device for the first year, doubling each year. Microsoft has extended the separate consumer ESU program to October 12, 2027, but says that program can’t be used in commercial scenarios.
Who it affects: Any business still running Windows 10 PCs, including machines enrolled in ESU as a stopgap.
Do this: Count your remaining Windows 10 PCs. Upgrade or replace what you can, and buy Year 2 business ESU only for machines that genuinely can’t move yet. Don’t rely on the consumer program for business PCs.
Exchange Server 2016/2019: paid Extended Security Updates end
What happens: On-premises Exchange 2016 and 2019 left support on October 14, 2025. Organizations that bought Microsoft’s paid Exchange Extended Security Update program have received security fixes since; Microsoft says there will be no further extension, and no updates of any kind once October 2026 ends.
Who it affects: Any business still running Exchange Server 2016 or 2019 on its own servers.
Do this: Plan the move to Exchange Online or a supported platform now — an unpatched mail server is a favorite ransomware entry point.
Microsoft 365: text-message and voice sign-in codes retired for most users
What happens: Microsoft-provided SMS and voice delivery is retired from the sign-in system behind Microsoft 365 (Entra ID) for all users except Global Administrators and external users, who follow on July 1, 2027. Users in scope whose only second factor is a texted or voice code hit a blocking passkey-registration prompt — in Microsoft’s words, there is no opt-out from it for users in scope of the February 1 retirement. Organizations with a business, regulatory or operational need for texted codes can configure their own telephony provider through the Microsoft Security Store from October 30, 2026, paying the provider’s message charges plus a small Azure charge — details in our guide.
Who it affects: Any Microsoft 365 organization with users still relying on text-message or voice codes — every industry, every size.
Do this: Finish moving every user to a passkey, Windows Hello, or a security key before this date. Check whether your password-reset process also depends on text messages — the retirement covers that too.
Microsoft 365: text and voice sign-in codes retired for Global Administrators and external users
What happens: When Microsoft narrowed the February 1, 2027 retirement in September 2026, it moved two groups to a later date. From July 1, 2027, Microsoft-provided SMS and voice codes also stop for Global Administrators (the top-level admin accounts) and external users.
Who it affects: Any Microsoft 365 organization whose admin accounts or external users still rely on text-message or voice codes.
Do this: Don’t wait for July: move admin accounts to a passkey, Windows Hello or a security key on the same schedule as everyone else.
Deadlines already passed — still biting the businesses that missed them
Sep 1, 2026passed
Microsoft 365: passkeys became the default sign-in
Users still enabled for text-message or voice codes were automatically enabled for passkeys and now see registration prompts at sign-in. The prompts can be snoozed — for now.
If that’s you: Inventory who still signs in with a texted or voice code and move each group to a passkey method before February 1, 2027, when those codes stop working for most users.
Exchange Server 2016/2019 and Office 2016/2019 end of support
Perpetual Office 2016/2019 left support on October 14, 2025 — no more security fixes. On-premises Exchange 2016/2019 left support the same day; organizations that bought Microsoft’s paid Exchange Extended Security Update program have received security fixes through October 2026, and Microsoft says there will be no updates of any kind after October 2026.
If that’s you: Unsupported mail servers are a favorite ransomware entry point — migrate to Exchange Online or a supported platform.
The stories below are curated and written by us — each with the part most reporting skips: what it means for a business your size, and what to do. The live list underneath comes straight from CISA.
Act nowOct 30, 2026
WordPress 7.1.4 fixes a no-login code-execution flaw in core updates, and Wordfence sees attackers trying it — confirm every site updated
On October 28, 2026, WordPress released version 7.1.4, a security release whose documentation counts 22 vulnerabilities. Among them is what WordPress describes as a race condition during core updates that could lead to remote code execution, reported by Umut Bayram. WordPress also released the fixes for older branches, from 7.0.8 and 6.9.11 back to 4.7.39, says only the most recent version is actively supported, and says WordPress 4.6 and earlier no longer receive security updates. WordPress recommends updating sites immediately.
On October 29, security firm Wordfence published an analysis rating the flaw 8.1 (High) and listing WordPress 4.7 through 7.1.3 as affected. Wordfence explains that when an affected site installs a full core update, it unpacks the complete WordPress package, installer included, into a temporary folder under wp-content/upgrade whose location can be predicted, and that an attacker with no account who reaches that installer during the brief window can end up running PHP code. Wordfence rates the attack complexity high, noting that in its lab tests the temporary folder usually existed for only seconds.
Wordfence says its telemetry shows threat actors “already actively attempting to exploit the vulnerability.” It reports a first hit on its new firewall rule nine minutes after deploying it, more than 18,500 requests aimed at staged setup-config.php installer paths over the first 21 hours, and two of the largest sources repeatedly polling small groups of sites for about 14.5 hours. It says not every request used the exact vulnerable path. Wordfence does not report a confirmed successful compromise, and WordPress’s release notes do not mention exploitation.
What it means for you: If your website runs on WordPress, this one is about the update process itself. Wordfence says most sites should get the fix through automatic background updates, and that two sources polled sites for about 14.5 hours in a pattern consistent with trying to catch the few seconds while a full update unpacks. The flaw needs no login, and success means an attacker running code on the server that hosts your site.
This week, have whoever manages your website log in to each WordPress site, go to Dashboard, then Updates, and confirm it shows 7.1.4 or the security release for its branch, such as 7.0.8 or 6.9.11. Wordfence says not to assume the automatic update completed. A site on WordPress 4.6 or earlier gets no fixes at all and needs a real upgrade project, not a patch.
If any site sat on an affected version after October 28, ask your web provider to check it the way Wordfence suggests: unexpected requests to PHP files beneath wp-content/upgrade, unfamiliar administrator accounts, plugins nobody installed, and PHP files nobody placed there. If you rely on a web application firewall, ask whether it inspects requests sent straight to PHP files, because Wordfence says this attack calls a staged PHP file without loading WordPress first. Treat any firewall rule as a stopgap until the update is confirmed, not a replacement for it.
Ivanti fixes the other two flaws chained in the Connect Secure VPN attacks — 25.1.1.2 and 22.8R2.5 are no longer enough, upgrade again
On October 29, 2026, Ivanti updated its Connect Secure (ICS) security advisory, first published October 13 for CVE-2026-104935, to add two more vulnerabilities and their fixes. Ivanti describes CVE-2026-111357, rated 8.8 (High), as missing authentication for a critical function that allows a local authenticated attacker to escalate their privileges, and CVE-2026-118527, rated 4.3 (Medium), as use of predictable filenames that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Ivanti says it is “aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained.”
Ivanti lists ICS 25.1.1.2 and prior and 22.8R2.5 and prior as affected by the two new flaws, with 25.1.1.3 and 22.8R2.6 as the resolved versions. Both 25.1.1.2 and 22.8R2.5 are also listed in the advisory as resolving CVE-2026-104935. Ivanti says 25.1.1.3 and 22.8R2.6 each resolve all vulnerabilities in this disclosure, that 25.1.3.0 (released July 2026, running on ISA4500, ISA6500 or ISA8500) or later does not contain this vulnerability, and that versions 22.7.X and lower do not contain it. It recommends 22.8 customers update to 25.1.1.3 or later, and says 22.7 and 22.8 both reach end of life on January 31, 2027.
Ivanti says that once the privilege-escalation flaw was discovered, it chose not to delay the CVE-2026-104935 fix, which “resolved the primary exploitation path,” and that a fix is now available for all vulnerabilities which were chained and exploited in the wild. CISA’s Known Exploited Vulnerabilities catalog lists CVE-2026-104935; as of its October 29 release it does not list the two new CVEs.
What it means for you: If your business, or the provider that runs your remote access, upgraded an Ivanti Connect Secure VPN in mid-October, check which version it landed on. Ivanti now says the attacks chained three flaws, and 25.1.1.2 and 22.8R2.5, two of the versions that closed the first one, are still exposed to the other two. The two new flaws need a login, but Ivanti says attackers chained them with the first, which needs none.
This week, have whoever runs the VPN confirm in writing that every appliance is on 25.1.1.3, 22.8R2.6, or 25.1.3.0 or later. If you are on 22.8, Ivanti recommends going to 25.1.1.3 or later, and 22.7 and 22.8 both reach end of life on January 31, 2027, so this is the moment to finish the move to 25.1. Remember that 25.1.3.0 needs the newer ISA4500, ISA6500 or ISA8500 platform or a rebuilt virtual appliance.
The compromise check still matters. Ivanti says indicators of compromise are limited and points to Volexity’s indicators and its own Integrity Checker Tool, which Volexity says does not detect this exploit chain. Volexity also says the attackers deleted evidence from the appliance’s logs, so if the VPN ran an affected version at any point since October 3, when Volexity says the attacks it investigated began, have network traffic checked against Volexity’s indicators and bring in forensic help if anything looks off. If you find a compromise, follow Ivanti’s recovery steps. Because Volexity found the attackers took the domain credentials stored on the VPN and searched Active Directory for LAPS local administrator passwords and BitLocker recovery keys, rotate those too.
Drupal says attackers are exploiting a Commerce Core flaw in online stores — update to 3.3.13 or 8.x-2.41 and audit recent orders
On October 28, 2026, the Drupal Security Team published advisory SA-CONTRIB-2026-254 for CVE-2026-118539, an access bypass flaw in Commerce Core, the module that lets Drupal sites sell goods and services through a shopping cart and checkout form, or through APIs for separate storefronts. Drupal rates it Highly critical, 21 on its 25-point risk scale, and says the module does not sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The advisory states that the vulnerability is being actively exploited in the wild. It does not describe the attacks or say when they began.
The advisory lists the affected versions as below 2.41, and 3.0.0 up to but not including 3.3.13. The fixes are Commerce Core 3.3.13 for sites on the 3.x branch and 8.x-2.41 for earlier versions, both released October 28. Both releases also fix five other Commerce Core advisories, SA-CONTRIB-2026-255 through SA-CONTRIB-2026-259, rated Moderately critical or Less critical. Drupal tells sites to audit their orders for inconsistencies. As of CISA’s October 29 catalog release, CVE-2026-118539 is not in the Known Exploited Vulnerabilities catalog.
What it means for you: This story is for any business or nonprofit that sells goods or services through a Drupal website. A site can run Commerce Core without anyone calling it that, so if you are not sure, ask whoever built or hosts the site whether it uses Drupal Commerce and which version.
Three things to do this week. First, have your web developer update Commerce Core to 3.3.13, or to 8.x-2.41 on the older branch, and confirm the installed version in writing. Second, do what Drupal itself says and audit your orders. Our advice is to compare recent store orders against what your payment processor actually received, and look for orders whose totals, prices, discounts, status or customer details do not match. Go back further than this week, because Drupal has not said when the attacks began. Third, if anything does not add up, hold fulfillment on those orders, keep the web server and store logs, and have the site reviewed before treating the update as the end of it.
Drupal’s own wording points at money rather than a defaced website: it warns of financial impact to the store owner and asks for an order audit. The advisory does not say attackers can run code on the server. That makes this a quieter problem to spot, which is why the order check matters as much as the update.
CISA now lists GitLab’s CVSS 10.0 CI/CD flaw as exploited — upgrade self-managed GitLab servers and check them for compromise
On October 29, 2026, CISA added CVE-2026-97229, a flaw in GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities catalog, with a remediation due date of November 1 for federal agencies. CISA describes it as an integer overflow that could let an unauthenticated user run arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, and notes that other products can potentially be affected by the same underlying Ruby/Onigmo issue. CISA does not say who is exploiting it. When we reported GitLab’s fix on October 12, the flaw was not in the catalog.
GitLab fixed it on October 12, 2026 in versions 19.4.2, 19.3.5 and 19.2.8 and rates it Critical, with a CVSS score of 10.0. It lists the affected versions as all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, says GitLab.com is already running the patched version and that GitLab Dedicated tenants were patched before the release was published, and lists threat detections self-managed customers can use to spot exploitation attempts. On October 21, GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for a second CVSS 10.0 regular expression flaw, CVE-2026-110264, which affects all versions from 7.0 and is not in CISA’s catalog as of its October 29 release.
On October 23, the Ruby project said Ruby 4.0.9, 3.4.12 and 3.3.13 contain the regular expression fixes behind four GitLab CVEs, including these two, and recommended upgrading to those versions or later.
What it means for you: This turns our October 12 GitLab story from a patch into an attack. If your company uses GitLab.com or GitLab Dedicated, GitLab says those are already patched, so there is nothing for you to do. If you run GitLab on your own server, as engineering firms, manufacturers and defense suppliers often do for source code and technical data, treat any server that ran 19.2, 19.3 or 19.4 below the fixed versions at any point as possibly compromised until someone has checked, especially if it can be reached from the internet. CISA has not said when the attacks began.
This week, have whoever runs it do four things and confirm them in writing. First, list every self-managed GitLab server, including test and forgotten ones, and its version. Second, move each one to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, or later, which also covers the October 21 flaw, and book an outage window for single-node servers, since GitLab says they are down while the database migrations run. Third, run the threat detections GitLab lists for this flaw, and look for administrator accounts, access tokens, runners and CI/CD changes nobody on your team made. Fourth, if the server was built from source or from a Linux distribution’s package rather than GitLab’s own installer, ask whether its Ruby is 4.0.9, 3.4.12 or 3.3.13 or later, since the Ruby project says those releases carry the underlying fixes.
