PHP2Shell now has a second stage. CISA added Fragnesia, a Linux kernel privilege escalation flaw, to its exploited list on October 28. Attackers are using it to turn a PHP2Shell foothold into root. Federal agencies have until October 31, two days from now.

1. Update the kernel on every Linux server that runs PHP, starting with internet-facing ones. Reboot into the new kernel.
2. Ask your firewall, VPN and appliance vendors whether their firmware is affected by CVE-2026-46300, and take management interfaces off the internet.
3. Confirm the PHP2Shell fixes are in place. The federal deadline for those is today.
4. For ConnectWise Cloud Backup, re-authorize Microsoft 365 tenants with the new app as ConnectWise instructs, and keep the old app connections disabled.

1. Update: Fragnesia lets PHP2Shell attackers become root

This follows the PHP2Shell items in the October 26 and October 27 briefings. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on October 28 (CISA alert). The catalog entry says it can be chained with CVE-2026-109618 and CVE-2026-109619 "to implant PHP webshells and run commands as root." The federal due date is October 31, and CISA flags it for forensic triage.

Fragnesia is a local privilege escalation in the kernel's XFRM ESP-in-TCP code. It lets a local user write into the in-memory copy of read-only files. The files on disk do not change, so a reboot erases both the change and the evidence. It was disclosed on oss-security on May 13, 2026, with a public exploit, and major distributions have shipped fixes since. The new part is confirmed use in attacks.

The attack chain comes from Dream Research's October 26 report. Dream says an operator it ties to China used a custom PHP2Shell exploit against the PHP-based management server on one vendor's firewalls. The operator then used Fragnesia to edit /etc/pam.d/su in memory so su root asked for no password. Dream counts 25 rooted systems: 24 firewalls and one internal firewall management server, including a US government-affiliated network. From that server the operator read an LDAP service account password and listed domain users and groups.

Dream does not name the firewall vendor and says the vendor has been notified. The claims have not been independently confirmed, and Dream published no IP addresses or hashes.

Who is exposed. Any client with a Linux server running PHP that has not had a kernel update since May: web servers, WordPress and Magento hosts, intranet apps and Nextcloud boxes. Also exposed are appliances built on Linux and PHP whose management page faces the internet. Ubuntu lists 20.04 and older as not affected on its standard kernels.

What to do.

• Update the kernel and reboot. Fixed Ubuntu packages are linux 7.0.0-22.22 (26.04), 6.8.0-124.124 (24.04) and 5.15.0-181.191 (22.04); cloud kernels have their own versions on the Ubuntu page. Debian fixed it in DSA-6306-1 (bookworm, 6.1.174-1) and DSA-6295-1 (trixie, 6.12.90-1), per the Debian tracker. For other distributions, check the vendor's tracker for CVE-2026-46300.
• Fragnesia is a separate bug from the earlier Dirty Frag flaws (CVE-2026-43284, CVE-2026-43500). A kernel patched for Dirty Frag is not proof of a Fragnesia fix. Check this CVE on its own.
• If you cannot reboot soon, Ubuntu's Dirty Frag mitigation applies: block the esp4 and esp6 modules. This breaks IPsec VPNs on that host, such as strongSwan.
• For firewalls and other appliances, the fix has to come from the vendor's firmware. Ask the vendor directly. Until then, restrict management access to a VPN or a short allow-list.
• Patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 to close the entry point. CISA's due date for both PHP2Shell CVEs is October 29.
• Look before you reboot a suspect host. A changed /etc/pam.d/su in memory disappears on reboot. Have your incident responder capture evidence first.
• Hunt on PHP hosts and appliances for small unexpected PHP files in web-readable folders, new systemd services or rc.local entries, and outbound SSH sessions you did not set up.
• If a firewall or management server was compromised, rotate any directory service accounts stored in its configuration. Then review Active Directory for new accounts and password spraying.

Quick hits

ConnectWise Cloud Backup restores have started. The October 28 update says phased restoration has begun with Microsoft 365, through a new app called ConnectWise Cloud Backup for M365. Partners must reset passwords, set up MFA if needed, and re-authorize each tenant with the new app. ConnectWise says not to re-enable previously disabled apps unless it tells you to. After re-authorizing, confirm new snapshots actually complete. No new indicators were published.

VMware ESX logging flaw is on the exploited list. CISA also added CVE-2026-41709 on October 28, with a November 11 federal due date. Broadcom rates it low (CVSS 2.7). It lets someone who already has admin access perform some operations without them being logged. It is fixed in builds ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, and in VCF 5.2.4, per VMSA-2026-0006. It does not let anyone in; it helps someone already inside avoid the logs. Patch at your next maintenance window, along with the vCenter fixes in the same advisory.

