{"id":6211,"date":"2026-11-01T12:02:33","date_gmt":"2026-11-01T17:02:33","guid":{"rendered":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6211"},"modified":"2026-11-01T12:02:33","modified_gmt":"2026-11-01T17:02:33","slug":"security-operations-weekly-november-1-2026","status":"publish","type":"post","link":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6211","title":{"rendered":"Security Operations Weekly &mdash; November 1, 2026"},"content":{"rendered":"<style>\n.single .entry-title,\n.single .entry-header .entry-title,\n.single .post-title,\n.single header.entry-header h1,\n.single h1.entry-title,\n.single .page-title,\n.post-template-default h1.entry-title,\n.post-template-default .entry-header,\narticle .entry-header,\narticle .entry-title { display: none !important; }\n.single .entry-header { margin: 0 !important; padding: 0 !important; }\n.single .entry-content { margin-top: 0 !important; padding-top: 0 !important; }\n<\/style>\n<table role=\"presentation\" class=\"wrapper\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\">\n<tr>\n<td align=\"center\">\n<table role=\"presentation\" class=\"container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"680\">\n<p>        <!-- Banner --><\/p>\n<tr>\n<td class=\"banner\" style=\"background-color:#0f2c4d;background:linear-gradient(135deg,#0f2c4d 0%,#1e5a8f 50%,#2b8fb3 100%);padding:36px 32px;color:#ffffff;\">\n<p class=\"date\" style=\"color:#ffffff !important;\">November 1, 2026 &middot; Weekly Edition<\/p>\n<h1 style=\"color:#ffffff !important;\">Security Operations Weekly<\/h1>\n<p class=\"tagline\" style=\"color:#ffffff !important;\">Node2Shell patches spread from Node.js to .NET and Python, PHP2Shell got a three-day federal deadline and a long tail of end-of-life PHP, and exploitation is overtaking stolen credentials as a way in. Tailworm, Oracle EBS and Veeam fill the patch queue, fake help desks move to Teams, and Swimlane, FireMon and Sekoia ship agent tooling with human approval built in.<\/p>\n<\/td>\n<\/tr>\n<p>        <!-- At a glance --><\/p>\n<tr>\n<td class=\"content\">\n<h2>This week at a glance<\/h2>\n<p>This was a patch-operations week. Node2Shell, a bug in Google&rsquo;s Brotli decompression library, pulled fixes out of Node.js, Microsoft&rsquo;s .NET, Visual Studio and PowerShell, two Python packages, Bun, Envoy and Istio. Whether it gives reliable code execution is still argued over, but the fix only works once services restart and container images are rebuilt. PHP2Shell moved into its second week with CISA confirming active exploitation and giving federal agencies three days to patch. CSO&rsquo;s reporting shows why the clean-up will take years: 42% of internet-facing PHP hosts run end-of-life branches, and PHP hides inside appliances and OT panels that cannot be patched directly.<\/p>\n<p>The data explains the urgency. Rapid7 sees high-severity flaws exploited about three days after disclosure, LevelBlue&rsquo;s exploitation share of incidents jumped from 4% to 14% in a quarter, and Verizon&rsquo;s DBIR now ranks exploitation ahead of credential abuse. Qualys argues for measuring the window of exposure rather than raw patch counts. The rest of the queue was busy too. Tailscale shipped fixes days after an uncoordinated disclosure of wormable SSH flaws, attackers began probing a 9.8-rated Oracle E-Business Suite bug within a week of the patch, and Veeam fixed critical backup flaws that ransomware crews will want.<\/p>\n<p>On the human side, Arctic Wolf and Cisco Talos both describe fake IT help desks that reach staff over Teams, using little more than names and email addresses, and get a payload running within 15 minutes. A CSO piece asks the follow-up question: where does the response team talk if the attacker can read the chat? The tooling news leaned towards governed agents. Swimlane, FireMon and Sekoia all shipped AI features that keep a person in the approval loop, Microsoft made local AI agent discovery generally available in Defender, and several essays argue that supervising an agent is a skill to test and authorise rather than assume.<\/p>\n<p>            <!-- Watch list --><\/p>\n<div class=\"watchlist\">\n<h2>On our watch list<\/h2>\n<ul>\n<li><strong>Node2Shell in bundled copies.<\/strong> A public tracker still lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as unpatched, and the public proof of concept only works on a weakened build. Watch for fixed releases from those projects and for a reliable exploit against a stock runtime, which would turn a restart-and-rebuild chore into an emergency.<\/li>\n<li><strong>Oracle EBS CVE-2026-101767 moving from probing to compromise.<\/strong> Defused saw exploratory attempts from October 27 and Shadowserver counts more than 670 exposed instances. A KEV listing or an Oracle exploitation notice would confirm it; EBS has been mass-exploited before.