Stolen Microsoft 365 sessions used to breach 79 organisations without passwords
Huntress tracked an attacker replaying stolen sign-in sessions to access mailboxes, then using hidden inbox rules to conceal mail from victims. Passwords and MFA prompts were bypassed.
Affects: Microsoft 365 tenants and mailboxes
Microsoft explains how to revive broken Exchange Online EWS apps
Apps that stopped working after Exchange Web Services was retired can be fixed. Microsoft says admins can re-enable the EWS API in Exchange Online.
Affects: Exchange Online tenants with EWS-dependent apps
PHP2Shell flaws under attack; emergency PHP patches out, third bug unpatched
Attackers are exploiting two critical PHP RCE flaws (CVE-2026-109618), including against a European government body. A third bug has no patch but only affects unusual configurations. PHP has shared mitigations.
Affects: PHP web servers and products embedding PHP (Cisco and Palo Alto have published advisories)
Collabora Online CODE server in Nextcloud under active attack
An OS command injection flaw allows remote code execution on Nextcloud setups using the built-in CODE server. CISA added it to KEV, with remediation due today.
Affects: Nextcloud deployments using Collabora Online's built-in CODE server
Brotli decoder flaw behind Node.js RCE hits Bun, Python and Envoy
A memory-corruption bug (CVE-2026-111497) in Google's Brotli decoder lets crafted compressed data corrupt memory. It sits in many tools beyond Node.js, so exposure is broad.
Affects: Node.js, Bun, Python Brotli and brotlicffi packages, Envoy proxies decompressing Brotli
GitLab max-severity bug allows remote code execution across 12 years of releases
A maximum-severity flaw affects a dozen years of GitLab releases. Ruby has also fixed three regex engine bugs behind four critical GitLab RCE flaws patched this past month.
Affects: Self-hosted GitLab instances
Arista VeloCloud Orchestrator zero-day exploited; CISA deadline is today
A SQL injection flaw in on-prem VeloCloud Orchestrator lets a remote attacker reach privileged functions and affect the host. Arista has released updates, and CISA lists it as exploited.
Affects: Arista VeloCloud Orchestrator (VCO) On-Prem deployments
Palo Alto GlobalProtect VPN flaw exploited by ransomware gangs
An authentication bypass (CVE-2026-0257) lets attackers open unauthorised VPN sessions. Unit 42 now names Qilin and Inc as exploiting it, though the fix has been out since May.
Affects: PAN-OS firewalls and Prisma Access using GlobalProtect with authentication override cookies
HPE patches eight max-severity ArubaOS auth bypass and RCE flaws
HPE fixed 72 ArubaOS vulnerabilities, eight of them maximum-severity authentication bypass and code execution issues. No exploitation is mentioned in the report.
Affects: Aruba Operating System (ArubaOS) networking gear
Cisco issues emergency distrust notice for eMudhra certificate authorities
Between 17 and 20 October, a researcher showed private keys for eight eMudhra intermediate certificates were fundamentally broken. eMudhra has since exited the TLS certificate business.
Affects: Sites and devices trusting or using eMudhra-issued certificates
Windows Server 2016 reaches end of support in January 2027
Microsoft confirmed Windows Server 2016 stops receiving security updates in January 2027. Any client servers still on it will be exposed to unpatched flaws after that.
Affects: Windows Server 2016 installations
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.