Sources

• CISA: two known exploited vulnerabilities added, October 28, 2026
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-46300
• oss-security: Fragnesia disclosure, May 13, 2026
• Dream Research: chained PHP2Shell exploit roots 25 servers
• Ubuntu: CVE-2026-46300
• Debian security tracker: CVE-2026-46300
• Ubuntu: Dirty Frag fixes and mitigation
• ConnectWise security advisories
• Broadcom VMSA-2026-0006

CISA added two flaws to its exploited list on October 27. One is the Brotli decoder bug covered here for the past week. The other is PolyShell, a file upload flaw in Adobe Commerce and Magento that a skimming crew has used against hundreds of stores.

1. Finish Brotli patching on Node.js, .NET, Python and Windows PHP, starting with internet-facing Express 5 apps. Restart every updated process.
2. Confirm every Adobe Commerce or Magento store you manage has Adobe's APSB26-73 fix. Then check its database and media folders for the indicators below, even if it is patched.
3. Keep ConnectWise Cloud Backup app connections disabled until ConnectWise sends restoration instructions.

1. Update: CISA adds the Brotli decoder flaw to its exploited list

This follows item 2 in the October 27 briefing. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27 (CISA alert). The catalog sets a November 10 due date for federal civilian agencies.

The evidence is still thin, but it is growing. Previdian's sensor page shows one exploitation attempt on October 27 from a US address. Previdian notes this does not show the target was vulnerable or that the attempt worked. ELLIO's analysis of the October 26 payload found it never reached code execution in 50 tries against a vulnerable Node.js 24.22.0 build. ELLIO calls it likely a "first-generation attempt". Expect better versions.

ELLIO also says the source address, 94.154.43[.]7, carries tags for PHP2Shell exploitation and GlobalProtect and FortiOS SSL VPN probing. If it shows up in your logs, check all three.

Who is exposed. Clients running custom web apps, portals or APIs on Node.js, ASP.NET Core or Python that decompress outside data. Sysdig's reachability table marks Express 5 with express.json() as reachable by default. Express 4 with body-parser 1.20.x rejects Brotli bodies, but other middleware or proxies in front of it may not. Sysdig also lists Koa body parsers and Fastify with @fastify/compress. Server-side fetch() decodes Brotli responses, so outbound calls to untrusted servers count too.

What to do.

• Update Node.js to 22.23.4, 24.22.1 or 26.12.1 (Node.js security release). Move end-of-life lines to a supported one.
• Install .NET 8.0.33, 9.0.22 or 10.0.14 and rebuild self-contained apps (.NET blog).
• Update the Python Brotli package to 1.2.1 and brotlicffi to 1.2.1.0. On Windows PHP hosts, install the -1 builds (php.net).
• Run node --version inside running containers, not only on the host image list. Restart and redeploy after updating.
• Watch web-facing Node.js processes for a crash followed by a shell or an unexpected outbound connection. A sensor will not see the overflow, only what follows it.
• The indicator table in the October 27 briefing still applies. ELLIO published no new indicators after October 26.

2. Adobe Commerce PolyShell is exploited and on the CISA list

CVE-2026-48356, known as PolyShell, is an unrestricted file upload flaw in Adobe Commerce and Magento Open Source. It can lead to code execution on the server. Adobe fixed it in security bulletin APSB26-73 in July 2026. CISA added it to the exploited catalog on October 27, also with a November 10 due date.

The main campaign is documented by Sansec, the researcher. Its October 24 report tracks one operator across 953 stores since July 2025. The operator uploaded webshells through PolyShell, then planted a JavaScript loader in Magento's cms_block table. In March, 471 stores were infected in one hour. The loader serves its payload only to real shoppers, which hides it from scanners. Sansec has not recovered the final payload, so the goal is unclear. The Hacker News reports that the campaign is ongoing.

Two details matter for cleanup. The loader can give the attacker write access to the database, and deleting the script does not remove it. And Sansec found the loader on a fully patched 2.4.7-p10 store after a clean scan. Patching closes the door. It does not evict someone already inside.

Who is exposed. Clients with a self-hosted Magento or Adobe Commerce store, including stores an agency built and nobody has updated since. Sansec found that 60% of Magento 2 installs missing a core patch also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).

What to do.

• Confirm APSB26-73 (PolyShell) and APSB25-88 (SessionReaper) are installed. Check the store's version in its admin panel against Adobe's bulletin.
• Search cms_block.content and cms_page for fpCode, se_referrer and localStorage.getItem. Include your table prefix. Check update_time for recent writes.
• Look for unexpected files in pub/media/custom_options/ and pub/media/customer_address/, and for accesson.php anywhere in the webroot.
• Review admin_user for accounts nobody recognizes.
• If you find the loader, remove it, remove webshells, and change database, admin and API integration passwords. Returning shoppers may keep running the payload from browser storage after you remove it.

