⚡ THE ONE THING TODAY
Inventory every internet-facing PHP, Magento or Adobe Commerce, and Brotli-dependent .NET or Node.js deployment across your clients today, and patch or isolate any exposed instances before Thursday's CISA deadline.
Microsoft releases out-of-band Windows updates to distrust eMudhra certificates
Certificates tied to compromised eMudhra certificate authority keys are being removed from trust. The updates are for systems that don't get automatic certificate trust updates, such as isolated or locked-down machines.
Affects: Windows systems without automatic certificate trust updates
Spam flood, then fake IT support on Teams, hits staff
Attackers swamp inboxes with spam, then message staff on Microsoft Teams posing as IT support. Arctic Wolf has documented more than 400 incidents abusing Teams' external chat.
Affects: Microsoft 365 tenants that allow external Teams chat
Microsoft Authenticator for Android flaw let apps steal work tokens
A malicious Android app with no permissions could pose as a trusted Microsoft app such as Teams and collect work account sign-in tokens. Microsoft has fixed it.
Affects: Microsoft Authenticator on Android
PHP2Shell flaws under active attack; CISA deadline Thursday
Two critical PHP remote code execution flaws are being exploited and are on CISA's KEV list. The PHP Foundation shipped fixes on 21 October. Cisco and Palo Alto have published advisories for their products.
Affects: PHP web servers and products that embed PHP
Brotli compression flaw exploited, hitting .NET, PHP and Node.js
A Brotli memory-corruption bug can be reached remotely without authentication and is on CISA's KEV list. Microsoft issued emergency .NET patches, and PHP rebuilt its Windows packages for 8.2 to 8.5.
Affects: .NET, PHP on Windows (8.2–8.5), Node.js and other software bundling Brotli
Adobe Commerce and Magento file-upload flaw exploited in attacks
An unrestricted file upload bug can give attackers code execution on Magento stores. CISA lists it as exploited, with a federal remediation deadline of 10 November.
Affects: Adobe Commerce and Magento stores
Apple backports fix for exploited CoreGraphics zero-day to older devices
A CoreGraphics out-of-bounds write that was exploited in targeted attacks is now patched on older iPhones and iPads. Apple's October release also covers 304 vulnerabilities.
Affects: Older iPhones and iPads managed by MSPs
Critical EDK2 UEFI firmware flaw allows early-boot code execution
A critical flaw in EDK2 lets attackers run code early in the boot process. Ars Technica says it threatens most servers.
Affects: Servers using EDK2-based UEFI firmware
Tailscale warns of SSH flaws allowing root privilege escalation
Tailscale is patching almost a dozen vulnerabilities. They could be used to steal credentials, crash servers or gain root.
Affects: Tailscale deployments, especially those using Tailscale SSH
Dahua IP cameras and DVRs hijacked via P2P and weak authentication
Ukraine's CERT-UA warns of unauthorised remote access to Dahua cameras and DVRs. Attackers can view video streams and change device configuration.
Affects: Dahua IP cameras and DVRs
Cisco ships security hardening releases for Expressway and Unified Communications
Cisco released hardening updates for Expressway and for Unified CM, Emergency Responder and related collaboration products. They fix multiple issues found in internal reviews.
Affects: Cisco Expressway and Unified Communications products
ASD cuts Amadey botnet operator off from 180,000 infected computers
The Australian Signals Directorate got into the Amadey malware backend and blocked the criminal's access to 180,000 infected machines worldwide, including some in Australia.
Affects: Computers infected with Amadey malware
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.