⚡ THE ONE THING TODAY
Prioritize Windows Patch Tuesday deployment today and scan your environment for Bricksforge plugin installations — both are actively exploited in the wild right now.
Azure Rights Management (ARM) Degradation Impacts M365 Content Protection — Oct 12
On 12 October 2026, Microsoft confirmed a 2h 56m incident in which some users were unable to access or protect content using Azure Rights Management across M365 services. The issue has since been resolved; no workaround was published during the outage window. MSPs managing Information Protection or sensitivity-label policies should verify ARM is functioning correctly for all tenants.
M365 Admin Center Intermittently Inaccessible — Oct 6 Incident
A 55-minute degradation on 6 October 2026 left admins intermittently unable to access the Microsoft 365 Admin Center. The outage affected partner-delegated admin sessions, with at least one report of Microsoft Lighthouse failing to load all managed tenants. No workaround was confirmed; the service restored automatically.
October 2026 Patch Tuesday: Windows Shell Zero-Day (CVE-2026-96951) Actively Exploited in Record 1,413-CVE Release
Microsoft's October 2026 Patch Tuesday — the largest ever — addresses approximately 1,413 CVEs across Windows, Office, SharePoint, SQL Server, Exchange, Azure, and Defender. CVE-2026-96951, a Windows Shell security feature bypass, is confirmed under active exploitation in the wild and should be patched immediately. Also notable: CVE-2026-97778 (Excel RCE via integer overflow, CVSS Critical) and a publicly disclosed .NET Framework bypass CVE-2026-108398. No known workaround — apply the official Microsoft security updates immediately.
Bricksforge WordPress Plugin CVSS 10.0 RCE Flaw Actively Exploited Since 7 October
Attackers are actively exploiting a CVSS 10.0 unauthenticated RCE vulnerability in the Bricksforge WordPress plugin (versions up to 3.1.8.9), with exploitation observed by Patchstack from 7 October 2026. The flaw allows full server compromise without credentials. Patch to version 3.1.8.10 immediately; if patching is delayed, deactivate the plugin as a temporary workaround.
Microsoft Exchange Server EoP Vulnerability CVE-2026-96940 Patched — CVSS 8.8, Upgrade Required
Microsoft's October Patch Tuesday also delivers four KB updates for Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) addressing CVE-2026-96940, an Elevation of Privilege flaw rated CVSS 8.8. While not yet confirmed exploited in the wild, Exchange EoP bugs have historically been fast-tracked by threat actors. MSPs should deploy the relevant KB (5129955–5129958) against all on-premises Exchange instances this week.
GitLab Critical RCE CVE-2026-97229 — Unauthenticated Code Execution via CI/CD Regex, PoC Reproduced
GitLab patched a critical unauthenticated RCE flaw (CVE-2026-97229) on 12 October 2026 affecting CE and EE versions prior to 19.4.2, 19.3.5, and 19.2.8. Rapid7 reproduced arbitrary code execution on an unpatched 19.4.1 image within 24 hours of disclosure, though in-the-wild exploitation has not yet been confirmed. Workaround: restrict public project creation on self-managed instances; upgrade to 19.4.2, 19.3.5, or 19.2.8 immediately.
Palo Alto Cortex XSOAR/XSIAM Microsoft Teams Integration Flaw (CVE-2026-0234) Patched
Palo Alto Networks patched CVE-2026-0234, an improper cryptographic signature verification bug in the Cortex XSOAR and XSIAM Microsoft Teams integration, which could allow attackers to access and tamper with protected resources. SonicWall simultaneously patched four SMA1000 flaws including a high-severity SQL injection (CVE-2026-4112) that could let read-only admins escalate to primary admin. SonicWall reports no in-the-wild exploitation but urges immediate updates to SMA1000 appliances.
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.