Quick hits

ConnectWise Cloud Backup. Restoration is ready but waiting on a third-party validation, per the October 27 update. Backup restore access comes first, then full re-enrollment with instructions. ConnectWise lists no new indicators and says existing backup archives show no sign of compromise. Keep affected app connections disabled and keep reviewing client Microsoft 365 tenants.

Sources

• CISA: two known exploited vulnerabilities added, October 27, 2026
• CISA Known Exploited Vulnerabilities catalog
• Sansec: Magento CMS block loader campaign (deepveindrilling)
• The Hacker News: Adobe Commerce PolyShell attacks and Brotli exploit traffic
• Previdian: CVE-2026-111497 telemetry
• ELLIO: Node2Shell analysis and observed exploit traffic
• Sysdig: detecting the Node.js Brotli RCE
• Node.js October 2026 security releases
• .NET October 2026 out-of-band security updates
• PHP: updated Windows builds for Brotli security fix, October 26, 2026
• ConnectWise security advisories

Two items today. CISA now lists both PHP2Shell flaws as exploited, which ends any argument about priority. A Brotli decoder flaw that sits inside Node.js, .NET, Python and PHP for Windows picked up new patches over the weekend, and one sensor network reports exploit traffic.

1. Finish patching every PHP server to the October 21 releases. Federal agencies have until October 29; treat that as your deadline too.
2. Inventory Node.js, .NET and Python services that handle Brotli data, and update them to the fixed versions below. Restart them afterwards.
3. On Windows PHP servers, install the new -1 builds that bundle Brotli 1.2.1.

1. Update: CISA adds both PHP2Shell flaws to its exploited list

This follows item 1 in the October 26 briefing. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26 (CISA alert). The catalog sets a due date of October 29 for federal civilian agencies.

Nothing about the fix has changed. What has changed is the evidence. Until the weekend, every report described failed attempts. Adel Karimi's honeypots then recorded working code execution on October 24, as covered yesterday. The Hacker News reports that Karimi called his setup an intentionally favorable single-worker mod_php profile. So reliability on other configurations is not yet measured. Do not read that as a reason to wait.

Who is exposed. Any PHP site, hosting panel, intranet app or appliance on a build older than October 21. That includes vendor appliances that ship PHP inside. The Hacker News article links advisories from Synology, QNAP, NETGEAR, SonicWall, Veeam, Hikvision and dozens of others.

What to do.

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (php.net advisory). Restart PHP-FPM and Apache, then confirm the running version.
• Check each appliance vendor's PHP2Shell advisory for products you manage. Appliances will not pick up an OS package update.
• Keep session.upload_progress.enabled=0 set in php.ini or the FPM pool file. PHP says it must apply before request parsing, so ini_set() and .user.ini do not work. It is also the interim fix for CVE-2026-115560, which is still unpatched.
• Hunt for /bin/sh started by apache2, httpd or php-fpm. The indicator table in the October 26 briefing still applies; no new indicators were published in the last day.

2. Brotli decoder flaw: new .NET and PHP for Windows fixes, and reported exploit traffic

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash a process, leak its memory or lead to code execution. Brotli versions 1.0.3 through 1.2.0 are affected; 1.0.10, 1.1.1 and 1.2.1 are fixed (researchers' tracking page). It is rated 9.2 under CVSS 4.0 in the GitHub advisory. Microsoft rates it 8.1 under CVSS 3.1.

Node.js disclosed it on October 21 (Node.js security release). Three developments since then matter to MSPs:

• .NET, October 25. Microsoft shipped out-of-band .NET 8.0.33, 9.0.22 and 10.0.14 (.NET blog). The same release re-issues two incomplete fixes from October 13. Microsoft rates the Brotli flaw "Exploitation More Likely", reported by The Register.
• PHP for Windows, October 26. PHP published rebuilt Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1 (php.net). The flaw is reachable through the cURL extension only when automatic response decompression is turned on. That is off by default, but apps and HTTP libraries can enable it.
• Exploit traffic, October 26. ELLIO reports its sensors recorded an exploit payload aimed at Node.js v24.22.0 on x86-64. It does not report a successful compromise. Other researchers have not seen active exploitation, reported by CyberScoop. It was not in the CISA catalog when we checked on October 27.

Who is exposed. Clients running custom web apps, portals or APIs on Node.js, ASP.NET Core or Python. Exposure depends on whether the app decompresses Brotli data from outside. In Node.js, that includes fetch() of a Brotli-compressed response. In .NET, it means request decompression, HttpClient automatic decompression or the Brotli APIs; .NET Framework is not affected. Line-of-business software and appliances that bundle these runtimes are exposed too, and their vendors may be slower.

What to do.

