Thank You for Patching

FortiOS CVE-2025-61624: an April fix, an October KEV entry, and an implant called PEERSTITCH

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. The fix shipped in April. CISA added the bug to KEV on Oct 16 after Unit 42 tied it to PEERSTITCH, an in-memory FortiGate implant that hooks miglogd and iked to wave tagged VPN sessions through.

Affected: FortiOS 7.6.0-7.6.4 and 7.4.0-7.4.9, plus every release of 7.2, 7.0 and 6.4. Those three trains have no fix in their own branch, so you’ll need to migrate to a fixed train. FortiProxy, FortiPAM and FortiSwitchManager are also affected.

Fixed in: FortiOS 7.6.5+ / 7.4.10+, FortiProxy 7.6.5+ / 7.4.12+, FortiPAM 1.7.1+, FortiSwitchManager 7.2.8+ / 7.0.7+.

Context: Exploitation needs admin access. In the Unit 42 case, the attackers got that by compromising FortiManager (FortiJump) and stealing configs and credentials. Patch, rotate admin and VPN credentials, and check how exposed your FortiManager is. Fortinet also offers virtual patch FG-VD-59270.0day.

Sources: FortiGuard FG-IR-26-122, The Hacker News, SecurityWeek.

October 2026 Patch Tuesday: 1,413 fixes, one exploited zero-day, and an Exchange hangover

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. The Windows cumulative updates fix CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass that is being exploited. CISA added it to KEV with a due date of October 16. Install it. Then work through the side effects below by role instead of holding the whole estate.

The numbers

Microsoft fixed 1,413 CVEs this month (SecurityWeek, CyberScoop, Malwarebytes). BleepingComputer counts 1,411 because it only includes the Patch Tuesday releases themselves. Either way it’s a record. CyberScoop says it beats Microsoft’s previous full-year record of 1,261, set in 2020, and SecurityWeek says it’s more than all of 2025 combined. One month. BleepingComputer counts 70 critical.

Exploited: CVE-2026-96951 (Windows Shell MotW bypass).
Publicly disclosed: CVE-2026-108398 (.NET Framework WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS).
KBs: KB5127648 (Win11 24H2/25H2/26H2), KB5126653 (Win11 23H2), KB5126657 (Win10 21H2/22H2), KB5126646 (WS2025), KB5126655 (WS2022), KB5126651 (WS2019), KB5126868 (WS2016).

What breaks

On-prem Exchange (Deploy with care, confirmed by Microsoft). The October Windows Server updates (KB5126651, KB5126868, KB5126655, KB5126646) cap Endpoint Mapper lookups. On busy Exchange 2016/2019/SE servers, the default 512 RPC contexts fill in about a day. Then OWA throws MapiExceptionMdbOffline, queues fill with 432 4.3.2, and mail sits in Outbox. Microsoft says don’t uninstall. Set EpmapSavedContextCap to 65536 under HKLM\SOFTWARE\Microsoft\Rpc and restart; you can set it before you install. No fix is imminent. (Exchange team blog, r/sysadmin)

PEAP-MSCHAPv2 SSO (Deploy with care). NTLMv1 SSO blocking is now enforced by default on Win11 24H2+ and WS2025 when Credential Guard is off. Only “use my Windows logon” pass-through breaks; typed credentials and machine-certificate auth are fine. About 4 independent megathread commenters plus two threads hit it. Microsoft calls it planned. Use BlockNtlmv1SSO=0 as a dated exception (event 4024 = audit, 4025 = block), and plan EAP-TLS. (KB5127648, MS Q&A)

Boot failures (Deploy with care, reported, not confirmed). There are 6 independent first-hand reports of KB5127648 failing at the finalizing reboot: 0xc000000d, winload.efi errors, or BitLocker recovery. They’re mostly Dell, plus Dynabook Tecra A60-M. One fleet of about 5,000 lost “a few.” Pilot by model and update firmware first. The workaround is DISM /revertpendingactions plus bcdboot from WinRE. (r/sysadmin, Tech Community)

Smaller items:

Smart App Control can’t be turned back on after KB5127648. There’s a registry workaround.
Non-admin RDP fails with 0xC000000D on hosts with Administrator protection.
Always On VPN automatic protocol selection is still broken. Microsoft marked it resolved, then reverted that on Oct 19.
Born reports install errors 0x800f0845/0x80070306/0x800f0989, and more than 70 Xbox Live 0x87DD0005 complaints. Neither is confirmed.