In our view, if a server was reachable from the internet and ran an affected version, also rotate the passwords, tokens and keys stored in its CI/CD settings, because those usually reach other systems. If it cannot be upgraded today, limit who can reach it to your office network or VPN until it is; that is our stopgap, not a GitLab mitigation.
Palo Alto now says attackers are exploiting the PHP flaws through PAN-OS management pages exposed to the internet
Palo Alto Networks’ advisory for the two critical PHP flaws in PAN-OS, CVE-2026-109618 and CVE-2026-109619, now says: “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” The advisory now rates the issue 9.2, Critical, for PAN-OS, with a suggested urgency of Highest, and its timeline records that change on October 27. When we first reported the advisory on October 24, Palo Alto said it knew of no malicious attacks against its products. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26.
The flaws affect the PAN-OS management web interface, meaning the HTTPS web UI and the XML API, on PA-Series and VM-Series firewalls and on Panorama, plus any data interface with a management profile attached. Palo Alto says the GlobalProtect portal, gateway and Clientless VPN are not affected. Palo Alto’s October 28 and 29 updates list the last six hotfixes as released, so all 20 are now out, including 10.2.18-h13, 11.1.16-h4, 11.2.16-h1, 12.1.10-h3 and 12.2.4-h1. Palo Alto says unsupported PAN-OS versions should be upgraded to a supported fixed version, and that restricting the management interface to trusted internal IP addresses minimizes the risk.
What it means for you: This moves the PAN-OS story from exposure to attack. If your firewall is a Palo Alto and its management page could be reached from the internet at any point since October 21, treat it as possibly compromised until someone has checked, not just as unpatched. Palo Alto has not said how many devices were attacked or when the attacks began.
Today, have whoever manages the firewall do three things and confirm them in writing. First, close the management interface to the internet: only trusted internal addresses or a jump box, and no management profile on any internet-facing interface, including the one that carries GlobalProtect. Second, install the hotfix for your build. Palo Alto’s October 29 update lists every one as released, and its solution table names the target for each build, such as 12.1.4-h13 or 12.1.10-h3. Third, if the page was reachable, review administrator logins, new administrator accounts and configuration changes since October 21 for anything your provider did not do.
In our view, if a firewall was exposed, also change the passwords of any directory service accounts it uses to read user and group information, and do not count on Threat Prevention signatures alone, since Palo Alto lists extra setup they need to work, including decrypting management traffic. If your provider cannot confirm these steps today, bring in incident response.
CISA lists a Linux kernel flaw as exploited after researchers say it was chained with the PHP flaws to take root on firewalls
On October 28, 2026, CISA added CVE-2026-46300, a Linux kernel flaw, to its Known Exploited Vulnerabilities catalog, with a remediation due date of October 31 for federal agencies. CISA describes it as a missing-initialization flaw that could allow unintended modification of page-cache-backed data, and says it can be chained with the PHP flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. The CVE record, first published May 23, 2026, lists the flaw as fixed in Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and in 7.1.
The Israeli security firm Dream reported on October 26 that an attacker it suspects is China-linked used the PHP flaws on the management web server of internet-facing firewalls, then this kernel flaw, which Dream calls Fragnesia, to become root. Dream counts 24 rooted firewalls, most in an automated batch run, in the US, Japan, Taiwan and South Korea, plus an internal firewall management server reached through a tunnel. Dream says it is not disclosing the firewall vendor or the affected versions and has notified the vendor. It reports that the attacker then decrypted an LDAP service account password and listed Active Directory users and groups, and that attempts at a password spray, backdoor accounts and SAML key theft had unknown results.
What it means for you: Two kinds of systems need attention. The first is any firewall, VPN or appliance whose management page is reachable from the internet. Dream does not name the vendor, so we cannot tell you whether yours is the one, but every rooted firewall started with a management page exposed to the internet. Have your IT provider confirm in writing that no management page in your office is reachable from the internet, and ask each appliance vendor whether its product uses PHP and whether it is fixed for the PHP flaws and CVE-2026-46300. Separately from Dream’s report, Palo Alto says attackers are exploiting the PHP flaws on PAN-OS management pages; see our story from today.
The second is Linux servers you run yourself, such as a web server or virtual private server hosting a PHP site or client portal. The kernel fix has been out since May, so the gap is usually a server that installs updates but never reboots, or one that has not been updated at all. Ask for each server’s running kernel version and its last reboot date, install your distribution’s kernel update and reboot. If your site is on shared hosting, ask the host when its servers took the fix.
Because Dream says the attacker went after Active Directory next, ask whether any firewall or appliance holds a directory service account. In our view, if that device was exposed, change that password and check for user or computer accounts nobody created.
Unit 42 says attackers are exploiting a YOOtheme Pro flaw to plant web shells on websites — update YOOtheme Pro to 5.0.53, then check the uploads folder
On October 26, 2026, Palo Alto Networks’ Unit 42 threat intelligence team reported in-the-wild exploitation of CVE-2026-102785 in YOOtheme Pro, a paid page builder that its maker describes as a website builder for WordPress and Joomla. The CVE record, published October 22 by Joomla’s CVE numbering authority, lists the YOOtheme Pro extension for Joomla, versions 5.0.0 through 5.0.52, as affected and rates the flaw 10.0, Critical, under CVSS version 4. It describes a publicly reachable image-processing handler that an attacker with no login can abuse, by reusing the signature from an image link already published on the site, to write a file that runs as code into a public media folder. YOOtheme’s changelog lists the fix in YOOtheme Pro 5.0.53, dated October 21, and lists no later version.
Unit 42 says the attacks it observed were automated and that the first web shell was written two days after the fix was released. It reports that a scanner wrote image files carrying hidden PHP code into a WordPress site’s uploads folder, named yt followed by seven hexadecimal characters and .php, and that about two minutes later a person uploaded a second web shell, with a helper kit in a folder named ALFA_DATA. Unit 42 lists 168.144.251.199 as the address used for the exploitation. As of CISA’s October 27 catalog release, CVE-2026-102785 is not in its Known Exploited Vulnerabilities catalog.
What it means for you: YOOtheme markets its builder to agencies, freelancers and developers who make sites for clients, so a business can be running it without knowing the name. A web shell is a back door: whoever has it can run commands on the web server, read the site’s database password and change the pages customers see. Unit 42 says the exploitation was automated and used generic tooling, which suggests sites are being found by scanning rather than chosen. In the case it describes, a person followed up within minutes.
Three things to do this week. First, ask whoever built or maintains your website whether it uses YOOtheme Pro, on WordPress or Joomla, and get the version in writing; anything 5.0.0 through 5.0.52 needs 5.0.53 or later. It is a paid product, so have them confirm the update installed rather than assume it came with the others.
Second, have them look in wp-content/uploads for .php files, especially names starting with yt, and for a folder named ALFA_DATA, and search the web server logs for 168.144.251.199 and for requests containing yootheme= together with FromFile=php://input or Save=, since Unit 42 says the person who followed up used other addresses. On a Joomla site, our advice is to look for .php files in the public image and media folders, where none belong. Third, if anything turns up, treat the site as compromised: restore it from a backup made before the first planted file appeared, or have it cleaned, update YOOtheme Pro to 5.0.53 again before the site goes back online, then change the database, hosting, FTP and admin passwords.
If a web designer rather than an IT provider looks after your site, this is the kind of update that slips. Attacks began two days after YOOtheme released the fix, and Unit 42 says proof-of-concept exploit code was available by then.
CISA lists the Brotli decompression flaw as exploited — update Node.js and .NET apps, and check whether Palo Alto firewalls inspect Brotli traffic
On October 27, 2026, CISA added CVE-2026-111497, a flaw in Google’s Brotli compression library, to its Known Exploited Vulnerabilities catalog, with a remediation due date of November 10 for federal agencies. CISA describes it as an unchecked return value flaw that lets a remote, unauthenticated attacker use a crafted Brotli-compressed stream to corrupt decoder memory, disclose memory contents, cause a denial of service or potentially run code, and notes other products can include it. Google’s Brotli 1.2.1 release of October 21 fixes it. CISA does not say which product attackers targeted.
Node.js said on October 21 that the flaw affects its 22.x, 24.x and 26.x lines when an application decompresses attacker-supplied Brotli data with node:zlib, and fixed it in 22.23.4, 24.22.1 and 26.12.1; it adds that end-of-life versions are always affected when a security release occurs. Microsoft’s October 25 out-of-band update fixes it in .NET 8.0.33, 9.0.22 and 10.0.14. Microsoft says apps may be affected if they process Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression or the Brotli APIs, that the first two are off by default, and that .NET Framework is not affected. PHP’s rebuilt Windows packages of October 26 include Brotli 1.2.1.
Palo Alto’s advisory, updated October 28, says PAN-OS 11.2, 12.1 and 12.2 firewalls are exposed only when Brotli inspection and TLS decryption are both in use, that Brotli encoding is disabled by default in PAN-OS 11.2.4 and later and that PAN-OS 10.2 and 11.1 and the management interface are not affected. Its October 28 update lists all nine hotfixes as released, including 11.2.10-h17, 11.2.16-h1 and 12.1.10-h3, and it says it is not aware of malicious exploitation of the Brotli flaw.
What it means for you: Brotli is a compression format, so this flaw lives inside other software rather than in one product you can point to. The risk sits in software that unpacks Brotli data it should not trust: a web application that accepts compressed requests, or one that fetches and decompresses content from elsewhere. CISA now lists it as exploited, and in our view that moves it from routine patching to this week.
First, ask whoever built or hosts your website, client portal or in-house apps whether any of it runs on Node.js or .NET, and get the versions in writing. Node.js should be on 22.23.4, 24.22.1 or 26.12.1 or later; a site on any other release line needs to move to one of those, because Node.js does not fix end-of-life versions. .NET apps should be on 8.0.33, 9.0.22 or 10.0.14, and Microsoft notes that self-contained apps and containers must be rebuilt with the new runtime, not just have the server updated. Microsoft has also said .NET 8 and 9 reach end of support on November 10, 2026, so plan the move to version 10 of .NET at the same time.
Second, if your firewall is a Palo Alto on PAN-OS 11.2 or later, have whoever manages it run Palo Alto’s check for Brotli inspection. If it is on, install the hotfix for your build, now out on every branch, or turn Brotli inspection off the way the advisory describes. Palo Alto says the same hotfixes in our PAN-OS story fix both this and the PHP flaws, except 11.2.10-h16, which fixes only PHP. Third, if PHP runs on a Windows server, install PHP’s rebuilt Windows package, 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1; PHP says the flaw is reachable there only through cURL’s automatic response decompression, which is off by default. Fourth, ask your software and appliance vendors whether their products include Brotli and when their fix ships.
CISA lists a July Adobe Commerce and Magento file-upload flaw as exploited — move stores to Adobe’s October build and check for planted files
On October 27, 2026, CISA added CVE-2026-48356, a flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog, with a remediation due date of November 10 for federal agencies. CISA describes it as an unrestricted upload of a file with a dangerous type that could result in arbitrary code execution. Adobe fixed it on July 14, 2026 in security bulletin APSB26-73, which rates it critical with a CVSS score of 9.6, lists its impact as privilege escalation, and says no authentication is required to exploit it. The bulletin, last updated August 11, says Adobe is not aware of any exploits in the wild for the issues it addresses.
APSB26-73 lists as affected Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier and 2.4.4-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier and 2.4.6-p15 and earlier; and Adobe Commerce B2B 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier and 1.3.3-p18 and earlier; and Adobe Commerce Events 1.6.0 to 1.20.0. The fixed versions are the July 2026 builds of each line, for example 2.4.9-2026-jul, and Commerce Events 1.21.0. Adobe has released further Commerce updates since. The most recent, APSB26-153 of October 13, lists the 2026-oct builds as fixed for Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3 and Magento Open Source 2.4.7 through 2.4.9, lists Magento Open Source 2.4.6 as affected with no fixed build, and tells users to also apply the hotfix for CVE-2026-75650 from APSB26-146, a flaw Adobe says is being exploited in the wild.
What it means for you: This is the third Adobe Commerce flaw CISA has added to its exploited list since September 8, after CVE-2026-75650 on September 8 and CVE-2026-71362 on September 24, which our September 24 story covered. If your business sells online, or runs a dealer or customer ordering portal, on Adobe Commerce or Magento, in our view the worry is the store nobody updates, often one an outside developer built years ago. CISA’s catalog does not say who is exploiting this flaw or how.
Three things this week. First, get the exact version in writing from whoever builds or hosts the store, including any B2B ordering site. Second, move it to the October 2026 build for its line, plus the APSB26-146 hotfix Adobe calls for; Adobe recommends the newest version, and the October build is the newest non-alpha build it lists. If the store is on Magento Open Source 2.4.6, Adobe’s October bulletin lists no fix for it, so the real project is an upgrade to Magento Open Source 2.4.7 or later, which the October bulletin does fix.
Third, because this flaw lets an attacker upload a file the store should never accept, ask the developer or host to look for unfamiliar files in the store’s upload and media folders, especially script files, and for administrator accounts nobody created. In our view, a store that sat on a build older than July’s into the fall needs that look back, not only the patch. If anything turns up, treat it as an incident and protect your customers’ data first.