• Update Node.js to 22.23.4, 24.22.1 or 26.12.1. Node 25, 23, 20 and older are end of life and get no fix; move them to a supported line.
• Install .NET 8.0.33, 9.0.22 or 10.0.14 on servers and rebuild self-contained apps. A runtime update does not reach an app that ships its own runtime.
• Update the Python Brotli package to 1.2.1 and brotlicffi to 1.2.1.0. Update lockfiles so builds do not reinstall the old versions.
• On Windows PHP hosts, install the -1 packages from php.net downloads.
• Restart every updated process and redeploy container images. A running process keeps the old decoder.
• If an inbound service cannot be patched yet, reject Content-Encoding: br request bodies at the proxy, load balancer or WAF.
• Ask software vendors whose products bundle Node.js, .NET or Python when they will ship a fix.

ELLIO describes the user agent as an exposure checker that maps which hosts decompress Brotli. A hit means you were scanned, not compromised.

Quick hits

ConnectWise Cloud Backup. Onboarding has slipped. The October 25 update targeted October 26. The October 26 update says only that ConnectWise is preparing for phased onboarding, with no new date. It lists no new indicators. Keep the affected app connections disabled until ConnectWise sends instructions for your service.

Sources

• CISA: two known exploited vulnerabilities added (PHP), October 26, 2026
• CISA Known Exploited Vulnerabilities catalog
• The Hacker News: CISA confirms active exploitation of two PHP2Shell flaws
• PHP: critical remote code execution vulnerabilities, October 21, 2026
• PHP: updated Windows builds for Brotli security fix, October 26, 2026
• Node.js October 2026 security releases
• .NET October 2026 out-of-band security updates
• Broccoli2Shell tracking page for CVE-2026-111497
• ELLIO: Node2Shell analysis and observed exploit traffic
• The Register: Microsoft releases emergency .NET fixes for Brotli bug
• CyberScoop: experts temper alarms over critical Brotli defect
• ConnectWise security advisories

A quiet weekend with two items that need action today. PHP2Shell has moved from attempts to confirmed shells on unpatched servers. A Nextcloud add-on that many small offices run has been exploited since September, and it is now on CISA's exploited list.

1. Patch every PHP server that is still unpatched today, starting with Apache mod_php. Then hunt for shells spawned by the web server since October 17.
2. Upgrade the Nextcloud "Built-in CODE Server" app to 26.4.303 or remove it. Disabling it is not enough. Then look for shx*.php files in its folder.

1. Update: PHP2Shell exploitation now confirmed successful

This is a follow-up to item 2 in the October 25 briefing. Until this weekend, every report described scanning and failed attempts. That changed on October 24.

Adel Karimi published honeypot evidence of working remote code execution against PHP 8.4.26 on Apache mod_php. Two source addresses got shells on three honeypots that day, 35 in total. The chain is consistent with CVE-2026-109618; his records do not show CVE-2026-109619 in use. Expel's Marcus Hutchins independently confirmed the findings, as reported by BleepingComputer on October 26.

After getting in, the attackers ran id, tried to write files to web roots, and called home with curl, wget or PHP itself. No second-stage download was seen. The shells ran as the web server user, with Apache as the parent process.

Weaponized tooling is spreading. SecurityWeek reported on October 23 that a Mirai-style botnet has added the flaws to its spreading methods. It also reported that VulnCheck built an exploit that works against default production settings. Neither CVE was in the CISA catalog when we checked on October 26. Do not wait for it.

Who is exposed. The same as last week: any client PHP site, hosting panel, intranet app or appliance on a build older than the October 21 releases. The confirmed shells were on mod_php, the configuration PHP's advisory already called the riskiest.

What to do.

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (php.net advisory). PHP says updating is the only complete fix; the mitigations only reduce exposure.
• Restart every PHP worker and Apache after updating, then confirm the running version.
• Hunt for /bin/sh started by apache2, httpd or php-fpm, running as the web server user. That process is the reliable success signal. An HTTP 200 on the earlier stages is not.
• Search PHP and web server logs for the strings below, and for very large multipart POSTs to / or /index.php.
• Check egress logs for the addresses below. Treat any match on an unpatched server as an incident.
• Keep session.upload_progress.enabled=0 in place. It is also the interim fix for CVE-2026-115560, which still has no patch (PHP informational advisory).

The memory figure is the honeypots' 128 MiB limit. Yours may differ.

2. Nextcloud's built-in Collabora CODE server is exploited and on the CISA list

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23 (CISA alert). The flaw is an unauthenticated OS command injection in proxy.php of richdocumentscode, the Nextcloud app listed as the Built-in CODE Server. Collabora's advisory, published October 14, rates it CVSS 4.0 9.2.

The attack works only while the built-in CODE server is not running, for example after a restart, upgrade or crash. The advisory says disabling the app does not prevent it. Standalone Collabora Online servers are not affected.