The rumor check

We were told October “broke security software and Classic Outlook.” Here, “security software” means physical security: Lenel, Genetec and similar. Here’s what the sources support:

Record count: true. See above.
Physical security software: not confirmed for October as such. There is one real thread, and it’s older.
- About 5 independent Reddit reports say older LenelS2 OnGuard (8.1 and earlier) loses its Login Driver/database connection after the August 11, 2026 cumulative updates, and every CU since, October included.
- LenelS2 hasn’t posted anything official. One second-hand TSG statement says only 8.0 and below are affected, but two posters say 8.1 is too.
- Call: hold those hosts only, isolate them (the CU fixes an exploited zero-day), and upgrade OnGuard.
- I found nothing for Genetec, Milestone, C•CURE 9000, Avigilon or Pro-Watch.
Classic Outlook: not as stated. Classic Outlook has open Microsoft-documented problems: stale shared-mailbox search, a shared-calendar crash, and Kaspersky crashes. None of them come from the Windows update. If your Outlook clients are stuck in Outbox, look at your Exchange servers first.

Housekeeping

AskWoody is at MS-DEFCON 2 (defer until at least Oct 27).
Windows Server 2022 left mainstream support on Oct 13.
Canadian time zone updates land before Nov 1.

Full tracker: Patch Watch.

PAN-OS CVE-2026-0322: root on your firewall, exploited, and php2shell is next in line

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. An authenticated, high-privilege attacker who can reach the management interface can run code as root. Palo Alto reports “very limited” exploitation and has published IoC IPs. CISA added it to KEV on Oct 14.

Fixed in: 12.2.4; 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; 11.2.16; 11.1.16-h3; 10.2.18-h12, plus branch hotfixes. Cloud NGFW and Prisma Access are not affected.

Workaround: The vendor says there isn’t one. Threat IDs 510046/510047 give limited coverage, and only if you decrypt management traffic. If your management plane is reachable from the internet, you already know what this paragraph is about to say.

This is the same management UI that’s exposed to php2shell, which has no fixed build until Oct 26-30, so lock down management access now.

Sources: Palo Alto advisory, BleepingComputer.

php2shell: patch PHP now, and remember how many of your boxes quietly run it

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. CVE-2026-109618 and CVE-2026-109619 together give an unauthenticated attacker remote code execution on any PHP install that serves web requests. Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix, and CISA says to take those systems offline until you’ve patched.

Exploitation: CISA’s alert, revised Oct 23, says successful exploitation had not been observed at publication. Unit 42 has seen a proof of concept. One post on X claims it’s already being exploited. I haven’t seen that corroborated.

Where PHP hides:

PAN-OS/Panorama management UI, all releases from 10.2 to 12.2. There’s no fixed build yet. Hotfixes are due Oct 26-30. Until they land, restrict management access to a jump host and remove management profiles from untrusted interfaces. GlobalProtect is not affected. (ctipilot write-up of the PAN advisory)
pfSense. Update from SSH or the console, not the GUI, and force-reinstall WireGuard or it may not come back up. Don’t do it over the WireGuard tunnel you’re connected through. (Netgate)
Synology. Update PHP in Package Center. MailStation needs a manual update. (Synology)
TrueNAS. The platform isn’t affected, but PHP-based catalog apps are, so update those images. (TrueNAS)

Sources: CISA, PHP Foundation, CERT/CC VU#763488.

Two more edge boxes under fire: Cisco Secure Email Gateway and Ivanti Connect Secure

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now on both. Both are being exploited, and both were added to KEV in the same week.

Cisco SEG, CVE-2026-76519. A crafted attachment lets an attacker write files and run commands as root. It affects gateways that have File Reputation enabled and run Content Scanner Tools earlier than 25.3.0.5525. Cisco is aware of active exploitation, and Shadowserver tracks nearly 300 exposed instances.

Check contentscannerstatus and update.
Review the System Security logs.
If you find signs of compromise, rotate credentials and crypto material.
Confirm the fixed AsyncOS build in the advisory itself. The build numbers I have come from summaries. (Cisco, BleepingComputer)

Ivanti Connect Secure, CVE-2026-104935. An authentication bypass that leads to unauthenticated command execution, exploited as a zero-day. CISA added it to KEV on Oct 13 with a three-day deadline.

Fixed in 22.8R2.5, 25.1.1.2 and 25.1.3.x.
Run Ivanti’s integrity checks. You know the drill by now; Ivanti certainly does.
Versions come from summaries of the CISA and NCSC-NL alerts, so confirm them against Ivanti’s advisory. (CISA, BleepingComputer)

Debian 13 kernel 6.12.111 and Broadcom NICs: Proxmox already did this one

Sat, 24 Oct 2026 00:00:00 GMT

Call: Hold on Debian 13 hosts with Broadcom NetXtreme-E (bnxt_en) NICs. This is reported, not confirmed: there are two merged Debian bugs, #1149564 and #1149790, and one of the reporters runs a fleet of identical servers. Stay on 6.12.107+deb13, which the reporter confirms is stable.