Apple now fixes the CISA-listed exploited iPhone flaw on the iPhone XS and XR with iOS 18.7.11, alongside a large update round for current iPhones and Macs
On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11. Its security notes list a fix for CVE-2026-86950, the CoreGraphics flaw Apple fixed for newer devices on September 28 and CISA added to its Known Exploited Vulnerabilities catalog on September 29. Apple says processing a maliciously crafted file may lead to arbitrary code execution, and repeats that it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Apple lists iOS 18.7.11 and iPadOS 18.7.11 as available for iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Apple’s September 28 fix, iOS 26.7.1, was listed for iPhone 11 and later, and Apple’s security releases page shows no iOS 18 update between September 28 and October 26.
The same day, Apple released iOS 27.2 and iPadOS 27.2, iOS 26.7.2 and iPadOS 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2. Each set of notes lists more than 100 CVE entries, including kernel fixes, and none of them says an issue was exploited. Apple also released Safari 27.2 for Macs on macOS Sequoia and macOS Tahoe. Apple’s security releases page lists no macOS Sonoma update in this round.
What it means for you: This one is about the older devices in your office. An iPhone XS or XR cannot run iOS 26, so until October 26 it had no fix for a flaw CISA lists as exploited. Apple’s wording still points to targeted attacks on specific people rather than a broad campaign, but older phones often end up as the shared front-desk phone, the spare, or a personal phone that still gets company email. Note what Apple does not list: iOS 18.7.11 is not offered for the iPhone 11 or later, so an iPhone 11 or newer that someone kept on iOS 18 has to move to iOS 26 or 27 to get the fix.
This week, find every iPhone XS, XS Max or XR, and every iPad 7th generation, iPad 9th generation or later, iPad Air 4th generation or later, or iPad mini 6th generation or later still on iPadOS 18, and install 18.7.11. Any other iPad on iPadOS 18, including every iPad Pro, gets no 18.7.11 and needs iPadOS 26.7.2 or later. Move any iPhone 11 or newer still on iOS 18 to iOS 26.7.2 or iOS 27.2. Then take the rest of the round: iOS 27.2 or 26.7.2 on current phones and iPads, and macOS Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2 on Macs, plus Safari 27.2 on Sequoia and Tahoe. None of those fixes is reported as exploited, but they are free and close well over a hundred holes each. If you manage devices centrally, raise the minimum versions and check compliance in a few days.
Two things updates will not solve. Apple again lists no macOS Sonoma update, so Macs on Sonoma or older need a plan to move to Sequoia or later, and those that cannot run Sequoia need replacing. And Apple lists no update in this round for iPhones older than the XS, so those should come off company email.
CISA now lists the two critical PHP flaws as exploited — confirm every PHP site has the fix, then check whether it was reached before the update
On October 26, 2026, CISA added CVE-2026-109618 and CVE-2026-109619, the two PHP flaws known as PHP2Shell, to its Known Exploited Vulnerabilities catalog, with a remediation due date of October 29 for federal agencies. The catalog describes both as allowing unauthenticated remote code execution, lists PHP as the affected product, and notes that the flaws sit in a component that other products can include. CISA also updated its October 21 alert to reflect the addition. The alert says the flaws affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, and tells organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Both catalog entries point federal agencies to CISA’s forensics triage requirements; CISA says its Binding Operational Directive 26-04 sets expectations for when agencies must check whether attackers compromised a system before the patch was applied. The directive binds only federal civilian agencies, but CISA encourages all organizations to prioritize vulnerabilities in the catalog. Separately, on October 26 PHP published rebuilt Windows packages, 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, which include Brotli 1.2.1 to fix a different flaw, CVE-2026-111497; PHP says the PHP runtime versions are unchanged.
What it means for you: We covered these flaws on October 21, when CISA’s original alert said it had not observed them being exploited. That has changed, and it changes the question for any website, client portal or intake form you own that runs on PHP: not only whether it is patched, but whether someone got in before it was. The fixed versions have been out since October 21, so a site still unpatched today has been exposed for most of a week.
Three things this week. First, finish the inventory: every website and web application, who hosts it, which PHP version it runs, and written confirmation that it is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on a vendor package that includes the fix. CISA says systems that cannot be updated now, or that run PHP 8.1 or earlier, should go offline until they are fixed. Remember PHP built into other products; our QNAP and Palo Alto stories cover two of them.
Second, for any site that was reachable from the internet and unpatched after October 21, have whoever runs the server look for signs of a break-in: PHP processes launching shells or downloading tools, which CISA names as a warning sign, new or changed files in the web folders, and administrator accounts nobody created. CISA has published a detection rule that a provider with log monitoring can use. If anything turns up, treat it as an incident: in our view, rebuild from a known-good copy and change every password and key the site held. Third, if PHP runs on a Windows server, install PHP’s rebuilt -1 package for your version as well; PHP says the Brotli flaw it fixes is reachable only when an application turns on automatic response decompression in the cURL extension, which is off by default.
Palo Alto says the critical PHP flaws reach the PAN-OS firewall management interface — all hotfixes are out, so lock down management access and patch now
On October 21, 2026, Palo Alto Networks published a security advisory saying the two critical PHP vulnerabilities the PHP project fixed that day, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS. The advisory applies to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama, and lists PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 as affected. Palo Alto says only the management web interface is affected, meaning the HTTPS web UI and the XML API service, plus any data interface with a management profile attached. It says the GlobalProtect portal, gateway and Clientless VPN and the captive portal are not affected. Palo Alto now rates the issue 9.2, Critical, for its own products, with a suggested urgency of Highest, after raising both on October 27, and says no special configuration is required to be affected.
Palo Alto’s October 29 update lists all twenty hotfixes as released, including 10.2.18-h13, 11.1.16-h4, 11.2.16-h1, 12.1.10-h3 and 12.2.4-h1, with the last six released on October 28 and 29. Palo Alto says the same hotfixes fix a separate Brotli flaw, CVE-2026-111497, except 11.2.10-h16, which fixes only PHP; that flaw does not affect PAN-OS 10.2 or 11.1.
Palo Alto says the risk is highest when the management interface can be reached from the internet, and that restricting it to trusted internal IP addresses, or to a single jump box, reduces the risk. It also lists Threat Prevention signatures, starting with Threat ID 543004, that work only after extra setup, including routing management traffic through a data port and decrypting it. Palo Alto’s advisory now says active exploitation has been observed against PAN-OS management interfaces exposed to the internet. On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
What it means for you: If your office firewall is a Palo Alto PA-Series or VM-Series, or your IT provider manages several through Panorama, this is the PHP story arriving at the front door. The flaw sits in the page and API used to manage the firewall, not in the VPN your staff use, so the question this week is simple: who can reach that management page? Palo Alto’s advisory now says attackers are exploiting management interfaces exposed to the internet, CISA added both PHP flaws to its exploited list on October 26, and a separate PAN-OS management interface flaw that needs a login, CVE-2026-0322, has been on CISA’s exploited list since October 14.
This week, have whoever manages the firewall confirm three things in writing. First, the management interface accepts connections only from trusted internal addresses or a jump box, never from the internet. Second, no internet-facing interface, including the one that carries GlobalProtect, has a management profile attached. Third, they know which PAN-OS branch and build each firewall and Panorama runs, so they can match it to the hotfix list. If you are counting on Threat Prevention signatures instead, ask your provider whether management traffic is actually routed through a data port, decrypted and inspected, because Palo Alto lists those among the steps the signatures need to work.
Then install the hotfix. All twenty are out as of Palo Alto’s October 29 update; on 11.2.10 the target is 11.2.10-h17, which also fixes the Brotli flaw CISA listed as exploited on October 27. There is no longer a reason to wait, so book the maintenance window now. If the management page has been reachable from the internet, ask your provider to review the administrator login and configuration logs for anything they did not do.
CISA lists the Collabora built-in CODE server flaw in Nextcloud as exploited — update the app to 26.4.303 or remove it, then check the server
On October 23, 2026, CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog. The flaw is in Collabora Online - Built-in CODE Server (the richdocumentscode app), a Nextcloud app that bundles a Collabora Online (CODE) server with Nextcloud, so no separate Collabora server is needed. CISA describes it as an OS command injection flaw that allows remote code execution when the CODE server isn’t running, and set a remediation due date of October 26 for federal civilian agencies.
Collabora’s advisory, GHSA-g3vx-3m76-fghh, rates the flaw critical, CVSS v4 9.2, and says a request to proxy.php can cause an operating system command to run as the web server user, with no login required. Collabora says the attack only works while the built-in CODE server is not running, such as on a container restart, an upgrade or after a crash. Affected versions are below 26.4.303, and the fix is release 26.4.303. Collabora says disabling the app is not enough: it must be upgraded to 26.4.303 or later, or removed. Users of end-of-life Nextcloud 29 or earlier should upgrade Nextcloud or remove the app. Standalone Collabora Online servers are not affected, and Collabora says this is a different flaw from CVE-2025-66208, whose fix does not prevent it. The CVE record says the flaw was exploited in the wild in September and October 2026.
What it means for you: In our experience, Nextcloud is a common way for small offices, nonprofits and professional firms to run their own file sharing instead of a cloud service. The built-in CODE server is the easy way to edit documents in the browser without setting up a separate server. A Nextcloud server often faces the internet and holds the firm’s files. This flaw lets an attacker with no account run commands on it whenever the built-in CODE server is not running, such as after a restart, an upgrade or a crash.
Three things to do this week. First, find out whether you or a provider run Nextcloud, and if so, whether the Collabora Online - Built-in CODE Server app is installed. If it is not, or Collabora runs as its own standalone server, Collabora says this flaw does not affect you. Second, if the app is installed, update it to 26.4.303 or later today, or remove it. Do not just disable it; Collabora says that is not enough. On Nextcloud 29 or older, upgrade Nextcloud or remove the app.
Third, because CISA lists the flaw as exploited and points federal agencies to its forensic triage requirements, our advice is to treat a server that ran an older version as possibly compromised. Have whoever runs it look for PHP files in the Nextcloud folders that nobody installed, unknown admin accounts and unexpected scheduled tasks, and review web server logs for requests to proxy.php. If anything turns up, rebuild the server from a known-good backup and change the passwords and app tokens stored on it.
Windows Server 2016 gets its last security update in January 2027 — find those servers now and choose an upgrade or Extended Security Updates
On October 14, 2026, Microsoft posted a 90-day reminder that Windows Server 2016 reaches end of updates on January 12, 2027. Microsoft says January 2027’s security update will be the last one for this version, and Windows Server 2016 machines will get no monthly security updates after that. The end of updates applies to all editions: Datacenter, Essentials, MultiPoint Premium and Standard. Microsoft says support for Windows Server 2016 Essentials features, including Remote Web Access, ends on the same date, and that any Essentials capability that keeps working afterward should be treated as unsupported.
Microsoft recommends upgrading to Windows Server 2025 and offers a free 180-day evaluation. It says Extended Security Updates (ESU) are available for the Standard and Datacenter editions for organizations that need more time to complete their transition. The notice does not mention ESU for Essentials or MultiPoint Premium.
What it means for you: In our experience, Windows Server 2016 is still common in small offices, often as the one server in the closet that runs the file shares, the domain controller, a line-of-business database or a practice-management system. After January 12 it stops getting security fixes, and a server that holds your files and passwords is the last machine you want running without them. Under three months is not much time for a server project once you count ordering hardware, testing your business software on the new version and scheduling a cutover around the holidays.
This week, have whoever manages your IT list every Windows Server 2016 machine, physical or virtual, including any at a hosting provider, with its edition and what runs on it. For each one, decide: move to Windows Server 2025, move the workload to a cloud service, retire it, or sign up for ESU for Standard or Datacenter to gain time. Ask the vendor of each business application on those servers, in writing, whether it supports Windows Server 2025. If you run Server 2016 Essentials, plan to replace it, because Microsoft’s notice names ESU only for Standard and Datacenter and says Essentials features, including Remote Web Access, lose support the same day. Regulated firms should record the plan and its dates in their risk assessment now.
HPE fixes 72 flaws in Aruba wireless controllers, gateways and access points, eight rated the maximum 10.0 — no known exploit code, plan the upgrade now
On October 22, 2026, Hewlett Packard Enterprise published security bulletin HPESBNW05162, fixing 72 vulnerabilities in AOS-8 and AOS-10, which run HPE Networking (Aruba) Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 access points and AOS-8 Instant access points. Eight of the flaws, CVE-2026-79844 through CVE-2026-79851 per HPE’s bulletin, score the maximum CVSS 10.0. HPE says seven of them could let an unauthenticated remote attacker run commands or code on the device’s underlying operating system (for two, only if preconditions outside the attacker’s control are met), and the eighth, in the PAPI protocol, could give an unauthenticated remote attacker administrative access. Of the other 64 flaws, 25 require an attacker on an adjacent network, and many of the rest can be reached remotely without a login. More than 20 of the 72 involve PAPI, Aruba’s access point management protocol, which uses UDP port 8211.
HPE lists the affected versions as AOS-10.8.x.x 10.8.1.1 and below, AOS-10.7.x.x 10.7.2.6 and below, AOS-10.4.x.x 10.4.1.13 and below, AOS-8.13.x.x 8.13.3.0 and below, and AOS-8.10.x.x 8.10.0.23 and below. The fixes are 10.8.1.2 and above, 10.7.2.7 and above, 10.4.1.14 and above, 8.13.3.1 and above, and 8.10.0.24 and above. HPE says releases past End of Maintenance are presumed affected and not covered, and those past End of Support should be considered potentially impacted.
HPE says the flaws were generally discovered by its own security research, with some reported through its bug bounty program, and that it is not aware of any public discussion or exploit code targeting them as of the bulletin’s release. None of the 72 CVEs is in CISA’s Known Exploited Vulnerabilities catalog as of its October 21 version.