Exploitation started weeks before the advisory. In the project's issue tracker, one administrator logged the first malicious request on September 10. Attackers wrote PHP webshells into the app folder. On one server they searched for password vaults and cryptocurrency wallet files. The fixed version, 26.4.303, shipped on September 11, but its release notes did not mention a security fix.

Who is exposed. Small offices, schools and nonprofits that run Nextcloud with the one-click office suite instead of a separate Collabora server. Anything the web server account can read on that host is at risk, including synced files and config secrets.

What to do.

• In each Nextcloud instance's Apps page, check whether the Built-in CODE Server app (richdocumentscode) is installed, and its version. Upgrade to 26.4.303 or later, or remove the app.
• 26.4.303 needs Nextcloud 30 or later. On older Nextcloud, upgrade Nextcloud or remove the app.
• Patching does not remove a webshell. Look for shx*.php files under apps/richdocumentscode/ and run Nextcloud's code integrity check.
• Search web logs back to September 10 for requests to /apps/richdocumentscode/proxy.php containing %2e%2e.
• If you find a webshell, rebuild the host and rotate the Nextcloud database, admin and storage credentials.

Quick hits

ConnectWise Cloud Backup. No new indicators since October 18. The October 25 advisory update still targets phased partner onboarding for October 26, with backup restore access first. Keep the affected apps disabled until ConnectWise sends instructions for your service.

Sources

• Adel Karimi: PHP2Shell confirmed RCE report, October 24, 2026
• BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild
• SecurityWeek: Mirai botnet operators join PHP2Shell attacks
• PHP: critical remote code execution vulnerabilities, October 21, 2026
• PHP: informational advisory on session upload progress, October 23, 2026
• CISA Known Exploited Vulnerabilities catalog
• CISA: one known exploited vulnerability added (Collabora Online), October 23, 2026
• Collabora advisory GHSA-g3vx-3m76-fghh
• richdocumentscode issue 354
• ConnectWise security advisories

This week was about trust that attackers borrowed. A stolen vendor credential walked into hundreds of Microsoft 365 tenants without a single user signing in. Two critical PHP flaws landed with exploitation already under way, and the NAS vendors are still catching up. Here is what to do first.

1. Disable the ConnectWise Cloud Backup and Cloud Management apps in every tenant you manage, then hunt for added roles and secrets.
2. Patch every internet-facing PHP install to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and update Synology and QNAP NAS units.
3. Hunt Entra sign-in logs for token replay from hosting networks and for rogue DESKTOP- devices.
4. Confirm every PAN-OS firewall with GlobalProtect is on a fixed build; ransomware crews are using the May flaw now.
5. Upgrade FortiOS, FortiManager and FortiAnalyzer to the October 22 builds before the CVEs go public on November 10.
6. Update any Plex Media Server you can find to 1.43.3.10861 or later, and treat older exposed servers as compromised.
7. Check SSPR registration coverage before Entra enforces registered methods in early November.

1. ConnectWise Cloud Backup credentials used to enter Microsoft 365 tenants

A credential for ConnectWise Cloud Backup, the product formerly called SkyKick, was used to sign in to customer Microsoft 365 tenants as the application itself. ConnectWise published its advisory on October 16, revoked certificates and disabled seven application identities on October 17, and suspended Cloud Backup, SaaS Security and Cloud Management (ConnectWise advisory). Phased restoration began on October 21. As of the October 25 update, partner onboarding is targeted for October 26, with restore access first and full re-enrollment after.

Huntress saw the first sign-ins on October 15 from 144.172.64[.]128. By its October 17 update it counted almost 1,000 Entra tenants with sign-in activity from that address and more than 300 successful sign-ins. In about 50 tenants, Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator. In one tenant the Teams app made itself Global Administrator and then added client secrets to two other applications, set to expire in 2028.

Microsoft attributed the campaign on October 21 to Storm-0940, a China state-aligned group, and said it used an open-source agentic AI penetration testing framework to automate the work. Microsoft counted sign-in attempts against more than 2,250 tenants and saw privileged access gained in under three hours in several cases.

Who is exposed. Any tenant where these apps were ever consented, including dormant SkyKick connections from years ago. User MFA and user Conditional Access were never in the path, because the attacker authenticated as the app.

What to do.

• In Entra, open Enterprise applications, find each app by application ID, and set "Enabled for users to sign-in" to No. Do not delete them; deleting destroys evidence and consent.
• Review directory role assignments and remove roles the apps granted themselves, especially Global Administrator and Privileged Authentication Administrator.
• Review client secrets and certificates on every app registration and enterprise app. Remove any added since October 13 that you did not create, including on your security tooling's apps.
• Check the service principal sign-ins tab, not user sign-ins, filtered by the Cloud Backup app ID, for the window October 15 01:00 UTC to October 16 02:00 UTC and beyond.
• Audit for "Add member to role", "Update application" and "Add service principal credentials" events initiated by ConnectWise or SkyKick apps.
• Keep the apps disabled until ConnectWise sends restoration instructions for your service.

