Daily Brief

ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

ConnectWise targets Oct 26 to start restoring Cloud Backup (SkyKick) after its app credential was abused in Microsoft 365 tenants. App IDs, IOCs and checks before reconnecting.
Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check

Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check

GitLab CVE-2026-110264, exploited VeloCloud CVE-2026-114625, the LiteLLM 1.107.0 malware and PHP2Shell attacks from Oct 17, with first steps for each.
PHP2Shell attacks began four days before the patch. Check your PHP servers’ logs back to October 17

PHP2Shell attacks began four days before the patch. Check your PHP servers’ logs back to October 17

Amazon saw PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploit attempts on Oct 17, four days before PHP 8.5.12 and 8.4.27. Hunt web logs from Oct 17.
A fake LiteLLM release stole AI and cloud keys for two hours. Check whether anything installed 1.107.0

A fake LiteLLM release stole AI and cloud keys for two hours. Check whether anything installed 1.107.0

Malicious LiteLLM 1.107.0 wheels and Docker images stole credentials on Oct 21. Find cook.pth and sitecustomize.py, rebuild on 1.106.2 and rotate every key.
Attackers are turning read-only VeloCloud logins into superusers. Upgrade your on-prem orchestrator now

Attackers are turning read-only VeloCloud logins into superusers. Upgrade your on-prem orchestrator now

Arista says CVE-2026-114625 (9.9), an SQL injection in on-prem VeloCloud Orchestrator, is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and block two IPs.
Self-hosted GitLab servers can be made to run an outsider’s code. Upgrade to 19.5.1, 19.4.3 or 19.3.6 today

Self-hosted GitLab servers can be made to run an outsider’s code. Upgrade to 19.5.1, 19.4.3 or 19.3.6 today

CVE-2026-110264 (CVSS 10.0) lets unauthenticated attackers run code on self-managed GitLab CE/EE. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a backport and check the logs.
Thursday’s brief: Fortinet’s firewall fixes land today, then Cisco Expressway, eMudhra certificates and PHP2Shell

Thursday’s brief: Fortinet’s firewall fixes land today, then Cisco Expressway, eMudhra certificates and PHP2Shell

Fortinet’s Oct 22 FortiOS fixes, Cisco Expressway CVE-2026-76466, eMudhra CVE-2026-111943 and PHP2Shell CVE-2026-109618, with first steps for each.
PHP2Shell patches are out and attackers are already trying them. Confirm every PHP server runs the new version

PHP2Shell patches are out and attackers are already trying them. Confirm every PHP server runs the new version

PHP2Shell CVE-2026-109618 and CVE-2026-109619 (9.2) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploit attempts have started; update and restart workers.
Browsers already block eMudhra’s broken certificates. Your servers, containers and Go apps need an update to do the same

Browsers already block eMudhra’s broken certificates. Your servers, containers and Go apps need an update to do the same

Eight eMudhra intermediate CA keys were recoverable. Go fixed CVE-2026-111943 in 1.27.3/1.26.10; update ca-certificates, Java, Node and certifi, then rebuild.
Clustered Cisco Expressway servers can be taken over as root without a login. Upgrade to X15.5.20, then Unified CM

Clustered Cisco Expressway servers can be taken over as root without a login. Upgrade to X15.5.20, then Unified CM

CVE-2026-76466 (9.8) lets unauthenticated attackers run root commands on clustered Cisco Expressway. Upgrade to X15.5.20 and Unified CM to 15SU5.
Fortinet ships critical FortiGate fixes today and won’t say what they fix until November 10. Upgrade internet-facing firewalls first

Fortinet ships critical FortiGate fixes today and won’t say what they fix until November 10. Upgrade internet-facing firewalls first

Fortinet releases FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 plus FortiManager and FortiAnalyzer fixes on Oct 22; advisories follow Nov 10. Patch edge firewalls first.
Wednesday’s brief: PHP’s 10 AM security release, then Oracle’s October patches, Chrome 156 and Pillow

Wednesday’s brief: PHP’s 10 AM security release, then Oracle’s October patches, Chrome 156 and Pillow

PHP’s critical release at 14:00 UTC, Oracle CPU CVE-2026-101809, Chrome 156 CVE-2026-113072 and Pillow CVE-2026-112398, with first steps for each.
Python apps that accept image uploads need Pillow 13. Two of its fixes stop code execution from a single file

Python apps that accept image uploads need Pillow 13. Two of its fixes stop code execution from a single file

CVE-2026-112398 and a 9.8 multi-frame bug let crafted images run code in Pillow 12.3.0 and older. Upgrade to 13.0.0 or limit Image.open formats.