What it means for you: In our experience, Aruba wireless is common in midsize offices, clinics, schools and public agencies, and the controllers and gateways in this bulletin manage the access points for a whole site. HPE says one of the flaws “could lead to complete device control, enabling interception of network traffic.” HPE strongly urges customers to patch. HPE knows of no public exploit code and CISA has not listed any of these flaws as exploited, so in our view this is a planned upgrade rather than an emergency, but with this many flaws that need no login we would not wait for the next quarterly maintenance window.
Four things to do this week. First, list every AOS-8 or AOS-10 controller, gateway, conductor and access point you own, including virtual controllers and SD-WAN gateways, and note the version each one runs. Second, schedule the upgrade to the fixed release for its branch: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24, or later; our advice is to start with any device that can be reached from the internet or from guest networks. Third, until then, follow HPE’s workaround: restrict the command-line and web management interfaces to a dedicated layer 2 segment or VLAN and/or firewall policies, and turn on accounting to log user activity. We also recommend making sure UDP port 8211 cannot be reached from the internet or from guest networks. Fourth, anything on a release past End of Maintenance or End of Support should move to a supported branch, because HPE does not cover or has not assessed it.
HPE says products not listed in the bulletin are not affected; the separate Instant On line is not listed. If an IT provider manages your Wi-Fi, ask them which AOS version each device runs and when it will be upgraded.
QNAP says the critical PHP flaws reach its NAS systems — QTS and QuTS hero fixes are out, so update now and keep QNAP devices off the internet
On October 22, 2026, QNAP published security advisory QSA-26-18, rated Critical, saying the two PHP vulnerabilities the PHP project fixed on October 21, CVE-2026-109618 and CVE-2026-109619, affect multiple QNAP products because PHP is used in QNAP web components and applications. Both are rated 9.2 out of 10 under CVSS version 4. QNAP says both can be triggered before any application-level authentication and could let unauthenticated remote attackers run code. The advisory lists QTS 6.1.0 and QTS 5.2.11 and earlier; QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier; QuTScloud c5.2.9 and earlier; Notes Station 3 3.9.14 and earlier; QNE (ADRA) 1.0.7 and earlier; QVR Surveillance 3.0.3 and earlier on ARM32 models; and TVR OS 1.0.4 and earlier.
QNAP’s October 24 revision (V1.1) lists fixes in build 20261023: QTS 6.1.0.3656 and 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661, and QuTScloud c5.2.9.3661. QNAP’s October 28 revision (V1.2) lists Notes Station 3 3.9.15 as fixed, and the advisory now also lists QVR Surveillance 3.0.3.1756 (ARM32 models) and TVR OS 1.0.5 as fixed. Only QNE (ADRA) is still listed as “Fixing”, with the fixed version “To be announced.” QNAP says exploitation attempts against PHP have been publicly reported, but that it has not received reports of exploitation targeting QNAP products. It says its interim steps reduce exposure but do not fully fix the vulnerabilities, and that PHP inside Container Station containers or third-party applications is not covered by QNAP updates. On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities catalog (version 2026.10.26), listing PHP as the affected product.
What it means for you: In many small offices a QNAP box is the file server, backup target or camera recorder, and it is easy to forget it runs a web server. QNAP has now released fixes for every affected product except QNE (ADRA), and QNAP says the most effective protection is to keep the device off the internet. In our view, a file server that can be made to run an attacker’s code puts both your files and any backups stored on it at risk.
Today, have whoever manages it confirm four things. The router has no port forwarding or UPnP pointing at the NAS. In myQNAPcloud, UPnP port forwarding (Auto Router Configuration) and myQNAPcloud Link are turned off. Services you do not need are unpublished under Publish Services. The management ports (8080 and 443 by default) accept connections only from your office network or VPN, set in QuFirewall or the Allow/Deny List. Staff who reach files from home should come in through a VPN, not a published web port. In App Center, stop affected apps you do not currently need, and turn off the built-in web server if nothing needs it.
Then check whether it was already reached: review QuLog Center for logins you do not recognize and run Security Center and Malware Remover with current definitions. If you suspect compromise, QNAP says to disconnect the device from the network, change all passwords, and contact QNAP Support. Install the QTS, QuTS hero or QuTScloud update for your model now, update Notes Station 3, QVR Surveillance and TVR OS where you run them, and check the advisory for the QNE (ADRA) fix. If the NAS runs containers or third-party apps that include PHP, ask those providers for their own fix. In our view, keep at least one copy of your backups somewhere the NAS cannot reach.
Microsoft has started switching off Exchange Web Services in Microsoft 365 — Apple Mail on Macs, classic Outlook for Mac and some add-ins can stop working
On October 21, 2026, Microsoft’s Exchange team updated its retirement post for Exchange Web Services (EWS) to say it has started disabling EWS in Microsoft 365 tenants in its worldwide cloud, and published steps for administrators whose apps stopped working. EWS is an older way for apps to reach mailboxes, calendars and contacts in Exchange Online. Microsoft lists Apple Mail and Calendar on macOS, classic Outlook on macOS, some Outlook desktop add-ins, outdated versions of Outlook for Windows, and other purchased software such as backup applications among the apps that use it. When EWS is off, Microsoft says these apps may keep asking for a username and password, or report that the EWS protocol is not available.
For tenants that have not configured EWS themselves, Microsoft says it posts a seven-day warning in Message Center, fills in an allow list of apps based on the last 60 days of use, and then turns EWS off. Only a tenant administrator can turn it back on; Microsoft says its support staff cannot. That is temporary: Microsoft says EWS will be fully and permanently disabled starting April 1, 2027, and that there will be no exceptions. The retirement applies only to Microsoft 365 and Exchange Online. Microsoft says EWS is not being retired in on-premises Exchange Server.
What it means for you: If someone at your company suddenly cannot get mail in the Mac’s built-in Mail app, or an Outlook add-in or a product that connects to your mailboxes stopped working recently, this is a likely cause, even though it can look like a password problem. Have whoever runs your Microsoft 365 tenant search Message Center for “Action may be required: EWS will be disabled in your tenant in 7 days” or “EWS has been disabled in your tenant”.
If something important broke, the fix is in the Microsoft 365 admin center under Baseline security mode, “Block access to Exchange Web Services”, or in Exchange Online PowerShell. The admin center steps look backwards: untick “Block your entire organization from using EWS”, apply, then tick it again and apply again. Microsoft says it usually works within an hour, up to four in rare cases.
Then review the allowed-apps list Microsoft built from your last 60 days of use and remove anything you know you no longer use. Changes to that list take 24 hours, and classic Outlook for Mac needs the “Microsoft Office” entry. In our view, shorter is better: the FBI, CISA and NSA advisory we covered on October 8 says attackers used a password-spraying tool that can work through EWS against Microsoft 365 accounts.
Treat April 1, 2027 as a hard deadline. Move Apple Mail and classic Outlook for Mac users to the new Outlook for Mac, which Microsoft says this change does not affect. Keep Outlook for Windows at the August 2026 build 16.0.20430.20092 or higher. Ask each vendor whose product connects to your mailboxes, in writing, when it will stop using EWS. Anything still depending on it on April 1 will stop working.
Fortinet ships urgent FortiOS, FortiManager and FortiAnalyzer fixes, with details withheld until November 10 — upgrade internet-facing devices first
On October 21, 2026, Fortinet’s chief information security officer, Carl Windsor, announced a coordinated set of security updates for FortiOS (the software on FortiGate firewalls), FortiManager and FortiAnalyzer, due October 22, following earlier releases for FortiMail and FortiAuthenticator. Fortinet says the releases include critical and high-severity fixes, that the vulnerabilities were found through its own AI-assisted security testing, and that customers should treat this as a priority change rather than routine maintenance, starting with internet-facing devices.
Fortinet lists FortiOS 8.0.0 to 8.0.1 as fixed in 8.0.2 or above, 7.6.0 to 7.6.7 in 7.6.8 or above, 7.4.0 to 7.4.12 in 7.4.13 or above, and 7.2.0 to 7.2.13 in 7.2.14 or above. For both FortiManager and FortiAnalyzer, it lists 8.0.0 to 8.0.1 as fixed in 8.0.2 or above, 7.6.0 to 7.6.7 in 7.6.8 or above, 7.4.0 to 7.4.11 in 7.4.12 or above, and 7.2.0 to 7.2.12 in 7.2.13 or above. Release notes for FortiOS 7.6.8 and 7.4.13 and FortiManager 7.6.8 are now in Fortinet’s documentation library.
Fortinet has not published CVE numbers or details. It says public advisories will appear on its PSIRT page on November 10, and it warns that once updates are public, the fixes reveal where code was changed, which can point attackers to the weaknesses. It says FortiSASE is updated automatically, FortiManager Cloud may need a manual update, and public cloud instances are being updated through Fortinet’s cloud partners. Fortinet does not say that any of the FortiOS, FortiManager or FortiAnalyzer flaws has been exploited.
What it means for you: FortiGate firewalls are common in small and midsize offices across Southern California, and Fortinet is shipping these fixes weeks before saying what they fix. Its reason for urgency: once fixes are public, comparing old and new code can point attackers to the weaknesses, and AI tools can now help them build working exploits in hours or days rather than weeks. Expect the gap between this release and the first attacks to be short.
Four things to do this week. First, list every FortiGate, FortiManager and FortiAnalyzer you own, including branch-office and spare units, and note the version each one runs. Second, back up each configuration and upgrade internet-facing devices first, to the fixed version for its branch. Third, until a device is upgraded, follow Fortinet’s interim steps: restrict the HTTPS and SSH admin interfaces to trusted IP addresses or turn them off on external interfaces, make sure FortiManager’s admin interface cannot be reached from the internet, and require MFA on every administrator account. Fortinet says these steps reduce risk but do not replace the upgrade. Fourth, before and after upgrading, watch the logs for unusual administrator logins or configuration changes nobody approved.
If an IT provider manages your firewall, ask them today which version it runs and when it will be upgraded. Fortinet’s table covers only the 7.2, 7.4, 7.6 and 8.0 branches, so our advice for a device on an older branch is to talk with whoever manages it about moving to a supported one. If you run FortiMail or FortiAuthenticator, Fortinet’s post lists fixed versions for those too; the FortiMail versions are the same ones that fixed the exploited FortiMail flaw we covered on October 1.
GitLab fixes a new CVSS 10.0 flaw that could let an attacker with no login run code, back to version 7.0 — self-managed servers need upgrading again
On October 21, 2026, GitLab released a critical patch release, versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 of GitLab Community Edition (CE) and Enterprise Edition (EE). The most serious fix is CVE-2026-110264, an integer overflow in the regular expression compiler that GitLab rates Critical, with a CVSS score of 10.0. GitLab says that, under certain conditions, it could have allowed an unauthenticated user to execute arbitrary code on the GitLab server when compiling a specially crafted regular expression.
GitLab lists the impacted versions as “all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.” That range includes 19.4.2, 19.3.5 and 19.2.8, the versions GitLab released on October 12 for a different critical flaw. GitLab backported this fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9. The same release fixes eleven other security issues, two of which GitLab rates High.
GitLab strongly recommends that all self-managed installations be upgraded immediately. It says GitLab.com is already running the patched version, and that GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes. GitLab has published two threat detections for self-managed customers to spot exploitation attempts, named “Onigmo native worker crash” and “Org mode render error burst.” Its release notes do not say the flaw has been exploited, and as of CISA’s catalog release of October 21 (version 2026.10.21), CVE-2026-110264 is not in the Known Exploited Vulnerabilities catalog.
What it means for you: If your company uses GitLab.com, there is nothing for you to do. This story is for organizations that run GitLab on their own servers: software teams, engineering firms, manufacturers and defense suppliers that keep source code and technical data in-house. The reach is what stands out. GitLab says every version back to 7.0 is affected, so an old server nobody has touched in years is in scope, and so is a server you upgraded last week for the October 12 fix.
Three things to do this week. First, list every self-managed GitLab server, including test and forgotten instances, and check its version against GitLab’s list. Second, upgrade each one to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, or later, and book an outage window for single-node servers, since GitLab says they will be down while the upgrade migrations run. A server on 18.10 or older has no fix on its own branch and has to move to one of these versions. Third, ask whoever runs the server to look for the two warning signs GitLab names for exploitation attempts. If a server is reachable from the internet and cannot be upgraded right away, our advice is to limit who can reach it, for example to your office network or VPN, until it is. That is our stopgap, not a GitLab mitigation; GitLab’s release notes give no workaround, so the upgrade is the fix.
GitLab has not said this flaw is being exploited, and CISA has not listed it. But a flaw that could let someone with no login run code on the server that holds your source code and build credentials is not one to leave for the next maintenance window.
PHP’s two critical flaws: CISA says patch immediately and Cloudflare reports attack traffic — update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
On October 21, 2026, the PHP project published a security advisory for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that it says can allow unauthenticated remote code execution, and released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix them. The project’s GitHub advisories rate both flaws Critical, 9.2 out of 10 under CVSS version 4, and list all versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says all installations that serve web requests are at risk, and considers the risk highest for Apache with mod_php, where it says an exploit has been demonstrated. PHP 8.1 and older get no new release; the project published minimal source backports for 7.4, 8.0 and 8.1.