2. PHP2Shell: two critical PHP remote code execution flaws, exploited

The PHP project released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (php.net advisory). Both can give unauthenticated remote code execution against PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on mod_php, where a demonstrated exploit fires before any application code runs. Details leaked a day early, so the release was pulled forward.

watchTowr reports seeing exploitation of both flaws in its honeypots on October 21. Huntress had not seen exploitation across its partner base as of the afternoon of October 21 but says Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla. Neither CVE was in the CISA catalog as of October 23.

On October 23 PHP added an informational advisory for a third issue, CVE-2026-115560, with no patch yet. It needs an unusual serialize-handler configuration, and the mitigation is the same session upload progress setting.

Who is exposed. Every client with a PHP web server: WordPress and other CMS sites, cPanel and Plesk hosts, intranet apps, and the PHP bundled inside appliances. NAS units matter most for MSPs. Synology shipped fixes on October 22 for its PHP packages, Calendar and Mail Station. QNAP released fixed QTS, QuTS hero and QuTScloud builds on October 24, but Note Station 3, QVR Surveillance on ARM32, QNE and TVR OS are still waiting.

What to do.

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official release; use your distribution's backport or PHP's minimal source backports for 7.4, 8.0 and 8.1.
• Where you cannot patch today, set session.upload_progress.enabled=0 in php.ini or the FPM pool, and restart all workers. Do not rely on ini_set() or .user.ini.
• Cap request size: post_max_size of 8M, or 32M where uploads are needed, with upload_max_filesize lower.
• Update Synology packages through Package Center and QNAP firmware through Live Update. Keep QNAP units off the internet until the remaining apps are fixed.
• Hunt for PHP workers spawning sh, bash, curl, wget, python or nc, new files in web roots, and unexpected cron jobs. Start the review at October 17, not the patch date.
• PHP 8.2 reaches end of life on December 31, 2026. Plan the move now.

3. Token replay campaign against Microsoft 365, with detections

Huntress published a ten-week campaign on October 22 that combined adversary-in-the-middle phishing with token replay at volume. Between July 14 and September 22, 2026 it counted at least 497 successful sign-ins across 79 victim organizations, plus more than 200,000 failed attempts. Stolen sessions were replayed from hosting provider 1337 Services GmbH. The attacker registered at least 48 rogue Entra devices, and in 19 organizations wiped existing MFA methods and registered a new authenticator within three hours of the first sign-in.

Who is exposed. Any tenant where Conditional Access has exceptions, and any tenant that still allows device code flow. MFA alone did not stop it, because the session was captured after MFA.

What to do.

• Require MFA or block for all users, all cloud apps and all client app types, with no exclusions.
• Block device code flow with an authentication flows Conditional Access policy.
• On suspected replay, revoke sessions and reset the password. A reset alone leaves tokens, rogue devices and attacker MFA methods in place.
• Audit Entra devices named DESKTOP- plus eight hex characters, especially those registered from hosting IPs.
• Audit MFA method changes for a clear followed by quick re-registration.
• Review inbox rules with punctuation-only names or that move mail to RSS Feeds or Conversation History.
• Treat error 53003 BlockedByConditionalAccess as proof of a valid credential, since the block happens after authentication succeeds.

4. Ransomware crews are using the May GlobalProtect bypass

Palo Alto Networks fixed CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway, in May 2026 (advisory). On October 19, Unit 42 updated its threat brief to say ransomware operators, including Qilin and Inc, are exploiting it against unpatched firewalls. The flaw lets an unauthenticated attacker establish a VPN session, bypassing MFA.

Observed follow-on activity includes reconnaissance with dual-use RMM tools, lateral movement over RDP and SMB, and a pivot from the VPN gateway to vCenter to dump credentials from a domain controller's virtual disk, which avoids in-guest EDR.

Who is exposed. Any client with a PAN-OS firewall running GlobalProtect on a build older than the fixed releases. Cloud NGFW and Panorama are not affected.

What to do.

• Upgrade to a fixed build: 10.2.18-h6, 11.1.15, 11.2.12, 12.1.7 or the listed hotfixes for your branch.
• Until then, disable the Authentication Override cookie options on the portal and gateway, or use a dedicated certificate for them.
• Hunt GlobalProtect logs for the IPs below and for client host names WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. Treat a successful gateway connection from any of them as an incident.
• Confirm the management interface is not reachable from outside on ports 4443 and 3879.

5. Fortinet shipped critical fixes before telling anyone what they fix

Fortinet announced a security hardening release on October 21 and shipped the builds on October 22 (Fortinet announcement). It says the release contains critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer. CVE IDs and advisories will be published on November 10. Fortinet does not report exploitation, but it warns that patch diffing can expose unpatched devices before then.