<\/li>\n<li><strong>PHP2Shell status for appliances.<\/strong> CSO&rsquo;s sources expect embedded PHP in NAS, firewalls, VPNs, printers and OT HMIs to linger for years. Track vendor advisories for appliances you run, and treat &ldquo;not affected&rdquo; statements like Juniper&rsquo;s Junos note as the exception to confirm, not the default.<\/li>\n<li><strong>More NetScaler advisories.<\/strong> Citrix&rsquo;s reserved CVE range has a gap from CVE-2026-88779 to CVE-2026-88787. A second batch would test whether the 17-day disclosure cadence holds.<\/li>\n<li><strong>Disclosure norms after Tailworm.<\/strong> The report reached Tailscale hours before publication, according to heise. Watch whether other researchers follow the zero-notice model for infrastructure software, and whether headscale users get equivalent fixes on the same timeline.<\/li>\n<li><strong>Exploitation versus phishing in Q4 incident data.<\/strong> LevelBlue had exploitation at 14% of initial access and phishing at 42%; Talos had phishing at 37%. If the gap keeps closing, the help desk and the edge appliance become equally urgent budget lines.<\/li>\n<li><strong>Teams external-access abuse.<\/strong> Arctic Wolf counted 400+ incidents using onmicrosoft.com trial tenants. Watch for Microsoft changes to default external access or trial-tenant trust, and for how its Teams phishing detection, due in targeted release this month, handles first-contact help desk lures.<\/li>\n<li><strong>FireMon&rsquo;s November release.<\/strong> FireMon says its agents never push changes to firewalls on their own. Early customer reports will show whether human-accepted, staged changes actually shorten the policy-change queue.<\/li>\n<li><strong>Defender runtime protection for local agents.<\/strong> Discovery is GA, but runtime protection on Windows is still in preview and risk scoring needs E7 or Agent 365. Watch Ignite for a GA date and licensing changes.<\/li>\n<li><strong>Runtime security consolidation.<\/strong> Upwind turned down Datadog and raised at $3.8 billion. Watch whether Datadog or another observability vendor buys a runtime security company instead, which would change how SOCs source cloud detection.<\/li>\n<\/ul><\/div>\n<p>            <!-- Topic map --><\/p>\n<div class=\"topic-map\">\n              <img decoding=\"async\" src=\"https:\/\/www.cybersecurityinstitute.com\/blog\/wp-content\/uploads\/2026\/11\/topic-map-security-operations-2026-11-01.png\" alt=\"Topic map of this week&rsquo;s Security Operations Weekly themes\" loading=\"eager\"><\/p>\n<p class=\"caption\">This week&rsquo;s topic map: Node2Shell and PHP2Shell patch operations, exploitation data from Rapid7, LevelBlue and Verizon, the Tailworm, Oracle EBS and Veeam patch queue, help desk impersonation over Teams, governed-agent SOC tooling (Swimlane, FireMon, Sekoia, Microsoft Defender) and agent supervision.<\/p>\n<p>              <!-- INTERACTIVE_MAP_LINK_START --><\/p>\n<p style=\"margin:10px 0 0;text-align:center;\"><a href=\"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6210\" target=\"_blank\" rel=\"noopener\" style=\"display:inline-block;padding:8px 18px;background-color:#0f172a;color:#ffffff !important;text-decoration:none;border-radius:6px;font-size:13px;font-weight:600;\">View interactive topic map &rarr;<\/a><\/p>\n<p><!-- INTERACTIVE_MAP_LINK_END -->\n            <\/div>\n<p>            <!-- Article index --><\/p>\n<h2>Article index<\/h2>\n<h4>Node2Shell and PHP2Shell: the second week<\/h4>\n<div class=\"cluster-intro\">Two library-level flaws that sit inside other software. Node2Shell patches spread from Node.js to .NET and Python; PHP2Shell got a three-day federal deadline and a long tail of end-of-life and embedded PHP.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>1. <a href=\"https:\/\/www.securityweek.com\/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages\/\">Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Oct 26, 2026<\/td>\n<\/tr>\n<tr>\n<td>2. <a href=\"https:\/\/federalnewsnetwork.com\/technology-main\/2026\/10\/cisa-gives-agencies-days-to-patch-critical-php-bugs\/\">CISA gives agencies days to patch critical PHP bugs<\/a><\/td>\n<td class=\"src\">Federal News Network<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>3. <a href=\"https:\/\/www.csoonline.com\/article\/4241941\/php2shell-will-persist-in-enterprise-environments-for-years.html\">PHP2Shell will persist in enterprise environments for years<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 29, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Exploitation, prioritisation and the edge<\/h4>\n<div class=\"cluster-intro\">Exploitation is overtaking stolen credentials as a breach cause, and it lands within days. The Qualys piece is an interview with the vendor&rsquo;s own CISO; the NetScaler essay is a contributed column.