The same day, CISA issued an alert urging organizations to patch immediately. CISA said it had not observed exploitation as of publication, and that organizations that cannot update right away, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched or updated. Cloudflare wrote on October 21 that the vulnerability leaked before the official release date, that it observed attack traffic targeting its customers, and that attackers were changing their payloads to try to get past its protections; it did not report any successful compromise. On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, with a remediation due date of October 29 for federal agencies, and updated its October 21 alert to say so.
What it means for you: This one reaches further than most stories on this page. If your organization has a website, client portal, intake form or online payment page, there is a good chance PHP is running underneath it, whether that is WordPress on shared hosting or a custom portal a developer built years ago. A CISA alert telling organizations to patch immediately, plus a security company reporting attack traffic against its customers, means now, not next week. A site that can be made to run an attacker’s code can be used to capture what visitors type into it or to serve malware under your name.
First, list every website and web application you own, including old microsites and anything a former vendor built, and ask whoever hosts each one, in writing, which PHP version it runs and when it will be on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on a vendor package that includes the fix. PHP lists 8.2 as reaching end of life on December 31, 2026, so a site on 8.2.35 needs an upgrade plan too. On shared hosting the host controls PHP. On your own server, apply the update and restart the PHP service so every worker picks it up.
Second, CISA says systems that cannot be updated now, or that run PHP 8.1 or earlier, should go offline until they are fixed. We agree: unless your host confirms a fix for the exact version your site runs, take that site down or upgrade it now. Third, ask whoever runs the server to check for PHP processes launching shells or downloading tools, which CISA names as a warning sign. CISA says a web application firewall can offer partial protection in the meantime; treat that as a stopgap, not a fix.
UpdraftPlus maker believes its customer database and UpdraftCentral connection keys were accessed — update the plugin and check connected WordPress sites
On October 19, 2026, TeamUpdraft, the maker of the UpdraftPlus backup plugin for WordPress, published a notice saying it identified unauthorized access to its teamupdraft.com website over the weekend of October 17 and 18. TeamUpdraft says it believes its customer database was accessed, including names, email addresses, billing addresses and order history, account passwords stored only in hashed form, two-factor authentication settings, and connection keys for its UpdraftCentral, UpdraftVault and UpdraftClone services. It says it does not store card details, and that the UpdraftPlus plugin and its downloads, backups sent to customers’ own remote storage, and self-hosted UpdraftCentral were not affected.
TeamUpdraft says UpdraftCentral connection keys can send commands to connected sites. Its fix is UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium): per the notice, these versions disconnect every UpdraftCentral connection made before 13:07 BST on October 18 (5:07 a.m. Pacific), and its October 20 update says that release revoked the old keys. TeamUpdraft also disconnected every site from UpdraftVault and replaced every UpdraftClone client key. Patchstack, a WordPress security firm, reports that someone using valid UpdraftCentral keys planted backdoor plugins on connected WordPress sites on October 18 and 19, and calls it a key compromise, not a flaw in the plugin’s code.
What it means for you: UpdraftPlus is a common backup plugin on small-business WordPress sites, and web agencies often link many client sites to UpdraftCentral. If your site was connected to UpdraftCentral cloud, treat it as possibly tampered with until it is checked. For free-plugin users without a teamupdraft.com account, TeamUpdraft says no action is needed beyond keeping the plugin current; our advice is to have whoever maintains the site confirm it holds no UpdraftCentral key anyway.
This week, for each site connected to UpdraftCentral cloud: log in directly at the site’s WordPress admin page rather than via UpdraftCentral; update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later; and delete the connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Then look for unfamiliar plugins, including on the Must-Use tab, and change every administrator password. TeamUpdraft says to remove unknown administrator accounts; our advice is to review every user, since Patchstack says the backdoor account it found shows as an Editor. If anything looks wrong, TeamUpdraft suggests restoring from a backup taken before October 17. For a site accessed through UpdraftCentral, it advises re-authorizing remote backup storage and changing its access keys; we would also change the database password and site API keys. Reconnect to UpdraftCentral only after these checks.
Anyone with a teamupdraft.com account should change that password and any reuse of it, and reset two-factor authentication there if they use it. UpdraftVault users must reconnect each site, then run a manual backup to confirm it works. TeamUpdraft says it will never ask for passwords or keys, so distrust emails claiming to be from it and type teamupdraft.com into the browser yourself.
Palo Alto’s Unit 42 says Qilin and Inc ransomware crews are using a GlobalProtect VPN flaw to get past multifactor sign-in — patch and check VPN logs
On October 19, 2026, Palo Alto Networks’ Unit 42 threat intelligence team updated its threat brief on CVE-2026-0257, an authentication bypass in the GlobalProtect VPN portal and gateway of the PAN-OS firewall software. Unit 42 says ransomware operators exploiting the flaw include the groups it tracks as Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc). It says attackers use the flaw to get past multifactor sign-in and open a VPN session, then typically scout the network with remote monitoring and management tools, move laterally over RDP and SMB, and stage tools to steal credentials and data before deploying ransomware. Unit 42 says its investigations since early June span healthcare, financial services, manufacturing, professional and legal services, education, government and other industries.
In one case, attackers went from the VPN gateway to the vCenter management appliance, turned off a security control on the ESXi hosts, and dumped credentials offline from a domain controller’s virtual disk, a method Unit 42 says bypasses security software running inside the servers.
Palo Alto published the flaw on May 13, 2026, rates it 7.8 (High) with a suggested urgency of Highest, and says a firewall is exposed only when GlobalProtect uses authentication override cookies with a specific certificate configuration. CISA added it to its Known Exploited Vulnerabilities catalog on May 29, 2026, and marks it as known to be used in ransomware campaigns. Cloud NGFW and Panorama are not affected, and Palo Alto says it is upgrading Prisma Access customers on a schedule shared with those customers.
What it means for you: If remote staff connect through a Palo Alto firewall with GlobalProtect and authentication override cookies are turned on, this is a ransomware entry point that multifactor sign-in does not stop. The fix has been out since May, so the risk now is a firewall that was never updated, or one attackers got into before it was patched.
This week: first, confirm every GlobalProtect portal and gateway runs a fixed release from Palo Alto’s table. By line, the fixes are 12.1.4-h6 or 12.1.7; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15; and 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6. Older unsupported versions must move to a supported fixed version. If you cannot upgrade at once, Palo Alto’s workarounds are a dedicated certificate for authentication override cookies, or turning authentication override off.
Second, have your IT provider search GlobalProtect logs for successful connections from the nine IP addresses and the device names Unit 42 lists, such as DESKTOP-GP01 and GP-CLIENT. Unit 42 says any successful connection tied to them calls for incident response. Third, because of the move to the virtualization layer, we recommend making sure vCenter and ESXi management cannot be reached from the VPN address pool, and keeping backup servers patched and off the general network; Unit 42 also saw attackers chain this access with exploits against backup systems.
Siemens says attackers are exploiting a Software Center flaw and ties it to a ClickFix campaign — update it and check PCs for the warning signs
On October 15, 2026, Siemens published security advisory SSA-580366 for CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, the Windows tool Siemens customers use to download, install, activate and update the Siemens software they have bought. Siemens says the tool loads DLL files from a search path it does not control, so an authenticated local attacker who places a crafted DLL where it looks can run code with the tool’s privileges. Siemens scores the flaw 8.4 under CVSS v4.0 and 6.7 under CVSS v3.1. The advisory lists all versions before V4.0.9.8 as affected. Siemens added the fix on October 17: V4.0.9.8 or later, and existing installations update automatically the next time they start.
On October 19, Siemens updated the advisory and said in a ProductCERT blog post that it has validated active exploitation. Siemens says the attackers put their own DLL files next to a genuine Software Center program that carries a valid Siemens signature, that the program itself was not modified, and that the bundle was distributed outside official channels. It attributes the activity to the “Romulus multi-platform ClickFix campaign.” Siemens says that, to its knowledge, no Siemens system, product or update channel was breached. On October 20, 2026, CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog, with a remediation due date of November 3 for federal agencies.
What it means for you: This is not only a problem for companies that run Siemens software. Siemens describes attackers bringing their own signed copy of Software Center, so a PC that never had Siemens software can still end up running it. In our view, updating your installed copy does not stop an attacker from dropping an older one. Siemens advises defenders to watch the folder the program runs from and how it behaves, not the file’s fingerprint, because the file itself is genuine. And because Siemens ties this to a ClickFix campaign, the best place to stop it is earlier: before a person is talked into pasting a command.
Four things to do this week. First, if your engineering, design or production PCs use Siemens software, confirm Software Center is at V4.0.9.8 or later; opening it starts the update. Second, tell staff plainly what Siemens tells users: never paste a command from a web page into Win+R, the Run box or PowerShell, because a real “I am not a robot” check never asks for that. Our advice: anyone who already did should report it at once, without blame.
Third, have your IT provider block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127, as Siemens advises, and search firewall and DNS logs for all three. Fourth, check PCs for the signs Siemens lists: Software Center in startup apps or Task Scheduler on a PC that never had it installed, SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec, a folder named SM Software Provisioning Service under AppData\Local\Programs, the files activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe, or an FTSuite folder under AppData\Local holding ftc.uml. If you find one, Siemens says to isolate the PC, stop the process first, remove the startup entry and scheduled task, and reset passwords.
Rank Math says some PRO plugin downloads on October 15 and 16 carried malware — WordPress sites that activated one should be treated as compromised
On October 16, 2026, Rank Math, the maker of the Rank Math SEO plugin for WordPress, published a security notice about its paid plugin, Rank Math PRO. The notice says a limited number of users downloaded version 3.0.123 between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 (1:02 p.m. Pacific on October 15 to 12:12 a.m. Pacific on October 16), and that the affected plugin files contained malware. It applies to sites that downloaded or updated to that version during the window. Rank Math’s changelog shows 3.0.123 was first released October 7. Rank Math says it removed the affected files right away and released a clean version, 3.0.124, and that the free Rank Math SEO plugin on WordPress.org is not affected.
Rank Math tells owners of sites that installed and activated an affected copy to treat the site as compromised and to assume that credentials and other secrets the site could reach may have been exposed. It warns that the malware can recreate its hidden backdoor whenever someone visits the site, so cleanup steps must be done in order. The cleanup items in the notice include blocking outgoing connections to rank1cdn[.]com, deleting a wp_options entry with one of three listed names, removing unknown administrator accounts whose usernames begin with wpsupport_ or whose email addresses end in @wp-mail[.]net, removing a file at wp-includes/class-wp-cache-util.php that Rank Math says is not a legitimate WordPress file, and removing system scheduled tasks tagged #ms6v46. Wordfence, a WordPress security firm, points out that installing 3.0.124 swaps out the plugin but leaves behind anything the malware already planted. On October 19, Wordfence assigned and published CVE-2026-111862 for the incident, rated 9.8 Critical.
What it means for you: No phishing email or shady download was involved here: the malware arrived through Rank Math’s own download and update channel, so a site that took the 3.0.123 update during those roughly 11 hours could be affected. If an agency built your site, ask them whether it runs Rank Math PRO.
Three things to do this week. First, for every WordPress site you own, find out whether it runs Rank Math PRO and when version 3.0.123 was downloaded or installed. Wordfence notes that the version number alone does not prove a compromise, because Rank Math limits the incident to copies obtained during the window. Second, if an affected copy was activated, follow Rank Math’s recovery order. Its recommended route is restoring the site and its database from a backup made before 20:02 UTC on October 15, then scanning. Without one, first delete the whole rank-math-pro folder (deactivating is not enough), delete the listed wp_options entry and block rank1cdn[.]com if you can, and only then hunt for other changes, or the backdoor can come back. If a copy was installed but never activated, delete it, install 3.0.124 and run a scan.
Third, change every credential the site could reach, even after a restore: WordPress passwords, the database password and security keys in wp-config.php, payment, email and other API keys, and hosting, FTP and SSH logins. Get 3.0.124 by signing in at rankmath.com yourself. Rank Math says it never sends login or download links by email, so treat any unsolicited email with a login, password-reset or download link as suspicious. If the site takes payments or collects client information, our advice is to keep a copy of the compromised site before restoring it and to bring in whoever makes your breach-notification decisions.
BeyondTrust says attackers exploited a Remote Support flaw as a zero-day, and CISA lists it as exploited — self-hosted appliances need the BT26-05 patch now
On October 15, 2026, BeyondTrust published security advisory BT26-05 for CVE-2026-102764, a flaw in its Remote Support product, which Google notes was formerly called Bomgar. BeyondTrust rates it Critical, scoring it 9.3 under CVSS v4.0, and says an internal messaging component did not adequately validate where messages came from, which a remote attacker could abuse to carry out file operations on an appliance. The advisory lists all Remote Support versions up to and including 26.2.3 as affected. The fix is the BT26-05-RS patch for versions 24.3.1 through 26.2.3, and customers on a version older than 24.3.1 must upgrade before they can apply it.
BeyondTrust says the flaw was exploited as a zero-day on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance, and that all Remote Support SaaS customers had the patch applied as of October 9. Google’s Mandiant attributes the activity to a suspected China-nexus espionage actor it calls ARMORY CASTLE, formerly tracked as UNC5221. BeyondTrust says it has also released the patch for Privileged Remote Access, which shares the affected code, although its own testing has not found a way to exploit the flaw in that product. On October 16, CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog with a remediation due date of October 19 for federal agencies.
What it means for you: If your IT provider, a vendor or your own help desk uses BeyondTrust Remote Support (formerly Bomgar) to take control of your computers, this matters even if you never log in to it yourself. A remote-support appliance holds the keys to every machine it can reach. BeyondTrust says the attackers took full administrative control within minutes, read the appliance’s stored credentials and deleted logs before leaving, and that once a flaw becomes public this actor usually turns to mass exploitation of any appliance left unpatched. BeyondTrust has already patched its cloud-hosted customers; self-hosted appliances are the concern.