Who is exposed. Every FortiGate client, which for most MSPs is most of them. FortiMail and FortiAuthenticator fixes were released earlier.

What to do.

• FortiOS: 8.0.2, 7.6.8, 7.4.13 or 7.2.14. FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12 or 7.2.13. Note the management products are one build number behind FortiOS on the 7.4 and 7.2 branches.
• FortiOS 7.0 is not in the table. Plan a branch upgrade for anything still on it.
• Patch internet-facing units first and back up configurations before upgrading.
• If you cannot patch yet, restrict HTTPS and SSH admin access to trusted IPs or disable it on external interfaces, and keep FortiManager off the internet.

6. Plex Media Server chain is being exploited for miners and proxies

CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on October 20 (CISA alert). Plex's security notice, updated October 19, says CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 chain into unauthenticated remote code execution. Plex reports active and widespread exploitation, with compromised servers running cryptocurrency miners and proxy software. A public proof of concept appeared on October 16.

Who is exposed. Plex turns up on small-office NAS units, staff machines and the odd server a client set up for the break room. If it forwards port 32400 and is older than 1.43.3.10861, assume it is compromised.

What to do.

• Update to 1.43.3.10861 or later. The version string "1.43.3" is not enough; build 1.43.3.10828 is vulnerable.
• Look for unexpected child processes of Plex Media Server, unfamiliar .so or .dll files in the Codecs folder, outbound connections to proxystream.st, and sustained CPU with nothing playing.
• If you find anything, reinstall from a clean data directory, sign out all devices and change the Plex password. Treat shares and credentials the Plex account could reach as exposed.
• Disable Remote Access if nobody needs it.

7. Entra SSPR will reject unregistered phone numbers from early November

Microsoft message center notice MC1325414 says self-service password reset will accept only explicitly registered authentication methods (Microsoft Entra blog; notice mirror). Mobile, office phone and alternate email pulled from directory attributes will stop working for verification. The registration campaign began October 5. The notice's title gives November 9, 2026 for enforcement, while its rollout table says November 7. Plan for the earlier date.

Who is exposed. Users whose only SSPR option is a phone number an admin typed into their profile. They will be locked out of self-service reset and will call you.

What to do.

• In the Entra admin center, open Authentication methods, then User registration details, and filter for users with no registered method.
• Turn on the registration campaign so users are prompted at sign-in.
• Make sure admins have a registered method too.
• Brief the help desk on assisted registration for users who cannot self-register.

Quick hits

Arista VeloCloud Orchestrator. CISA added CVE-2026-114625 to its catalog on October 23 (CISA alert). Arista's advisory rates the SQL injection 9.9 and says it is actively exploited; the lowest tenant role is enough. On-premises orchestrators need 5.2.3.18, 6.1.3.10 or 6.4.2.12. Arista lists 74.82.197.86 and 38.54.50.151 as malicious IPs. Hosted instances are already patched.

Windows 11 24H2 Home and Pro stopped getting updates. Microsoft's lifecycle page lists the end date as October 14, 2026, and the October security update was the last (Microsoft lifecycle; reported by BleepingComputer). There is no November patch for these editions. Move them to 25H2 or 26H2 before Patch Tuesday. Enterprise and Education on 24H2 are supported until October 12, 2027.

Sources

• ConnectWise security advisories
• Huntress: ConnectWise (SkyKick) vendor credentials abused in M365 attacks
• Microsoft: AI-driven nation-state campaign using ARTEX enables supply chain compromise
• PHP: critical remote code execution vulnerabilities, October 21, 2026
• PHP: informational advisory on session upload progress, October 23, 2026
• watchTowr: PHP2Shell
• Huntress: php2shell rapid response
• Synology-SA-26:14 PHP2Shell
• QNAP QSA-26-18 PHP2Shell
• Huntress: M365 token spray and replay campaign
• Palo Alto Networks advisory CVE-2026-0257
• Unit 42 threat brief on CVE-2026-0257
• Fortinet security hardening release
• CISA: six known exploited vulnerabilities added, October 20, 2026
• CISA: one known exploited vulnerability added, October 23, 2026
• Plex security update notice
• Arista Security Advisory 0199
• Microsoft Entra blog: security updates organizations need to act on
• Message center notice MC1325414 (mirror)
• Microsoft lifecycle: Windows 11 Home and Pro

LNX Monitor, the tool our NOC runs on, now watches UniFi networks through UniFi Site Manager. When a client's site goes offline or loses its internet connection, we have an incident open within about a minute.

What UniFi Site Manager is

UniFi Site Manager is Ubiquiti's cloud portal for UniFi networks. Every UniFi console an organization owns, whether a gateway, a Cloud Key, or a Dream Machine, shows up there with its status, and Site Manager has an API that other software can read.

