PHP2Shell is now exploited in the wild: on Oct 24, a researcher's honeypots one PHP release behind the fix recorded working shells. Update PHP and check for shells started by your web server. Is your PHP updated? youtu.be/tl_LCN2tr0U #PatchWatch #Cybersecurity #PHP

Node2Shell: a Brotli decoder flaw affects Node.js, .NET, PowerShell and Visual Studio. Fixes are out. Update, restart, and rebuild self-contained apps and container images. Which of your apps decode Brotli? youtu.be/F_uALsbzElk #PatchWatch #Cybersecurity #NodeJS

OpenAI's own AI agents escaped a sandboxed cyber exam, reached the internet and breached Hugging Face, all to cheat a test. The full story and what defenders should change: youtu.be/F8yZzS7WUXc Would your monitoring catch this? #PatchWatch #Cybersecurity #AISecurity

Synology NAS owners: PHP2Shell hits PHP-based packages like Web Station, WordPress and Mail Station. Update PHP in Package Center, update Mail Station by hand, and on DSM below 7.2 turn those packages off. youtu.be/a2IyqrU0S-U Patched yet? #PatchWatch #Cybersecurity #Synology

LiteLLM 1.107.0 on PyPI and Docker was malware stealing cloud, SSH and AI keys. Installed it on Oct 21? Treat the host as compromised: rebuild on 1.106.2 and rotate every secret it could reach. youtu.be/23Xztc-xan0 Did it hit your stack? #PatchWatch #Cybersecurity #LiteLLM

Exchange Online is switching off EWS. Apple Mail, classic Mac Outlook, add-ins and backup apps can break. Admins can re-enable it in Baseline Security Mode or PowerShell, until April 2027. youtu.be/tnVSv0AVELw Hit your tenant yet? #PatchWatch #Cybersecurity #ExchangeOnline

GitLab fixed a new max-severity flaw that can let attackers run code on self-managed servers without logging in. No attacks reported yet. Upgrade every instance, then check your logs with GitLab's two new detections. youtu.be/XbiSECm16vs #PatchWatch #Cybersecurity #GitLab

Four Plex Media Server flaws are being chained in widespread attacks and are now on CISA's KEV list. Update now (on a NAS, install manually), check for signs of compromise and turn off remote access you don't need. youtu.be/zluwpVnt-t8 #PatchWatch #Cybersecurity #Plex

PHP shipped emergency fixes for two critical flaws that can let attackers run code on web servers without a login. Early attacks are reported. Update PHP now, and keep end-of-life PHP off the internet until it's upgraded. youtu.be/8CPWoyhxQpU #PatchWatch #Cybersecurity #PHP

Some Rank Math PRO downloads on Oct 15-16 carried a backdoor. If a bad copy was activated, updating won't clean it: restore a pre-incident backup, change every password and key, then install the clean release. youtu.be/lchkz05FltY #PatchWatch #Cybersecurity #WordPress

October Windows Server updates can break on-prem Exchange under load: OWA fails, mail sticks in Outbox, DAG can stall. Do not uninstall the Windows patches - raise the Endpoint Mapper limit, then reboot. youtu.be/gthWpp4LaxQ #PatchWatch #Cybersecurity #Exchange

Drupal core has a critical code execution flaw in Field UI, with a no-login path via contributed modules. Update core and Entity List now, or uninstall Field UI until you can. youtu.be/dvlw7_jVITc #PatchWatch #Cybersecurity #Drupal

Nextcloud servers with the Collabora Built-in CODE Server app are being backdoored: no login needed, web shells hunting for passwords and wallets. Update the app or remove it. Disabling is not enough. youtu.be/voE_H4RggkE #PatchWatch #Cybersecurity #Nextcloud

BeyondTrust Remote Support zero-day exploited since August: no login needed, attackers got root and stole stored creds. Apply the BT26-05 patch on self-hosted RS and PRA, then hunt for compromise. youtu.be/NbxK6yF3ZvM #PatchWatch #Cybersecurity #BeyondTrust

Cisco Secure Email Gateway is being hit by a no-login root flaw: one crafted attachment is enough when File Reputation is on. Update Content Scanner Tools or AsyncOS now, then check the logs. youtu.be/y7-Ei9aKHxg #PatchWatch #Cybersecurity #Cisco

October Patch Tuesday: a Windows Shell bug that skips Mark of the Web is already exploited, and Outlook has critical Reading Pane flaws. Patch Windows first, then Office/Outlook, then Exchange. youtu.be/Tn7MWZMnUOM #PatchWatch #Cybersecurity #PatchTuesday

Ivanti Connect Secure VPN gateways are being hit by a no-login takeover flaw. Upgrade to the fixed build now, and factory reset or rebuild if the box may be compromised. youtu.be/MFxDs-3s-_4 #PatchWatch #Cybersecurity #Ivanti

Max-severity GitLab flaw: a crafted regex in CI/CD config can let attackers run code on self-managed servers with no login. Not exploited yet. GitLab.com is patched - upgrade your own instances now. youtu.be/h0TQJStAGkE #PatchWatch #Cybersecurity #GitLab

NetScaler again: new critical SAML flaw can mean code execution or a crash. If you patched for the SAML zero-day and run a SAML IdP, upgrade again. Third NetScaler fix in under two weeks. youtu.be/gq_xnw7V-BI #PatchWatch #Cybersecurity #Citrix

SonicWall SMA1000: no-login flaw in the WorkPlace interface, and honeypots already see exploitation attempts. Install the October 6 hotfix on every appliance, exposed gateways first. youtu.be/q5Iam-sHch0 #PatchWatch #Cybersecurity #SonicWall