Four things to do this week. First, ask every vendor and IT provider with remote access to your systems which remote-support tool they use. If it is a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance, get written confirmation that the BT26-05 patch is installed, and when. Second, if you run the appliance yourself, apply the patch now, upgrading Remote Support first if it is older than 24.3.1, and restrict its administrative interface to trusted networks.
Third, look for signs the appliance was used against you: privileged or administrative sessions from home-broadband or commercial VPN addresses nobody recognizes, unknown script files in web folders, and permission changes nobody requested. Because the attackers delete local logs, the logs that count are the ones forwarded off the appliance. Fourth, if anything looks wrong, treat every credential the appliance stored as exposed: image the appliance before rebuilding it, rotate those passwords, and review new multi-factor registrations on admin accounts. BeyondTrust asks anyone who finds evidence of exploitation to open a Sev 1 support request citing BT26-05.
CISA now lists the Atlassian Data Center file-read flaw as exploited — patch self-hosted Jira, Confluence and Bitbucket, then check the logs
On October 15, 2026, CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog, with a remediation due date of October 18 for federal agencies. Atlassian disclosed the flaw on October 5 and rates it Critical, scoring it 9.3 under CVSS v4.0. It lets an unauthenticated attacker read specific files within the web application root directory of a self-hosted server. Atlassian says the attacker must already know a file’s exact name and path, and that in some configurations sensitive files may be present that increase the risk.
The affected products are Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. Atlassian’s advisory, last modified October 5, lists these fixed versions: Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12; Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12; Bamboo Data Center 10.2.24 and 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; Crucible 4.9.15; and Fisheye 4.9.15. Atlassian says its affected Cloud products have been patched and its investigation found no evidence of exploitation there.
What it means for you: We covered this flaw on October 6, when CISA had not listed it as exploited. That has changed. For any organization that runs Jira, Confluence, Bitbucket or another listed product on its own server, the question is no longer only whether to patch, but whether someone read files before you did. Atlassian Cloud customers have nothing to do.
Three things this week. First, confirm every self-hosted Atlassian server is on a fixed version listed above or later, including test servers, the old wiki and any Bitbucket mirrors. If one cannot be upgraded right away, Atlassian says to take it off the internet until it is patched or one of the temporary mitigations in its advisory is in place, and, if you use its firewall rule, to test that the rule actually blocks the attack pattern. Second, because Atlassian cannot confirm whether self-hosted instances have been affected, have your IT provider search the access logs as far back as they go for requests where .. sits next to a slash, a backslash or ::, after URL-decoding each line up to twice, as the advisory describes.
Third, if that search finds hits, assume any file in the application’s web folder could have been read. Find out what lives there, such as configuration files, keys or exported data, and rotate any passwords or keys those files held. If you are a defense supplier and the server holds controlled technical data, bring in whoever handles your incident reporting.
Drupal patches a critical code-execution flaw in core’s Field UI, and some add-on modules expose it without a login — update to 11.4.10, 11.3.19 or 10.6.19
On October 14, 2026, the Drupal Security Team published advisory SA-CORE-2026-014 for CVE-2026-108097, a remote code execution flaw in the Field UI module of Drupal core, rated Critical with a score of 19 on Drupal’s 25-point risk calculator. Drupal says the flaw cannot be exploited through core alone, but that contributed modules open “multiple serious exploit paths,” at least one of which requires no authentication, and that custom code may also expose it. Two days earlier, in PSA-2026-10-12, the Security Team pre-announced the upcoming release and urged sites to reserve time for updates because “exploits might be developed within hours or days.”
The advisory lists the affected versions as 8.9.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. The fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19. Branches that Drupal lists as end-of-life get no fix: Drupal 11.2.x and earlier, 10.5.x and earlier, and Drupal 8 and 9. Drupal says uninstalling the core Field UI module (field_ui) mitigates the flaw while sites are updated, and that its Drupal Steward service already protects against some known attack vectors but not all of them. Drupal’s risk score marks exploitation as theoretical, and as of CISA’s most recent catalog release on October 14, CVE-2026-108097 is not in the Known Exploited Vulnerabilities catalog.
What it means for you: This story is for any organization whose website, portal or intranet runs on Drupal. If you are not sure what your site is built on, ask whoever built or hosts it; it is a one-line answer, and it is worth getting even if you think the answer is no.
Three things to do this week. First, find every Drupal site you own, including old event, grant or member sites, and confirm each one is on the fixed release for its branch: 11.4.10, 11.3.19 or 10.6.19. Second, if a site cannot be updated this week, ask your web developer about uninstalling the Field UI module, which Drupal names as the mitigation until the update is done. Third, a site on Drupal 11.2 or earlier, 10.5 or earlier, or Drupal 8 or 9 is end-of-life and gets no fix. It has to be moved to a supported release; until then, uninstalling Field UI is the only mitigation Drupal names, and our advice is to treat the site as exposed.
Drupal has not said this flaw is being exploited, and CISA has not listed it. But the Security Team itself warned that exploits might follow within hours or days of the release. A public website that can be made to run an attacker’s code can serve malware or phishing pages under your name, so this does not belong in the next quarterly maintenance window.
CISA lists two exploited AhsayCBS backup-server flaws and Ahsay reports break-ins — the first fix fell short, so apply the new hotfix and check for compromise
On October 14, 2026, CISA added two AhsayCBS flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-105133, an improper authentication flaw that CISA says could let a remote attacker bypass authentication, and CVE-2026-105134, a command injection flaw that could let a remote attacker run operating system commands. CISA says the two can be chained and set a remediation due date of October 17 for federal agencies. Ahsay’s announcements are addressed to its partners, who run AhsayCBS backup servers that hold their customers’ data.
Ahsay says partners began reporting unauthorized access to their AhsayCBS servers on October 9. On October 10 it said its earlier patch, v10.3.4.0, did not fully address the two flaws and released hotfix v10.3.4.45. On October 12 it released hotfix v9.15.2.70 for v9, said partners on v8 and v7 should upgrade to v9.15.0.0 and then apply it, and said the earlier v9.15.2.59 and v10.3.4.0 patches did not fully address the flaws. Ahsay says v10.3.4.45 and v9.15.2.70 fully address both CVEs. On October 13 it listed signs of compromise, including unexpected folders such as ahsay_ts on the root of drives, randomly named .jsp files in the %CBS%\webapps folder, unauthorized RPS receivers, and unauthorized AhsayCBS accounts with Admin privilege, and recommended a full rebuild of any affected server.
What it means for you: If you do not run AhsayCBS yourself, a backup provider or IT firm may run it for you, and that is what makes this serious. A backup server holds copies of many customers’ data, and it is what you are counting on to recover from ransomware.
This week, ask whoever handles your offsite backup, in writing: do you run AhsayCBS anywhere in the chain that stores our data; have you applied hotfix v10.3.4.45 or v9.15.2.70 and rebooted; and did you check for Ahsay’s signs of compromise, and what did you find? A provider that stopped at v10.3.4.0 or v9.15.2.59 is not done. If they found signs of compromise, Ahsay strongly recommends a full rebuild of the server, so ask what data was on it and when your backups were last test-restored.
If you run AhsayCBS yourself, apply the hotfix for your version and reboot today; Ahsay’s October 13 update says v7 and v8 servers must first upgrade to v9.15.0.0. Check for the folders, .jsp files, unknown RPS receivers and admin accounts Ahsay lists. For a compromised server, Ahsay’s steps are to reinstall the operating system, install v9.15.0.0 or v10.3.4.0 plus the hotfix, and restore the configuration from an Auto Save at least one day older than the first suspicious files. Either way, confirm you have at least one recent backup copy the backup server cannot change or delete, and test a restore.
Palo Alto Networks and CISA flag an exploited flaw in the PAN-OS firewall management interface — upgrade and lock down admin access this week
On October 14, 2026, Palo Alto Networks published an advisory for CVE-2026-0322, a remote code execution flaw in the management interface of its PAN-OS firewall software. Palo Alto says an attacker who is logged in and can reach the management interface can use it to run code as root on the firewall. It rates the flaw 8.6 (High) with a suggested urgency of Highest, and says it has observed “very limited exploitation” aimed at the management interface. It applies to PA-Series and VM-Series firewalls and to Panorama; Cloud NGFW and Prisma Access are not affected. The same day, CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog with a remediation due date of October 17 for federal agencies.
Palo Alto’s fixed versions, by release line (its table shows which applies to your exact minor version): 12.2.4; 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16 (released October 15); 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3; and 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12. Older unsupported versions must move to a supported fixed version. Palo Alto says no known workarounds exist, that Threat Prevention Threat IDs 510046 and 510047 give only limited coverage and require decrypting management traffic, and that risk is highest when the management interface is reachable from the internet. It lists three IP addresses tied to exploit attempts.
What it means for you: A firewall is the last device you want an attacker running code on as root. The attacker needs a valid login (Palo Alto rates the required privileges as high) and network access to the management interface, so both the software and that access need attention. Take three steps.
First, upgrade as soon as possible to the fixed release for your exact version in Palo Alto’s table, and include Panorama if you use it. If you are on 11.2.14 or 11.2.15, the fix is 11.2.16, which Palo Alto published on October 15; until it is installed, restricting management access is the main protection. If you are on an unsupported version, there is no patch for you; plan the move to a supported release now.
Second, make sure the management interface cannot be reached from the internet. Palo Alto recommends allowing it only from trusted internal IP addresses and says limiting it to a single jump box reduces risk. We also recommend reviewing firewall admin accounts, removing any you do not recognize, changing the passwords on the rest, and requiring multifactor sign-in for admins if it is not already on.
Third, have your IT provider search firewall and management logs for the three IP addresses in Palo Alto’s advisory. If an outside provider manages your firewall, ask them in writing which PAN-OS version you run, when it was upgraded, and whether the management page is reachable from the internet.
Microsoft disrupts a phishing supply shop that hijacked Microsoft 365 tenants and resold them — nonprofits should check admin accounts and apps this week
On October 14, 2026, Microsoft said that it and Health-ISAC, with an order from the U.S. District Court for the Southern District of Florida, had seized and redirected domains behind three parts of a Chinese-language cybercrime marketplace: YAM Store, CoGUI and Iron Man. Microsoft says the three services enabled more than one billion malicious messages since January 2026, aimed at more than 75,000 organizations worldwide and used against consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries. Microsoft says it has disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
Microsoft Threat Intelligence tracks YAM Store as Storm-3119 and describes it as an access broker: it takes over Microsoft 365 and Azure for Education tenants and sells the accounts, licenses and storage to other criminals, offering stock by organization type, such as .edu or .org. Microsoft says the operators sign in to a compromised Global Administrator account, add the PnP Management Shell service principal to the tenant, grant it broad Microsoft Graph permissions including read and write access to directory data, and use the tenant’s SharePoint and OneDrive as bulk hosting. Microsoft also says that in some cases the operators acquired domains that legitimate organizations, often nonprofits and schools, had let expire, and rebuilt the websites to make those organizations look active so they could obtain Microsoft 365 accounts.
Criminals using the marketplace’s phishing kits, whose developers Microsoft tracks as Storm-2990, sent email and text lures about unpaid tolls and traffic citations, and in some cases abused device code sign-in to obtain access tokens.
What it means for you: The disruption removes one supplier, not the tactics, and Microsoft says the attacks these tools enable could affect any organization. What should catch a small organization’s attention is the business model. A nonprofit or school tenant with a weakly protected Global Administrator is not only a data-breach risk; it is stock on a shelf. Once inside, the attackers add their own app with directory-wide permissions, and Microsoft says that app-level access is more durable and harder to detect than access tied to a single user session.
Four things to do this week. First, have whoever runs your Microsoft 365 open Enterprise applications in Entra ID and look for apps nobody on your side added, especially one named PnP Management Shell, and for any app holding directory write permissions. That tool has legitimate uses, so finding it is a reason to ask questions, not proof of a break-in, but remove what nobody can explain. Second, list your Global Administrators, keep the list as short as possible, and require phishing-resistant sign-in such as passkeys for them through Conditional Access, as Microsoft recommends. Third, allow new MFA and passkey registrations only from trusted locations or devices, another Microsoft recommendation. Fourth, check when your domain names renew and turn on auto-renew, including old names you no longer use, because Microsoft says some expired domains were bought and rebuilt to make the old organization look active so criminals could obtain Microsoft 365 accounts in its name.
For staff, a text about an unpaid toll or a traffic ticket is a scam until proven otherwise. Go to the agency’s website yourself; never use the link.
Microsoft and CISA say attackers are exploiting a Windows flaw that removes the warning on files from the internet — install October’s update this week
On October 13, 2026, Microsoft released its October security updates, including a fix for CVE-2026-96951, which it calls a Windows Shell Security Feature Bypass Vulnerability. Microsoft describes it as improper neutralization of special elements used in a command (‘command injection’) in Windows Shell that allows an unauthorized attacker to bypass a security feature over a network, and says a successful attacker could evade Mark of the Web (MOTW) defenses. Microsoft rates it Important, with a CVSS score of 8.8, and marks it as exploited (Exploitation Detected). The same day, CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog, with a remediation due date of October 16 for federal agencies. Microsoft’s advisory does not say who is exploiting it or how widely.
