⚡ THE ONE THING TODAY
Today, inventory every internet-facing firewall, VPN, GitLab and VMware ESX instance across your clients, confirm patch levels against the Cisco, GitLab and Broadcom fixes, and restrict management interfaces to trusted admin networks.
Microsoft fixes Remote Desktop failures for non-admin users
Recent Windows updates stopped non-admin users connecting via Remote Desktop when Administrator protection was enabled. Microsoft says the known issue is now resolved.
Affects: Windows devices with Administrator protection enabled
Windows 11 preview update KB5127936 brings 41 changes
The optional preview cumulative update for Windows 11 25H2 and 26H2 includes File Explorer and Cloud rebuild improvements.
Affects: Windows 11 25H2 and 26H2
GitLab servers hit by CVSS 10 unauthenticated code execution flaw
An unauthenticated attacker can run code on a GitLab server using a crafted regular expression. It's on CISA's KEV list, and Alpine Linux saw an attempt a week after the fix.
Affects: GitLab Community and Enterprise Edition (self-hosted)
China-linked attackers exploited a VMware ESX zero-day
CISA added a Broadcom VMware ESX flaw to KEV after CrowdStrike tied it to a China-nexus actor using it to reduce audit trail visibility.
Affects: Broadcom VMware ESX hosts
Linux kernel TCP flaw rated 9.8 affects Ubuntu and RHEL
The kernel's CVE team rates CVE-2026-98432 at 9.8 out of 10. Ubuntu, Red Hat Enterprise Linux and other distributions are affected.
Affects: Ubuntu, RHEL and other Linux distributions
319 Chrome extensions hijack searches for 13.4 million users
A campaign redirected users' searches through tracking servers to earn advertising revenue from Bing and Yahoo.
Affects: Chrome users with the affected extensions installed
PHP2Shell flaws under attack, hitting firewall management interfaces
PHP's critical remote code execution bug is on CISA's KEV list. Palo Alto says attackers are hitting exposed management interfaces, and some chain it with the Linux 'Fragnesia' kernel flaw.
Affects: PHP-based web apps and appliance management interfaces (Palo Alto, Cisco products)
Cisco ASA and FTD firewalls being crashed via VPN zero-day
Attackers are exploiting a flaw to remotely reload Cisco ASA and FTD firewalls without logging in. Cisco has released patches, and CISA's remediation deadline is 1 November.
Affects: Cisco Secure Firewall ASA and FTD software
Cisco SD-WAN flaw used to plant KeyDrift key-stealing malware
Attackers exploited CVE-2026-20127, an authentication bypass fixed in February, to install malware that copies the keys encrypting traffic between sites.
Affects: Cisco Catalyst SD-WAN Controller, Manager and Validator
Node.js security fixes cover Brotli, DNS and TLS flaws
Node.js shipped fixes on 21 October for 22.x, 24.x and 26.x. Palo Alto rates the Brotli flaw critical for its products, and Cisco and Fortinet have published advisories.
Affects: Node.js 22.x, 24.x, 26.x and vendor products embedding it
Fake ChatGPT and Claude desktop apps deliver crypto miners
Fake GitHub projects posing as desktop ChatGPT and Claude apps install a malware chain ending in a crypto miner, using signed executables. Check Point has tracked it for two months.
Affects: Users downloading AI desktop apps from GitHub
Defence mandates move off VMware before licence bill doubles
Defence is directing a move off VMware ahead of its licence bill doubling. It's a signal for clients facing similar Broadcom renewals.
Affects: VMware customers facing licence renewals
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.