Johan Arwidmark

Systems management and Imaging expert. Check out our Office Hours, Courses and Masterclasses on #msintune #configmgr #osd #mdt

[VideoLAN @videolan]

VideoLAN services are back after numerous upgrades, after all the PHP, Gitlab, Kernel and other huge security issues of the week.

Today is sysadmin appreciation day :)

(Reminder: people maintaining our infra are volunteers, like all of us)

[Guy Leech @guyrleech]

PowerShell 7.6.8 released
https://t.co/RHrv7ZsIIq

[Richard Hicks @richardhicks]

An update is available for Npcap. Release 1.90 is now available for download. #security https://t.co/35qLDp4shM

[4n6lady @4n6lady]

PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure.

Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now.

https://t.co/Rb1yoaQF7b

[Florian Roth ⚡️ @cyb3rops]

This week has been quite a shitshow already, and there are still 2 days to go

Here’s a quick recap of the security mess we’ve seen in just the last few days:

1. PHP Core RCE (CVSS 9.2)

Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…

Useful links:

Official PHP advisory and patches:
https://t.co/XOos2fsRoy

Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
https://t.co/30YfHmqIcR

Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
https://t.co/XLx8za50cZ

Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
https://t.co/5HdgI3aM0f

Corelight’s open-source Zeek and Suricata detection rules:
https://t.co/eQdkc3vIpM

2. GitLab RCE (CVSS 10.0)

CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.

https://t.co/APW5ihIOZ0

3. Node.js / Brotli RCE

CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.

https://t.co/RUFjjKtfPE

4. DNS-over-QUIC DoS

CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.

https://t.co/DxaIsMF2ZP

5. eMudhra CA disaster

And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.

Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.

Google’s analysis and response:
https://t.co/gvfGdOBibg

Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
https://t.co/K2wxEOneGJ

—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.

We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.

I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.

The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.

Anyway, quite a week. And it’s only Thursday…

[Johan Arwidmark @jarwidmark]

10/21/26 ViaMonstra Academy - Updates and Q&A for ConfigMgr / OSD / Intune https://t.co/mXwfFEcNJX

[php-net @php_net]

PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).

Changelog + downloads: https://t.co/q5agMkUfNe

[HD Moore @hdmoore]

https://t.co/fgE40dHDiy

The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).

[Ars Technica @arstechnica]

The Internet goes on high alert after discovery of 8 compromised TLS certs https://t.co/MjeEwDmNht

[ViaMonstra @viamonstra]

Your Intune policies are configured correctly. So why aren't your devices behaving?

Successful troubleshooting requires more than knowing where to click in the admin center.

Join five Microsoft MVPs and industry experts November 18–20 for Mastering Microsoft Intune Internals & Troubleshooting.

Go beyond the interface. Understand what's happening behind the scenes.

https://t.co/xwtgOSapte

#MicrosoftIntune #Intune #EndpointManagement #ITTraining #ViaMonstraAcademy

[Windows Update @WindowsUpdate]

Quick machine recovery is now supported on Windows Server 2025. With the October 2026 security update, IT admins can enable quick machine recovery to help recover servers from critical boot failures using targeted remediations from Windows Update.
👉https://t.co/8YHjEYtnyk

[Merill Fernando @merill]

I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today.

https://t.co/n5ewnUHA05

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants.

ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.

On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.

Microsoft Defender detects post-exploitation activity with the following alerts:
- Any alert related to "Suspicious sign-in"
- Graph API activity from a Microsoft threat intelligence IP address
- Verified Threat Actor IP

Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities.

We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: https://t.co/zwFyMAzaEV.

Indicators of compromise (IOCs):
- App name: ConnectWise Cloud Backup
- AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae
- Publisher name: SkyKick
- Source IP: 144.172.64[.]128
- User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

[BleepingComputer @BleepinComputer]

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
https://t.co/zGjAgaDBfh

https://t.co/zGjAgaDBfh

[Johan Arwidmark @jarwidmark]

@chrisnack Awesomeness! And good to see you blogging again. I missed you!

[Chris Nackers @chrisnack]

Relaunched my 2009 blog in one day with Claude: 622 posts restored, 923 images rescued from the Wayback Machine, 55 pieces of malware removed, $0 hosting. First post title? "Finally. Again." :)

https://t.co/ZQnehFeDFc

[Merill Fernando @merill]

Did you know in Entra ID there is no API not even internal ones where you could read the password of a user.

That's how it was designed from the ground up for the modern world we live in.

That's why you've never heard of a password dump of Entra ID passwords!

[ViaMonstra @viamonstra]

Tired of troubleshooting #MSIntune through trial and error? Learn what’s really happening behind the scenes and gain the skills to tackle even the toughest issues with confidence. Stop guessing. Start solving. Join @Mister_MDM, @mniehaus, @byteben, @jarwidmark, @AndrewJNet on the #ViaMonstraAcademy Nov 18-20!

https://t.co/xwtgOSapte

#Windows11 #Intune #EndpointManagement #SysAdmin #ITPro #Windows #CloudManagement #DeviceManagement #ITTraining #TechCommunity #Microsoft365 #ITSupport

[Johan Arwidmark @jarwidmark]

@m365show Both :)

[Johan Arwidmark @jarwidmark]

10/14/26 ViaMonstra Academy - Updates and Q&A for ConfigMgr / OSD / Intune https://t.co/aVCZI1DD2X