Symptoms: AMD-Vi IO_PAGE_FAULT from bnxt_en, “Abandoning msg … firmware status: 0x2000001”, and hwrm errors. One port dies, and later the other. It happens idle or under load. Firmware updates didn’t help.

Why it looks familiar: Proxmox kernel 7.0.14-20/-21 hit the same bnxt_en DMA padding regression in September. Proxmox fixed it in -22 and -23 with the upstream patch “bnxt_en: fix DMA mapping length for padded small packets.” If you run PVE, move to 7.0.14-23 or later and drop your kernel pins. If you run plain Debian, wait for a kernel that carries that patch.

Sources: debian-kernel list, Debian #1149564, Proxmox pve-devel.

Old OnGuard vs new Windows: the Login Driver can't find its way home

Sat, 24 Oct 2026 00:00:00 GMT

Call: Hold, only on hosts running OnGuard 8.1 or older. This is reported, not confirmed. I count about 5 independent reports across three r/Lenel threads. LenelS2 hasn’t posted anything official, and it isn’t on Microsoft release health.

Trigger: the August 11, 2026 cumulative updates and every one since, because they’re cumulative. October’s KB5127648 and its Server versions are included.

KB5120418 (Server 2016 / Win10 1607)
KB5120238 (Server 2019)
KB5120242 (Server 2022)
KB5120233 (Server 2025)
KB5120249 (Win10 22H2/21H2)
KB5121003 (Win11 24H2/25H2)
One user also names KB5120710.

What breaks:

OnGuard asks for the “Login Driver Location” and can’t reach its database.
Event ID 9 shows up in the RPC-Events log, from SystemAdministration.exe.
Users have narrowed it to the 32-bit RPC runtime: SysWOW64\rpcrt4.dll 10.0.26100.8875 works and 10.0.26100.9168 doesn’t.
Re-imaged machines get hit hardest, because current install media has the updates slipstreamed in. There’s nothing to uninstall.
One integrator saw about 8 customers in a single day.

Versions:

7.4, 7.5, 7.6 and 8.0 are affected.
8.1 is disputed: two posters say it’s affected and one says it’s fine. A second-hand LenelS2 TSG statement, relayed by ckirejevas, says only 8.0 and below are affected and 8.1-8.4 are not. Until LenelS2 says so in writing, treat 8.1 as at risk.
LenelS2 lists 8.0 end of support in Aug 2024 and 8.1 in Dec 2025.

Don’t hold quietly. The October CU fixes CVE-2026-96951, a Windows Shell zero-day that is being exploited and is on CISA KEV. A held OnGuard box needs compensating controls:

No email or web browsing on it.
Segment it from user networks.
Write down the date the hold ends.

What people are doing:

Rollback: uninstall the update on server and clients, then pause updates. This works if the update can be uninstalled.
Don’t: some users swapped rpcrt4.dll back to the 8875 build. That’s unsupported, it rolls back RPC security fixes, and it puts a hand-edited system DLL on the box that unlocks your doors.
Fix: upgrade to a supported OnGuard release under your SSA, and confirm the path with LenelS2 support.

Everyone else: I found no October breakage for Genetec, Milestone XProtect, C•CURE 9000, Avigilon or Pro-Watch. Honeywell hadn’t posted its October Pro-Watch tested-patch list as of Oct 24.

Sources: r/Lenel 1vneny5, r/Lenel 1ws95ac (r/accesscontrol cross-post), r/Lenel 1vx5z5d (r/accesscontrol cross-post), LenelS2 end-of-life notices, Honeywell Pro-Watch patch testing notices.

Windows 11 26H2 on Falcon fleets: hold the feature update, not the security update

Sat, 24 Oct 2026 00:00:00 GMT

Call: Hold the 26H2 feature update on CrowdStrike Falcon fleets. Keep installing the October security update on 24H2 and 25H2. This rests on one source: Penn ISC says 26H2 doesn’t yet have Falcon sensor support and they haven’t cleared it. I didn’t read a CrowdStrike statement this run, so treat this as reported, not confirmed (1 source).

Scope: This is about the 26H2 feature update, not the October security update. I found no EDR or AV crash tied to KB5127648. Separately, Trellix fixed BSODs on recent Windows updates in EDR client 4.2.3.6356 on Oct 1.

