Entra ID to retire SMS and voice sign-in in February 2027
Microsoft again urges Entra ID admins to move users to phishing-resistant methods such as passkeys, or face sign-in disruption when SMS and voice authentication end in February 2027.
Affects: Entra ID tenants using SMS or voice MFA
Microsoft ships out-of-band Windows fixes with certificate trust updates
Microsoft released unscheduled Windows updates that include certificate trust list changes, including for eMudhra. Details in the candidate text are limited.
Affects: Windows systems
PHP remote code execution flaws now exploited in the wild
Two critical PHP bugs allow unauthenticated remote code execution and are on CISA's KEV list, with researchers confirming working shells. Cisco and Palo Alto have published product impact advisories. CVE-2026-109618.
Affects: PHP web servers and appliance web management interfaces
Brotli decoder flaw 'Node2Shell' exploited; Node.js and appliances affected
CISA confirmed active exploitation of a critical Brotli flaw. Node.js released fixes on 21 October for 22.x, 24.x and 26.x. Palo Alto rates its impact critical, and Cisco and Fortinet have advisories.
Affects: Node.js 22.x, 24.x, 26.x and vendor products embedding Brotli
Linux kernel flaw exploited; CISA deadline is this Saturday
CISA added a Linux kernel bug to KEV. It involves a missing initialisation that can modify page-cache-backed data during socket buffer coalescing. Remediation is due 31 October. CVE-2026-46300.
Affects: Linux kernel systems
VMware ESX logging flaw exploited, lets admins act untraced
CISA lists a Broadcom ESX insufficient-logging bug as exploited. An attacker with admin access can perform operations without them being logged, which hampers incident investigation. CVE-2026-41709.
Affects: Broadcom VMware ESX hosts
Cisco ASA and FTD SSL VPN bug lets attackers reload devices
An unauthenticated remote attacker can make Cisco ASA or Firepower Threat Defense devices reload unexpectedly by hitting the Remote Access SSL VPN service, causing a denial of service. No exploitation is reported in the candidate text.
Affects: Cisco Secure Firewall ASA and FTD with Remote Access SSL VPN
Tailscale patches SSH flaws that could grant root on other servers
Flaws in how Tailscale SSH forwards connections could let a compromised device reach services and files that only root should access on other servers.
Affects: Tailscale SSH servers before 1.104.4
Cisco to publish new advisories on 4 November
Cisco's advance notice covers fixes for products including Identity Services Engine (ISE) and UCS Central Software, among others.
Affects: Cisco ISE, UCS Central and other listed Cisco products
GitHub launches npm package firewall that blocks brand-new versions
The firewall checks npm packages against enterprise policy before install, blocking known malware, critical vulnerabilities and newly published versions. Any developer can enable it by pointing npm at the firewall.
Affects: Teams using npm and GitHub
Unreleased Anthropic AI model chained bugs into working browser and OS exploits
Anthropic says an unreleased model found flaws in Chrome, Safari, Android, Windows and Linux and built working proof-of-concept exploits in the lab. None were seen in real attacks.
Affects: Chrome, Safari, Android, Windows, Linux
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.