⚡ THE ONE THING TODAY
Today, inventory every PHP 8.2–8.5 runtime, including those bundled in appliances across client estates, and patch or isolate any exposed instance against PHP2Shell.
Microsoft 365 token-replay attacks compromise 97 accounts at 79 organisations
Huntress saw attackers use an adversary-in-the-middle relay to capture sign-in sessions, then replay the stolen tokens to break into email accounts. MFA alone doesn't stop this.
Affects: Microsoft 365 tenants
Fake IT support chats on Microsoft Teams are delivering malware and ransomware
Researchers report hundreds of cases where attackers use Teams' external chat feature to pose as IT support. Your helpdesk's own branding is an easy thing to impersonate.
Affects: Microsoft Teams tenants allowing external chat
Microsoft Teams to add AI phishing detection from early November
Microsoft plans AI-powered, context-aware phishing detection for Teams messages starting in early November 2026. It's a useful layer against the Teams IT-support scams above.
Affects: Microsoft Teams tenants
PHP2Shell: critical PHP remote code execution flaws under active attack
Two unauthenticated PHP RCE flaws are being exploited, with attempts seen before the 21 October patches. Fixes cover PHP 8.2–8.5. Cisco and Palo Alto advisories list products that bundle PHP.
Affects: PHP before 8.5.12/8.4.27/8.3.36/8.2.35 (8.1 and older: no official release, source backports only);
Brotli decoder flaw hits Node.js, .NET and Python; patches out
A memory-corruption bug in Google's Brotli decoder can allow remote code execution. A public proof of concept exists, but no in-the-wild attacks are confirmed. Microsoft shipped emergency .NET fixes.
Affects: Node.js 22/24/26, .NET 8/9/10, Bun, Python Brotli, PHP Windows builds, Palo Alto products
DreamHost forces email and FTP password resets during ongoing incident
DreamHost forced password resets for email and FTP/SFTP users after an incident that disrupted File Manager connections. The incident is still ongoing.
Affects: DreamHost email and FTP/SFTP users
Gheist campaign uses stolen GitHub tokens to leak repository secrets
Attackers plant workflows that print a repository's secrets into Actions logs, download them, then delete the runs. It has worked against private repos and GitHub Enterprise.
Affects: GitHub private repos and GitHub Enterprise using Actions
Fortinet ships quiet hardening updates for FortiOS and four other products
Fortinet released updates last week for bugs found with AI help. It is withholding details until 10 November 2026, after which exploit development is likely.
Affects: FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator
Unpatched Tailscale SSH flaws let a hacked device reach root on other servers
A researcher published findings showing one compromised device on a tailnet can gain root on servers it can reach. It requires Tailscale SSH with port forwarding allowed.
Affects: Tailscale networks with SSH port forwarding enabled
LiteLLM master key leak let attackers push a malicious package
A master key published by accident to a public GitHub repo in late May 2026 let the attacker steal GitHub tokens and push a malicious version of the Python package.
Affects: Users of the LiteLLM Python package
AI coding agents hijacked by a malicious AGENTS.md in the Downloads folder
Forever Security found a file dropped in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package.
Affects: Developers running AI coding agents from the Downloads folder
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.