Do: Defer 26H2 in Intune or WUfB until your EDR vendor lists support for it. Asking the EDR vendor first is old advice that still holds.

Sources: Penn ISC, Trellix release notes.

KB5127648 boot failures: reported, not confirmed, worth a pilot ring per model

Sat, 24 Oct 2026 00:00:00 GMT

Call: Deploy with care. This is reported, not confirmed. I count 6 independent first-hand reports, and Microsoft hasn’t put it on release health as of Oct 24. Don’t hold the exploited Shell fix across the whole estate over this. Do pilot by hardware model.

Symptoms: At the finalizing reboot, affected machines show:

0xc000000d before the kernel loads, or “winload.efi missing or contains errors”
an Automatic Repair loop
a BitLocker recovery prompt

One organization saw it without full-disk encryption.

Who’s reporting it:

A Tech Community admin with about 50 Dells.
An admin who also names HP and Lenovo.
An MSP with two OptiPlex 7010 customers.
An AWS-hosted organization.
A Dell Community poster.
An r/sysadmin admin with a ~5,000-device fleet where a few Dell and Dynabook Tecra A60-M machines failed. It’s a small fraction, which is the usual shape of a firmware interaction.

A separate r/sysadmin thread reports sleep hangs and failed or rolled-back installs, and one commenter blames an Intel Modern Standby driver. That’s a different symptom, so it isn’t counted above.

Workarounds from the community, not from Microsoft:

From WinRE, run DISM with /revertpendingactions against the offline image, rebuild the boot files with bcdboot, and pause updates.
Or uninstall the update from WinRE.
Update BIOS and firmware before reapplying it.
Check ESP free space and Secure Boot events 1795/1796/1801.
Before any of that, make sure your recovery keys are in AD or Entra.

Sources: Tech Community thread, Dell Community, r/sysadmin 1xdcuys, r/sysadmin 1xasn7m, pcmasterinsider.

October Windows Server updates vs on-prem Exchange: one registry value, set it first

Sat, 24 Oct 2026 00:00:00 GMT

Call: Deploy with care. Install the October Windows Server CU: KB5126651 (2019), KB5126868 (2016), KB5126655 (2022) or KB5126646 (2025). It carries an exploited zero-day fix. But set the registry value below before you do.

What breaks: Microsoft has confirmed this, on release health and on the Exchange team blog. The update limits Endpoint Mapper lookups. On a busy server, the default 512 RPC contexts fill up in about a day, and then:

OWA throws MapiExceptionMdbOffline (ec=1142) and logs Event 1006.
Queues fill with 432 4.3.2 MapiExceptionMdbOffline.
Outlook clients keep mail stuck in Outbox.
Replication and DAG quorum get unhappy.

A reboot clears it until the contexts fill up again. Some servers never see it at all. The October Exchange SU isn’t needed to trigger it.

Fix:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

Restart and monitor. Raise the value if it comes back. Microsoft: don’t uninstall the update, and no fix release is imminent.

This is also the real story behind “Patch Tuesday broke Outlook.” It’s the server, not the client.

Sources: Exchange team blog, Microsoft Exchange article, release health, r/sysadmin thread, October megathread.

Your PEAP-MSCHAPv2 Wi-Fi stopped auto-connecting. That's not a bug, that's the roadmap.

Sat, 24 Oct 2026 00:00:00 GMT

Call: Deploy with care. KB5127648 and KB5126646 enforce NTLMv1 SSO blocking by default on machines where Credential Guard is off and BlockNtlmv1SSO is unset.

What breaks: only SSO pass-through, the “use my Windows logon” option for PEAP-MSCHAPv2 and EAP-MSCHAPv2 on Wi-Fi, wired 802.1X and VPN. Typed credentials still work, and so does machine-certificate auth. If your network already does EAP-TLS, you can stop reading and feel smug.

Microsoft lists this as a planned change, not a known issue, so no fix is coming. About 4 independent commenters in the r/sysadmin megathread hit it, plus two dedicated threads and a Microsoft Q&A post.

Temporary: Set DWORD BlockNtlmv1SSO = 0 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 (audit mode), and push it by GPO before the update lands. Event 4024 means audit and 4025 means blocked, so you can see who still depends on NTLMv1. Put an expiry date on that exception.

Permanent: EAP-TLS, PEAP-TLS, or TEAP with TLS.

Sources: KB5127648, Windows message center, Microsoft Q&A, r/sysadmin 1x6oy6g, r/sysadmin 1x5mxs1, October megathread, Extreme Networks.