Microsoft fixes Always On VPN failures caused by September Windows 11 updates
Microsoft says it has resolved Always On VPN connection failures triggered by the September 2026 Windows 11 security updates. Clients you held back or worked around can now be revisited.
Affects: Windows 11 clients using Always On VPN
Maximum-severity GitLab flaw now exploited in the wild, says CISA
CISA says attackers are exploiting a max-severity GitLab bug patched earlier this month. Alpine Linux rebuilt its GitLab server after an attempted RCE attack on 20–21 October.
Affects: Self-managed GitLab servers
WordPress core RCE flaw hit by 63,000 attack attempts in 24 hours
Attackers began exploiting a high-severity remote code execution bug in WordPress core soon after patches landed. The flaw has no CVE and affects versions from 4.7.
Affects: WordPress core 4.7 and later
TeamViewer bug lets a controlled machine attack the technician connecting
A malicious or compromised remote host could attack the computer that connects to control it. TeamViewer has fixed the flaw, which matters for engineers connecting to untrusted client machines.
Affects: TeamViewer on technician (viewer) machines
Fake IT help desk callers are tricking staff into remote access sessions
Cisco Talos found attackers posing as help desk staff by phone, email and Teams, needing little more than names and email addresses. Staff were talked into opening remote sessions.
Affects: Client staff and MSP help desks
Ivanti Connect Secure exploit chain gives attackers root; CISA lists more flaws
Attackers chained three Ivanti VPN flaws to get unauthenticated root, including on a patched appliance. CISA added two more to KEV, with deadlines of 2 and 13 November. Fixes for the whole chain are out.
Affects: Ivanti Connect Secure VPN appliances
Brotli decoder flaw puts Node.js, .NET, Python and Palo Alto products at risk
A critical memory-corruption bug in Google's Brotli library can crash apps or allow remote code execution. Esri reports CISA KEV listing on 27 October. Public PoCs exist.
Affects: Brotli 1.0.3–1.2.0; Node.js, .NET, Python packages, vendor appliances
Critical PHP remote code execution flaws hit Cisco and Palo Alto products
The PHP Foundation released a critical security update on 21 October for two RCE bugs. Cisco and Palo Alto have both published advisories on affected products.
Affects: PHP web servers and Cisco and Palo Alto products embedding PHP
Linux kernel MPTCP flaw allows remote root on exposed servers
Anthropic researchers built an exploit for a critical kernel bug that lets unauthenticated attackers run commands as root on servers with Multipath TCP listeners.
Affects: Linux servers running MPTCP listeners
Trojanised Claude Code extension on Cursor planted SSH backdoors
A malicious Claude Code extension update was live on Cursor's marketplace for about 11 hours on 29 October, exposing up to 5,000 developers. It installs persistent SSH backdoors.
Affects: Developers who installed the extension on Cursor or Open VSX (version 2.1.313)
FBI blames North Korea for record $6.3 billion Binance crypto heist
The FBI attributed the theft to TraderTraitor. Binance's early findings point to a compromised DevOps engineer's laptop, a reminder of how one endpoint can open the door.
Affects: Binance; lesson for any privileged admin endpoint
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.