That makes it the natural place to watch from. The portal shows you the state of each site. What it does not do is decide who needs to know, keep a record of each outage, or stay quiet during planned work. LNX Monitor handles that part.

What LNX Monitor does with it

Give LNX Monitor a Site Manager API key and it does the rest on a schedule:

• Syncs every console once a minute. Each one becomes a device in LNX Monitor, grouped by organization, with its online state and when it was last seen.
• Opens an incident when something is wrong. A console that goes offline opens a high-severity incident. A console that is online but reports an internet problem opens a medium one.
• Opens one incident, not fifty. If a site already has an open incident, the next sync does not open another. Notifications are de-duplicated and rate-limited, so a flapping connection does not bury the on-call phone.
• Sends alerts where the team works. Email, Slack, or any webhook.
• Respects maintenance windows. Planned firmware updates and cutovers do not page anyone.

Site Manager covers the network itself. The same tool also checks the things around it on a schedule: websites, servers by ping and port, SSL certificates before they expire, and SIP trunks for phone systems. Public status pages can show a client what is up without giving them a login.

Why we built it

We needed to know a client site was down before the client did, across dozens of UniFi networks, without paying per-monitor pricing for a hosted service. So we built the tool we wanted, and we run our own managed IT monitoring on it.

For a client, the difference is simple. A store that loses its internet connection overnight has an incident open and someone on it, instead of a phone call at opening. An office whose gateway drops at lunch is already flagged before the first complaint.

Running it yourself

LNX Monitor is published on GitHub and listed on our open-source page. It runs as a single Docker image with MySQL and Redis alongside, and starts with three commands. The license is source-available: free to use and host for your own organization or your own clients, not to resell as a product or a hosted service.

If you are an IT team or a managed service provider with UniFi sites to watch, the repository has everything you need. If you run a business on UniFi and would rather someone else watched it, call us. We can watch it for you as part of managed IT.

LNX Inc. has built Detecto, a real-time video surveillance system that adds AI detection to the IP cameras a site already has. It runs on a single server on the premises, and video does not leave the site. Schools, colleges, universities, and non-profit organisations can use it free of charge, and LNX can deploy it for any organisation that wants help.

What Detecto does

Detecto connects to existing IP cameras. It finds ONVIF cameras on the network automatically and can scan IP ranges for RTSP streams, so most sites do not need new cameras to start.

Live video streams to a browser dashboard over WebRTC or MSE. On the same server, YOLO models run on an NVIDIA GPU with TensorRT and look for:

• People, vehicles, and animals.
• Weapons: guns and knives.
• Fire.
• Behaviour from pose analysis: falls, fighting, arms raised, and crouching.
• Motion.

Detections are drawn as overlays on the live video. Each event is recorded with its history, and the event list can be filtered by severity. Every camera can have its own motion masks and zones, so a busy street at the edge of the frame does not raise alerts all day.

Automations

Detecto includes rules in an "if this, then that" style. A rule has a trigger, optional conditions, and one or more actions.

• Triggers include a gun detected, a person detected, a camera going offline, and no motion for a period.
• Conditions narrow a trigger by time window, camera, zone, duration, confidence, and count.
• Actions include a browser notification, a webhook, a Slack message, an email, and recording a clip.

Templates for common rules are included, so a new rule can start from a template rather than a blank form. For example, a rule can say: when a person is detected in a chosen zone outside opening hours, email the facilities manager.

Where it runs

Detecto runs fully on-premises on one Ubuntu server with an NVIDIA RTX GPU. Cameras, video, detections, and event history stay on that server. Nothing is sent to a cloud service unless you configure an action, such as a webhook or an email, to send it.

What it is not

Detecto is an aid to the people who watch the cameras, not a replacement for them. Models miss things and flag things that are not there. Detecto helps staff notice events sooner and find them faster afterwards. Decisions about what an alert means, and what to do about it, stay with people.

Licensing

• Free for education and non-profits. Schools, colleges, universities, non-profit and charitable organisations, public research institutions, and government bodies can use Detecto at no cost under the PolyForm Noncommercial License 1.0.0.
• Commercial license for businesses. Companies using Detecto in a commercial setting need a commercial license from LNX.

How LNX can help

Software is one part of a camera system. LNX can deploy Detecto end to end:

• A site survey of your cameras, network, and coverage.
• Camera integration, including the cameras you already have.
• Supply and installation of the GPU server.
• Configuring detection, zones, and alert rules for how your site actually runs.
• Training the staff who will use the dashboard and respond to alerts.
• Ongoing support.

This builds on our low-voltage and camera work and our AI & Automation practice.

If you are a school or a non-profit, the software is free, and we can help you deploy it. If you are a business, we can quote the license and the installation together. Either way, tell us about your site on the contact page.