Microsoft describes an email or instant message attack scenario in which the attacker sends the target a specially crafted file, and says the attacker has to convince the user to act, for example by enticing the user to click a link to the attacker’s site or by sending a malicious attachment. Microsoft lists Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025 as affected. Its list also includes Outlook.com, for which it shows a release-notes entry rather than a Windows update. The fixes include KB5127648 for Windows 11 24H2, 25H2 and 26H2, KB5127646 for 26H1, KB5126653 for 23H2, KB5126657 for Windows 10 21H2 and 22H2, KB5126868 for Windows 10 1607, KB5126651 for Windows 10 1809, KB5126646 for Windows Server 2025, KB5126655 for Server 2022, KB5126651 for Server 2019, KB5126868 for Server 2016 and KB5126836 for Server 2012 R2.
What it means for you: Mark of the Web is the label Windows puts on files that arrive from the internet or by email. It is what makes Windows ask before running a downloaded file and what makes Office open an emailed document in Protected View. A flaw that lets an attacker get around that protection removes the warning that would otherwise make someone stop and think before opening a booby-trapped file, and Microsoft and CISA both say it is being used now. It is the kind of flaw that works against small offices, because it targets the person reading email.
Three things to do this week. First, install the October 13 update on every Windows PC and server and restart, then have whoever manages your computers show you a report of which machines have it. Laptops that stay asleep or off the network are the usual gaps. Second, check the stragglers: Microsoft says Windows 11 24H2 Home and Pro reached end of updates on October 13, so install this update and then move those PCs to 25H2. Windows 10 Home and Pro support ended in October 2025, so those PCs get this fix only if they run 22H2 and are enrolled in Extended Security Updates. Third, because the attack starts with a file sent by email or chat, remind staff this week not to open unexpected attachments or files from links, even from known senders, and ask your email provider or IT team whether risky attachment types are blocked before they reach inboxes.
Attackers are exploiting an Ivanti Connect Secure VPN flaw that needs no login, Ivanti and CISA say — upgrade, then check for compromise
On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935 in Ivanti Connect Secure (ICS), its remote-access VPN. Ivanti describes it as an authentication bypass by spoofing that allows a remote unauthenticated attacker to execute arbitrary commands, scores it 8.6 (High), and says it is aware of exploitation in the wild affecting a limited number of customers at the time of disclosure. The same day, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog with a remediation due date of October 16 for federal agencies.
Ivanti lists as affected ICS 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and lists 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5 as resolved versions. It says ICS 22.7R2.14 and prior are not affected. Ivanti notes that moving to 25.1.3.0 requires the newer ISA4500, ISA6500 or ISA8500 platform, or a new virtual or cloud device built from the 25.1.3.0 template, and that the 22.7 and 22.8 lines reach end of life on January 31, 2027.
Volexity, which Ivanti credits, reports that a group it tracks as UTA0576 exploited the flaw starting October 3, 2026, chained with a separate privilege escalation flaw. Ivanti’s October 29 update to the advisory lists that flaw as CVE-2026-111357, together with a third chained flaw, CVE-2026-118527, and resolves both in 25.1.1.3 and 22.8R2.6. Volexity says the attackers extracted stored credentials such as LDAP domain credentials, searched Active Directory for LAPS local administrator passwords and BitLocker recovery keys, and tampered with logs, and that Ivanti’s Integrity Checker Tool did not detect the compromise.
What it means for you: If your business, or the provider that runs your remote access, uses an Ivanti Connect Secure VPN, treat this as today’s job. Ivanti says it has been exploited, CISA lists it as exploited, it needs no password, and the activity Volexity describes runs straight from the VPN box into the Windows domain behind it: stealing domain credentials and searching for local administrator passwords and BitLocker disk-encryption recovery keys.
First, upgrade to a version that resolves all three chained flaws: 25.1.1.3, 25.1.3.0 or later, or 22.8R2.6 if you cannot leave 22.8 yet. After Ivanti’s October 29 update, 25.1.1.2 and 22.8R2.5 are no longer enough. Check Ivanti’s advisory for the right path from your exact version, and remember that 25.1.3.0 needs newer hardware or a rebuilt virtual appliance, so that path may take longer than a normal patch window. Upgrading does not undo a break-in that happened first, so do not skip the next step.
Second, do not take a clean Integrity Checker result as proof you are fine, because Volexity says it missed this compromise. Review VPN logs at least back to October 3 against Volexity’s indicators, including large numbers of requests to /dana-na/auth/url_default/welcome.cgi, keeping in mind that the attackers tampered with logs. If anything looks wrong, treat it as an incident: follow Ivanti’s recovery steps, reset the directory account the VPN uses to look up users, and rotate local administrator passwords and BitLocker recovery keys.
Third, if you are on 22.7 or 22.8, put the move to 25.1 on the calendar now; Ivanti ends support for both lines on January 31, 2027. If an outside provider manages your VPN, ask them in writing which version you are on, when it was upgraded, and what the compromise check found.
GitLab ships a critical fix for a CVSS 10.0 flaw that could let an attacker with no login run code on self-managed servers — upgrade now
On October 12, 2026, GitLab released a critical patch release, versions 19.4.2, 19.3.5 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The most serious fix is CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that GitLab rates Critical, with a CVSS score of 10.0. GitLab says that, under certain conditions, it could have allowed an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
GitLab lists the affected versions as all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The same release fixes other security issues, five of which GitLab rates High, and all five of those also affect versions older than 19.2.
GitLab strongly recommends that all self-managed installations be upgraded to one of these versions immediately. It says GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. GitLab’s release notes do not say the flaw has been exploited, and as of CISA’s most recent catalog release on October 8, CVE-2026-97229 is not in the Known Exploited Vulnerabilities catalog. GitLab also notes that the patch includes database migrations: single-node instances will have downtime during the upgrade because the migrations must complete before GitLab can start, while multi-node instances can be upgraded without downtime using its zero-downtime procedure. GitLab later updated the release to 19.3.5, saying 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled.
What it means for you: If your company uses GitLab.com or GitLab Dedicated, there is nothing for you to do. This story is for organizations that run GitLab on their own servers, such as software teams, engineering firms, manufacturers and defense suppliers that keep source code and technical data in-house. A flaw that could let someone with no login run code on the server is the worst kind for a system that holds your source code and the keys your build pipelines use.
Three things to do now. First, find every self-managed GitLab server you run, including test or old instances, and confirm its version. Second, upgrade each one to 19.4.2, 19.3.5 or 19.2.8, or later, and book an outage window for single-node servers, since GitLab says they will be down while the database migrations run. GitLab released fixes only for 19.2, 19.3 and 19.4. A server on an older release is not affected by the critical flaw, but it is affected by at least one of the High-rated ones, and the only way to get those fixes is to upgrade to one of these versions.
Third, if a server is reachable from the internet and cannot be upgraded this week, our advice is to limit who can reach it, for example to your office network or VPN, until it is. That is not a GitLab mitigation; GitLab’s release notes give no workaround, so the upgrade is the fix. GitLab has not said this flaw is being exploited, and it is not in CISA’s catalog. But CISA did add a different GitLab flaw, CVE-2026-85706, to that catalog on September 11, and a flaw that could allow code execution with no login on an internet-facing server is not something to leave for the next maintenance window.
Windows 11 version 24H2 Home and Pro stop getting security updates after October 13 — 23H2 Enterprise and Education follow on November 10
Microsoft says Windows 11, version 24H2 Home and Pro editions reach end of updates on October 13, 2026. After that date, devices running those editions no longer receive monthly security updates. Microsoft recommends updating them to Windows 11, version 25H2. The Enterprise and Education editions of version 24H2 are not affected by this date and remain supported until October 2027.
In a separate 30-day reminder posted October 9, 2026, Microsoft said Windows 11, version 23H2 Enterprise and Education editions reach end of updates on November 10, 2026, and that the November 2026 security update will be the last one available for those editions. Version 23H2 Home and Pro already stopped receiving updates in November 2025. Microsoft’s lifecycle pages list version 25H2 as supported until October 2027 for Home and Pro, and until October 2028 for Enterprise and Education.
What it means for you: Many small-business PCs run Pro, so October 13 is the date that matters here. A PC left on 24H2 stops getting fixes, and next month’s patches will not reach it. The machines most likely to be stuck are the ones someone held back on purpose, with an update deferral, a version pin or a worry about one program, and then forgot.
This week, have whoever manages your computers pull one list: every Windows 11 PC, its edition and its version. On a single machine, Start > Settings > System > About lists the Edition and Version. Any Home or Pro PC on 24H2 should move to 25H2 now. If you are unsure whether a line-of-business program supports it, check with that vendor this week, but do not let the check drag into November. Any Enterprise or Education PC still on 23H2 has until November 10. If your PCs are managed through Intune, Group Policy or another update tool, ask your IT provider to confirm that no deferral or version setting is holding machines on the older release.
Windows Update certificates expire in May and June 2027 — PCs and servers without the replacement certificates will stop getting updates from Windows Update
Microsoft announced on October 8, 2026 that a set of certificates Windows devices use to confirm they are talking to the real Windows Update servers will expire on May 17, 2027 and June 19, 2027. Devices must have the replacement certificates to keep receiving updates after the date that applies to them. Microsoft says devices without them will lose access to Windows Update and stop receiving all types of updates from it. Microsoft is delivering the replacement certificates for most devices through normal monthly updates, and says most devices running an in-support version of Windows that are current with monthly updates need no action.
Microsoft’s list: Windows 11, version 25H2 and later need nothing. Windows 11, version 24H2 and Windows Server 2025 need the September 2025 security update or later before June 19, 2027. Other in-support versions of Windows 11, Windows Server 2022 and in-support versions of Windows 10 need the July 2026 security update or later before June 19, 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 security update or later before May 17, 2027. For any other Windows version, Microsoft says to upgrade to a supported version of Windows client or Windows Server, because out-of-support devices will lose access to Windows Update. Microsoft says the change does not apply to devices that receive updates from Windows Server Update Services (WSUS).
What it means for you: This is not an attack, and nothing breaks this year. It is a hard stop with a date on it. It lands on exactly the machines small businesses forget: the server in the back room still running Windows Server 2016 or 2019 without recent updates, the front-desk PC that has not finished an update in months, and the computer kept on an old version of Windows because one program needs it. Those servers have the earlier deadline, May 17, 2027. A device that misses its date may not fail loudly. It simply stops getting fixes from Windows Update, and an unpatched machine nobody is watching is what attackers look for.
This week, ask whoever manages your computers for one list: every Windows PC and server, its version, and the date of its last security update. Microsoft’s own plan is the right one: find devices on older or unsupported versions, keep supported devices current with monthly updates, and plan upgrades for unsupported devices before May and June 2027. Anything supported but behind can be brought current now, from Microsoft Update Catalog or your normal management tools. Anything on a version Microsoft no longer supports needs an upgrade or replacement, with a budget line, well before May. If your updates come through WSUS, ask your IT provider to confirm how this applies to you, since Microsoft’s notice says the change does not apply to devices receiving updates from WSUS.
Citrix fixes a critical new NetScaler flaw — appliances that act as a SAML sign-in provider need another upgrade, even after the October 3 fix
On October 8, 2026, Citrix published security bulletin CTX697191 for CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that Citrix says may lead to remote code execution or denial of service. Citrix rates the bulletin Critical and scores the flaw 9.5 under CVSS v4.0. In a companion blog post, Citrix says that as of the bulletin’s publication it is not aware of any unmitigated exploits of this vulnerability.
Whether an appliance is affected depends on its build and its SAML role. On NetScaler ADC and NetScaler Gateway builds between 14.1-73.37 and 14.1-73.41, inclusive, and between 13.1-64.23 and 13.1-64.28, inclusive, which include the fixed builds from Citrix’s September 27 and October 3 bulletins, the flaw applies only when the appliance is configured as a SAML identity provider (IdP). On builds before 14.1-73.37 and before 13.1-64.23, it applies when the appliance is configured as a SAML service provider (SP) or a SAML IdP. For 14.1-FIPS the same build numbers apply; for 13.1-FIPS and 13.1-NDcPP, builds 13.1-37.279 through 13.1-37.282 are affected only as a SAML IdP, and earlier builds as a SAML SP or IdP.
Citrix’s fixed versions are 14.1-73.46 and later, 13.1-64.29 and later, 14.1-73.46 FIPS and later, and 13.1-37.283 and later of 13.1-FIPS and 13.1-NDcPP. Secure Private Access hybrid deployments using NetScaler instances are also affected. The bulletin applies to customer-managed appliances; Cloud Software Group says it upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself.
What it means for you: This is the third NetScaler bulletin in two weeks, and it changes the advice in our October 4 story, which said appliances using SAML should move to 14.1-73.41 or 13.1-64.28. Those builds are still affected by this new flaw if the appliance acts as a SAML identity provider, meaning it is the system that signs staff in to other applications. Citrix says it is not aware of any unmitigated exploits, but CISA lists flaws from both earlier NetScaler bulletins as exploited, so plan this upgrade for this week rather than the next maintenance window.
Three things to do. First, run Citrix’s own check: search the NetScaler configuration for add authentication samlIdPProfile (a SAML IdP) or add authentication samlAction (a SAML SP). Second, upgrade to 14.1-73.46 or later, 13.1-64.29 or later, or the FIPS and NDcPP builds Citrix lists if the appliance has the samlIdPProfile entry and runs a build up to 14.1-73.41 or 13.1-64.28, or has either entry and runs a build before 14.1-73.37 or 13.1-64.23. Third, if any appliance is still below 14.1-73.37 or 13.1-64.23, it also missed the September 27 fix for flaws CISA lists as exploited; check it for compromise before upgrading, as our September 27 story describes.
