Thursday, October 22, 2026

PHP2Shell (CVE-2026-109618 / CVE-2026-109619): Critical Pre-Auth RCE in PHP Core — Patch Released 21 Oct

Two critical remote code execution flaws dubbed 'PHP2Shell' were patched on 21 October 2026 at 14:00 UTC across PHP 8.2, 8.3, 8.4, and 8.5. The vulnerabilities (CVSS v4.0 9.2) allow a single unauthenticated HTTP request to trigger exploitation before any application code runs, with mod_php deployments most at risk. Legacy PHP versions (5.4+) have no upstream patch — operators must use a distro backport, WAF rule, or take the service offline. Restart PHP-FPM or the web server immediately after applying the fixed interpreter.

Fortinet FortiSIEM RCE Patched in v7.5.1 — Arbitrary File Write Risk

Fortinet addressed a remote code execution vulnerability in FortiSIEM that allows attackers to write arbitrary files, which can then be executed via scheduled tasks. The fix is included in FortiSIEM 7.5.1; version 7.6 is not affected. MSPs running FortiSIEM 7.5.0 or earlier should upgrade to 7.5.1 immediately and review scheduled task configurations for signs of tampering.

Rewst Launches AI-Native Automation Platform for MSPs — Oct 2026

Rewst announced the launch of an AI-native automation platform this week, leading the MSP channel's latest AI tooling roundup alongside new AI SOC offerings and agentic finance features from other vendors. The platform targets cross-tool orchestration across PSA and RMM stacks. MSPs evaluating Rewst should budget dedicated workflow-builder labour, as the platform's power scales with investment in configuration.

Autonomous IT Gap: 53% of MSPs Use AI for Ticketing But Only 13% Generate AI Revenue — Kaseya 2026 Survey

A Kaseya 2026 survey published 20 October found that 48% of MSPs ranked AI and automation as the top client need, yet only 13% reported meaningful AI-service revenue, despite 53% already using AI for ticketing, patching, or monitoring. Technician hiring difficulty also rose from 9% to 16% year over year, increasing pressure on automation ROI. The findings suggest MSPs need outcome-based AI contracts and tighter service definitions to convert tooling investment into margin.

Atera 'Robin' AI Agent Offers 90-Day Guarantee: 50% of Tier-1/2 Tickets Resolved Autonomously

Atera's autonomous AI agent 'Robin' is being promoted with a public 90-day performance guarantee — Atera commits to autonomously resolving 50% of Tier-1 and complex Tier-2 tickets, or it waives fees. Robin handles end-to-end incident resolution rather than just summarising tickets, taking diagnostics through to fix execution. MSPs evaluating autonomous helpdesk tooling should factor this performance commitment into procurement decisions alongside NinjaOne, SuperOps Monica, and ConnectWise Sidekick.

Windows Server 2012 / 2012 R2 Extended Security Updates End This Month — Final Patch Cycle

October 2026 marks the third and final year of Extended Security Updates for Windows Server 2012 and 2012 R2, meaning these platforms receive no further Microsoft security patches after this Patch Tuesday cycle. MSPs with clients still running these OSes must urgently plan migration to Server 2022 or 2025, or accept full exposure to unpatched vulnerabilities going forward. Volume Licensing ESU coverage has now expired; no further extensions are available.

CRN Channel Awards Australia 2026: Interactive Wins MSP of the Year (100+ Employees), Kaseya Double Winner

CRN Australia held its inaugural Channel Awards in Sydney, recognising 31 winners across the IT channel. Interactive took MSP of the Year (100+ Employees), Otto IT won the 0–49 category, and Kaseya claimed both Vendor of the Year and Channel Leader of the Year. LogicMonitor was named AI and Automation Vendor of the Year, with First Focus winning AI Initiative of the Year.