Microsoft quietly fixes Windows troubleshooter privilege escalation bugs
Microsoft fixed a privilege escalation flaw in a Windows troubleshooter. An Australian researcher earned US$16,000 in bounties for two diagnostics bugs.
Affects: Windows systems
Microsoft fixes Smart App Control broken by October Windows update
A known issue stopped some users activating Smart App Control after installing the October 2026 KB5127648 Windows 11 update. Microsoft says it is now resolved.
Affects: Windows 11 with KB5127648
Over 1,000 GitLab servers still open to exploited RCE flaw
A maximum-severity GitLab flaw is being actively exploited for remote code execution. Alpine Linux rebuilt its GitLab server and reset passwords after an attempted attack on 20–21 October.
Affects: Internet-exposed self-hosted GitLab servers
Synology warns of C3RB3R ransomware hitting NAS devices
Synology says attacks using C3RB3R ransomware against its NAS appliances are surging. NAS boxes commonly hold client files and backups, so they're a high-value target.
Affects: Synology NAS devices
Fake IT support on Teams used to steal AD CS certificates
Attackers posing as IT support on Teams got staff to grant remote control. They then abused weak AD CS settings to get certificates for privileged accounts, including a domain controller.
Affects: Microsoft Teams tenants and Active Directory Certificate Services
Google dismantles 1.3 million-device XCPE Android TV box botnet
Google took down the servers behind XCPE, a backdoor in set-top box firmware. It says maker Videostrong shipped the devices infected on purpose, and has banned the company.
Affects: Videostrong Android TV boxes
Ivanti Connect Secure: two more chained zero-days patched
Ivanti released fixes for two more Connect Secure flaws, chained with a third for unauthenticated root access since at least 1 October. CISA lists CVE-2026-111357 as exploited.
Affects: Ivanti Connect Secure (ICS) VPN gateways
Critical Linux kernel TCP flaw rated CVSS 9.8
Fortinet's PSIRT lists CVE-2026-98432, a kernel race condition in IPv4 SYN handling, as a remote code execution risk. SANS notes it relates to the Multipath TCP code. No exploitation reported in the candidates.
Affects: Linux kernel systems and appliances
Palo Alto assesses impact of two critical PHP flaws
Palo Alto Networks published an advisory on how two critical PHP vulnerabilities affect its products. The snippet doesn't say which products are affected or whether fixes exist.
Affects: Palo Alto Networks products (see advisory)
Canonical LXD and MicroCloud flaw lets attackers skip private key
A CVSS 10.0 flaw lets an attacker log in as a trusted client without its private key. They need network access to the HTTPS API and the client's public certificate.
Affects: Canonical LXD and MicroCloud
Critical Langflow flaws allow unauthenticated code execution
Two critical Langflow flaws let a remote attacker with no account bypass authentication or run arbitrary code on the server. IBM disclosed them last week.
Affects: Langflow servers, every release from 1.0.0 (upper bound not shown)
Anthropic's Cursor VS Code extension backdoored for nearly 12 hours
Attackers compromised the verified Anthropic extension on Cursor in a supply-chain attack. It's still unknown how they got into the account. Anthropic blames a malicious actor.
Affects: Cursor users with the Anthropic extension
Second wave of fridge hacks spoils food in European supermarkets
Three weeks after the French attack, hackers remotely changed refrigeration settings at stores in Belgium, Luxembourg and Sweden, spoiling food. A reminder to check remote access on building and OT systems.
Affects: European supermarket chains' refrigeration systems
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.