Citrix lists fixes only for the supported 14.1 and 13.1 lines. If an outside provider runs your NetScaler, get the build number and its SAML role in writing.
FBI, CISA and NSA say China-linked hackers are spraying passwords at Microsoft 365 email and reusing old server flaws — check MFA and mailbox apps this week
On October 8, 2026, the FBI, CISA and NSA, with security agencies in the United Kingdom, Australia, Canada, Japan, New Zealand and Spain, published joint advisory AA26-281A. Drawing on multiple FBI investigations, it says hackers enabled by Integrity Technology Group, which the advisory describes as a China-based company with links to the Chinese government, have targeted US government, critical manufacturing, healthcare and information technology organizations, as well as law enforcement, education and religious organizations.
The advisory says the actors use a tool called EBurst to spray and guess passwords against Microsoft 365 and Exchange email accounts through Outlook Web Access, Exchange Web Services, ActiveSync, Autodiscover and other mail interfaces. They keep access by installing the legitimate SoftEther VPN client, whose installers they often name conhost.exe or dllhost.exe, use a tool called DC.exe to copy Active Directory credentials with a technique called DCSync, and use a tool called office-cli, fed with a client ID, tenant ID and secret, to keep pulling mail from Outlook 365 accounts.
The advisory lists eight older flaws as successfully exploited. CISA added five of them to its Known Exploited Vulnerabilities catalog the same day: ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199 and Strapi CVE-2023-22894. The other three, in GNU Bash, Pulse Connect Secure and GitLab, were already listed.
What it means for you: Few small offices run these old servers, but nearly all of them run Microsoft 365 email, and much of the advisory’s technical detail concerns email. Password spraying works against any account that still accepts a password alone.
Four things to do this week. First, confirm that every mailbox requires MFA, including shared, service and former-staff accounts, and that sign-ins using legacy authentication are blocked; if you still run Exchange on your own server, find out which of the interfaces named above can be reached from the internet. Second, review the apps registered in Microsoft Entra that can read mail or hold a client secret, and remove any nobody can explain. Third, ask whoever manages your computers to search for SoftEther, or for conhost.exe or dllhost.exe running from an unusual folder, and to watch for Active Directory replication requests that do not come from a domain controller. Fourth, ask whether you host anything running ProFTPD, BIND, Struts, ONLYOFFICE, Strapi or GitLab, often an old web or file server someone set up and forgot, or an old Pulse Connect Secure VPN, and patch or retire it.
The advisory’s list of indicators reaches back to 2016, and the agencies say to vet them before blocking anything.
The FBI and Secret Service say FortiBleed is still targeting FortiGate firewalls with stolen passwords — reset them and add MFA this week
On October 6, 2026, the FBI and the U.S. Secret Service issued an advisory warning that FortiBleed, an active, global campaign to steal and abuse login credentials, is still targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The agencies say attackers are continuing to scan exposed Fortinet firewalls with credentials obtained earlier, and that the campaign takes advantage of reused or leaked passwords and of legacy SHA-256 password storage, which lets attackers harvest and crack credentials at scale. The advisory says SOCRadar has verified more than 86,644 compromised devices in 194 countries.
According to the advisory, attackers who get in create new administrator accounts to keep their access and then move into the internal network. The advisory lists account names commonly found on victim systems after an intrusion, including fortiAdmin, forticloud-sync, adminsslvpn and support_fortinet. The agencies have received reports of organizations locked out of their own devices after attackers disabled or deleted accounts or changed passwords. The agencies say initial access brokers using this attack chain have passed access to ransomware affiliates, currently including INC/Lynx and Payload.
Fortinet said on June 19 that this is not a new Fortinet vulnerability. It attributes the activity to credentials reused from earlier incidents and to brute-force attacks against devices with weak passwords and no multifactor authentication (MFA), and it recommends upgrading to the latest 7.4, 7.6 or 8.0 releases, which support PBKDF2 hashing of administrator credentials.
What it means for you: FortiGate firewalls are widely used in small and midsize offices, and this campaign does not need a software flaw. It needs a reused, leaked or weak password and a login page facing the internet. If your firewall’s admin page or VPN can be reached from outside and nobody has changed those passwords since June, assume someone has tried them.
Four things to do this week, in this order. First, take the firewall’s management page off the internet, or limit it to trusted addresses; the agencies call removing internet administration the best option. Second, end all active admin and VPN sessions and reset every admin and VPN password. Third, require phishing-resistant MFA on every admin and remote-access account. Fourth, check the list of admin and VPN accounts for any name you do not recognize, compare the configuration with a known good copy, and remove any REST API keys you do not recognize and refresh the rest.
Then ask whoever manages the firewall which firmware version it runs and whether administrator passwords are stored with PBKDF2. Fortinet’s guidance is to upgrade to the latest 7.4, 7.6 or 8.0 release and remove the older legacy password settings. If you find an account nobody created, treat the firewall as compromised and check the internal network too, because the agencies say this access is being handed to ransomware groups. If the firewall is linked to Active Directory, Fortinet says to treat that linked account as compromised as well.
Attackers are using a Ninja Forms flaw to plant hidden admin accounts on WordPress sites — update to 3.15.4 or later, then check for intruders
On October 6, 2026, Patchstack, a WordPress security firm, reported that attackers are exploiting CVE-2026-94504 in Ninja Forms, a WordPress form plugin that WordPress.org lists with more than 500,000 active installations. The CVE record, published September 22 by Wordfence, describes a stored cross-site scripting flaw: a value submitted anonymously in a form’s text box is saved and later shown without safe encoding in the plugin’s legacy submission editor, so script planted by an attacker runs in the WordPress admin when an administrator opens that submission. The record lists Ninja Forms 3.15.3 and earlier as affected and rates the flaw 7.2, High. The plugin’s changelog shows that version 3.15.4, released September 21, strengthened output escaping in the admin submission edit screen, and Patchstack lists 3.15.4 as the fix.
Patchstack says it first saw the same campaign on October 4 against a second plugin, WPC Product Bundles for WooCommerce (CVE-2026-93836, all versions up to and including 8.6.6), and against Ninja Forms on October 5. Once the script runs in an administrator’s browser, Patchstack reports, it installs a fake plugin named WP Smart Thumbnails, creates two administrator accounts, one of them hidden from the Users screen, adds a secret login link that signs in as the site’s oldest administrator, and adds a file manager that needs no login. Patchstack names imgcdn1.com as the domain serving the script. Neither CVE is in CISA’s Known Exploited Vulnerabilities catalog as of its October 4 release.
What it means for you: If your website has a contact or quote-request form, it may run on Ninja Forms, and this attack is aimed at the person with full control of the site: whoever reads the form submissions. The attacker sends the payload through the public form, waits for an administrator to open it, and uses that moment to leave behind several ways back in, some of which do not show up in the WordPress dashboard.
Three things to do this week. First, check every WordPress site you own for Ninja Forms and update it to 3.15.4 or later; if a site runs a WooCommerce store with WPC Product Bundles, update that plugin to 8.6.7 or later too. Second, because the hidden account does not appear in the dashboard, have whoever manages the site check the database directly for administrator accounts, look in the plugins and mu-plugins folders for WP Smart Thumbnails or files nobody installed, and search the web server logs for imgcdn1.com and for wp-login.php requests containing _wplogin, the secret login link. Third, if you find any of it, treat the site as compromised: remove the files, the accounts and the database entries Patchstack lists, then change every administrator password and reset the WordPress security keys. Restoring from a backup you know predates the attack also works, but the passwords and keys still need changing.
If nobody can tell you who updates your website’s plugins, fix that first. This flaw was fixed two weeks before Patchstack first saw attacks on it.
A booby-trapped spreadsheet can run code in LibreOffice and Apache OpenOffice — update LibreOffice to its fixed version and OpenOffice to 4.1.17
On October 5, 2026, The Document Foundation published an advisory for CVE-2026-63277 in LibreOffice. A Calc spreadsheet can link a cell range to an outside data source, and the advisory says a document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location. The fix is in LibreOffice 26.2.5 and 26.8.0, and the project recommends that all users upgrade to LibreOffice 26.2.5 or later, or 26.8.0 or later. The CVE record rates the flaw 8.5, High, under CVSS v4.0.
On October 2, the Apache OpenOffice project disclosed the matching flaw in its own product, CVE-2026-59265, and rates it critical. Apache says a crafted untrusted document can run arbitrary, even remote, code when the user opens it, and that Apache OpenOffice 4.1.16 and earlier are affected. Apache’s advisory said the fix would come in version 4.1.17, and the project released 4.1.17 on October 14. For a copy that cannot be updated yet, Apache says disabling Java runtime integration in the Preferences dialog prevents the attack, and that users who cannot do that, or want an extra precaution, can avoid opening untrusted files entirely.
Rick de Jager of V12, one of the researchers both projects credit, has posted proof-of-concept files for LibreOffice and OpenOffice on V12’s GitHub page. No vendor, CISA or threat-intelligence firm has reported the flaws being used in attacks, CISA’s enrichment of both CVE records lists exploitation as none, and neither CVE is in CISA’s Known Exploited Vulnerabilities catalog as of its October 4 release.
What it means for you: Offices that run only Microsoft Office are not affected, but check for stray LibreOffice or OpenOffice installs before skipping this one. It matters to the nonprofits, small offices and public agencies that use LibreOffice or Apache OpenOffice to save on licenses, often on a few machines nobody tracks. The risk is the oldest one in email: an attachment that runs code simply by being opened.
Three things to do this week. First, find out where either program is installed, including any home computers staff use for work. Second, update LibreOffice to 26.2.5 or later, or 26.8.0 or later. Third, update Apache OpenOffice to 4.1.17, released October 14, the version Apache named for the fix; on any copy you cannot update yet, turn off Java runtime integration in its settings, which Apache says prevents the attack.
If OpenOffice is only there out of habit, consider replacing it with a suite that gets regular security updates; OpenOffice went almost a year between 4.1.16 (November 2025) and 4.1.17. No one has reported either flaw being used in attacks yet, but that is no reason to wait: working examples of the malicious file are already public.
Actively exploited right now — CISA’s Known Exploited Vulnerabilities
Flaws confirmed to be under real-world attack — not theoretical. When your software appears here, patching stops being routine maintenance and becomes urgent. Newest 15 entries; full catalog at CISA.
Source: CISA Known Exploited Vulnerabilities catalog (U.S. government, public domain). Feed refreshed Nov 11, 2026.
Added
Software
What it is
Used in ransomware?
Nov 10, 2026
Microsoft Office CVE-2026-124194 Common in small-business networks
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
None reported
Nov 10, 2026
Cisco BroadWorks CVE-2026-20320 Firewalls and remote access — check with whoever manages yours
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
None reported
Nov 10, 2026
Barracuda Networks Multiple Products CVE-2026-111560 Firewalls and remote access — check with whoever manages yours
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
None reported
Nov 10, 2026
Barracuda Networks Barracuda Email Security Gateway (ESG) CVE-2026-116606 Firewalls and remote access — check with whoever manages yours
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
None reported
Nov 6, 2026
SonicWall SonicOS SSLVPN CVE-2026-19868 Firewalls and remote access — check with whoever manages yours
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
None reported
Oct 30, 2026
Ivanti Connect Secure CVE-2026-118527 Firewalls and remote access — check with whoever manages yours
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
None reported
Oct 30, 2026
Ivanti Connect Secure CVE-2026-111357 Firewalls and remote access — check with whoever manages yours
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
None reported
Also added in this period, in systems far less common in small-business environments —
Openwave Messaging Limited Webtop Media Transcoder, Google Chromium, GPUStack, OpenBSD OpenSSH, SignalWire FreeSwitch, IBM Aspera Faspex, Apple Multiple Products, WordPress Core.
Listed for completeness; if you don’t run them, there is nothing here for you to do.
“None reported” means CISA has no record of this flaw being used in a ransomware campaign — it is not an all-clear, and it can change as investigations catch up.
Government data, republished as intended. The vulnerability and advisory lists come from CISA and NIST — U.S. government publications in the public domain (17 U.S.C. §105), published expressly for reuse. We reproduce them faithfully and link the originals.
News, in our own words. Curated stories are summaries we write ourselves from the underlying facts, always crediting and linking the original reporting. We never republish another outlet’s text — their reporting deserves the click.
Facts are stated as of the date shown. Vulnerability and deadline entries reflect the linked source at the time we recorded it. Vendors’ own advisories are the authoritative record, and a date that moves is the vendor’s to move — if you are acting on something here, click through and confirm the current position first.
Headlines are links, nothing more. The industry-headlines list carries each outlet’s title, date, and a link to their site — no excerpts, no copies. If a headline interests you, the click belongs to the people who reported it.
What this isn’t. A briefing, not incident response. If something on this page is happening to you right now, don’t read — call (949) 916-6444.
Want someone watching this for you?
Secure IT clients don’t read threat feeds — our 24/7 security operations coverage does it for them. See where your business stands, with the owner.
We use cookies to understand how visitors use our site (Google Analytics & Microsoft Clarity) — analytics only, never sold. No analytics load unless you accept. Privacy policy
AI answers can be imperfect — confirm anything important with us. Messages are processed by our AI provider to generate replies; questions are kept (without your identity) to improve answers. Please don’t include passwords or sensitive data.