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>4. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/27\/rapid7-vulnerability-exploitation-trends-q3-2026-report\/\">71% of vulnerability exploitation starts within a week of disclosure<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>5. <a href=\"https:\/\/www.csoonline.com\/article\/4241912\/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches.html\">Vulnerability exploitation rising as the root cause of many breaches<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 29, 2026<\/td>\n<\/tr>\n<tr>\n<td>6. <a href=\"https:\/\/www.securityweek.com\/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal\/\">This is Fine: What NetScaler Zero-Days Tell Us About the New Normal<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>7. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/29\/nathan-smolenski-qualys-ai-vulnerability-management\/\">Qualys CISO on what security teams can do as exploit campaigns grow<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 29, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>The rest of the patch queue<\/h4>\n<div class=\"cluster-intro\">An uncoordinated disclosure at Tailscale, probing against a fresh Oracle E-Business Suite flaw, and critical fixes for backup and routing products.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>8. <a href=\"https:\/\/www.securityweek.com\/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws\/\">Tailscale Rushes Patches After Uncoordinated Disclosure of Tailworm Flaws<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>9. <a href=\"https:\/\/www.securityweek.com\/hackers-start-probing-fresh-oracle-ebs-vulnerability\/\">Hackers Start Probing Fresh Oracle EBS Vulnerability<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Oct 28, 2026<\/td>\n<\/tr>\n<tr>\n<td>10. <a href=\"https:\/\/www.securityweek.com\/adobe-veeam-juniper-networks-patch-critical-vulnerabilities\/\">Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Oct 29, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Help desk impersonation and incident communications<\/h4>\n<div class=\"cluster-intro\">Attackers posing as IT support over Teams and the phone, and how to coordinate a response when your own chat tools may be watched. The CSO channels piece is by the CEO of an incident-response software vendor.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>11. <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/exploit-teams-chat-breach\/\">Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes<\/a><\/td>\n<td class=\"src\">Infosecurity Magazine<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>12. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/30\/cisco-talos-it-help-desk-vishing\/\">Fake IT help desk callers got by on little more than names and email addresses<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 30, 2026<\/td>\n<\/tr>\n<tr>\n<td>13. <a href=\"https:\/\/www.csoonline.com\/article\/4242184\/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them.html\">Everyday channels are available in an incident, but you may not want them<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 30, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>SOC tooling and the market<\/h4>\n<div class=\"cluster-intro\">Launches and funding across SOC automation, firewall policy, security context and runtime security, plus Microsoft&rsquo;s monthly Defender and Sentinel updates. Sekoia and Swimlane items are vendor announcements; the Microsoft posts are product blogs.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>14. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/27\/sekoia-self-hosted\/\">Sekoia introduces self-hosted deployment for organizations with strict data controls<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>15. <a href=\"https:\/\/siliconangle.com\/2026\/10\/27\/exclusive-firemon-unveils-ai-agents-to-handle-the-legwork-behind-firewall-policy-changes\/\">Exclusive: FireMon unveils AI agents to handle the legwork behind firewall policy changes<\/a><\/td>\n<td class=\"src\">SiliconANGLE<\/td>\n<td class=\"dt\">Oct 27, 2026<\/td>\n<\/tr>\n<tr>\n<td>16. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/28\/swimlane-turbine-platform-capabilities\/\">Swimlane connects custom detections to AI-led investigation and response<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 28, 2026<\/td>\n<\/tr>\n<tr>\n<td>17. <a href=\"https:\/\/techcrunch.com\/2026\/10\/28\/upwind-raises-400m-after-walking-away-from-datadog-acquisition-offer\/\">Upwind raises $400M after walking away from Datadog acquisition offer<\/a><\/td>\n<td class=\"src\">TechCrunch<\/td>\n<td class=\"dt\">Oct 28, 2026<\/td>\n<\/tr>\n<tr>\n<td>18. <a href=\"https:\/\/siliconangle.com\/2026\/10\/28\/northstar-launches-with-7m-to-give-ai-agents-the-context-to-act-on-security-risks\/\">Northstar launches with $7M to give AI agents the context to act on security risks<\/a><\/td>\n<td class=\"src\">SiliconANGLE<\/td>\n<td class=\"dt\">Oct 28, 2026<\/td>\n<\/tr>\n<tr>\n<td>19. <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/microsoftthreatprotectionblog\/now-generally-available-discover-local-ai-agents-with-microsoft-defender\/4568216\">Now generally available: Discover local AI agents with Microsoft Defender<\/a><\/td>\n<td class=\"src\">Microsoft Tech Community<\/td>\n<td class=\"dt\">Oct 28, 2026<\/td>\n<\/tr>\n<tr>\n<td>20. <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/microsoftsentinelblog\/what%E2%80%99s-new-in-microsoft-sentinel-october-2026\/4568804\">What&#x27;s new in Microsoft Sentinel: October 2026<\/a><\/td>\n<td class=\"src\">Microsoft Tech Community<\/td>\n<td class=\"dt\">Oct 30, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Supervising agents and building the next analysts<\/h4>\n<div class=\"cluster-intro\">Who is qualified to supervise an AI agent, how to contain agents that wander, how a SOC prepares for adversaries that reason, and why capture-the-flag contests matter more as entry-level work shrinks. The Security Boulevard piece is a syndicated personal blog.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>21. <a href=\"https:\/\/www.darkreading.com\/cybersecurity-operations\/your-ai-agent-has-a-supervisor-are-they-qualified-\">Your AI Agent Has a Supervisor. Are They Qualified?<\/a><\/td>\n<td class=\"src\">Dark Reading<\/td>\n<td class=\"dt\">Oct 26, 2026<\/td>\n<\/tr>\n<tr>\n<td>22. <a href=\"https:\/\/www.darkreading.com\/cybersecurity-operations\/redefining-security-for-the-agentic-enterprise\">Redefining Security for the Agentic Enterprise<\/a><\/td>\n<td class=\"src\">Dark Reading<\/td>\n<td class=\"dt\">Oct 26, 2026<\/td>\n<\/tr>\n<tr>\n<td>23. <a href=\"https:\/\/www.csoonline.com\/article\/4242253\/beyond-deterministic-worms-preparing-the-soc-for-reasoning-adversaries.html\">Beyond deterministic worms: Preparing the SOC for reasoning adversaries<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 30, 2026<\/td>\n<\/tr>\n<tr>\n<td>24. <a href=\"https:\/\/securityboulevard.com\/2026\/10\/how-to-solve-the-mystery-of-ai-defense-in-depth\/\">How to Solve the Mystery of AI Defense in Depth?<\/a><\/td>\n<td class=\"src\">Security Boulevard<\/td>\n<td class=\"dt\">Oct 30, 2026<\/td>\n<\/tr>\n<tr>\n<td>25. <a href=\"https:\/\/www.darkreading.com\/cybersecurity-operations\/why-ctf-more-important-than-ever\">Why CTF Competitions May Be More Important Than Ever<\/a><\/td>\n<td class=\"src\">Dark Reading<\/td>\n<td class=\"dt\">Oct 29, 2026<\/td>\n<\/tr>\n<\/table>\n<p>            <!-- Detailed write-ups --><\/p>\n<h2>Detailed write-ups<\/h2>\n<div class=\"article\">\n<h4>1. Node2Shell: one Brotli decoder bug, patches across every runtime<\/h4>\n<p class=\"meta\">SecurityWeek &middot; October 26, 2026<\/p>\n<p>Node2Shell (CVE-2026-111497, also circulating as HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in Google&rsquo;s Brotli decompression library, affecting Brotli 1.0.3 through 1.2.0. Crafted compressed input can push data past a decoder buffer, which can crash the process, leak memory or, according to the Node.js project, let an unauthenticated attacker run code. Google scores it 9.2 under CVSS v4; Microsoft scores it 8.1 and rates exploitation &ldquo;more likely&rdquo;. Brotli 1.0.10, 1.1.1 and 1.2.1 carry the fix. Node.js and the two affected Python packages (Brotli 1.2.1 and brotlicffi 1.2.1.0) patched first, and Microsoft followed on October 25 with .NET 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3, plus Visual Studio 2019, 2022 and 2026 and PowerShell 7.4 to 7.6. Bun, Envoy and Istio have updated too.<\/p>\n<p>Exploitability is disputed. Imperva achieved code execution on the official Node.js 24.22.0 image for Linux on arm64, but the public proof of concept reportedly works only against a deliberately weakened build, and some researchers argue the bug is a denial-of-service at most. CISA has since added it to its Known Exploited Vulnerabilities catalog. The operational problem is reach rather than severity. OpenAI&rsquo;s Patch the Planet advisory warns that &ldquo;any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed&rdquo;, including compressed request bodies, responses fetched from untrusted servers and compressed files. A public tracker of software that bundles its own decoder still lists unpatched projects, among them DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II.<\/p>\n<p>For patch operations this is a container and restart exercise as much as a package update. Running processes keep the vulnerable decoder in memory, so services must be restarted and container images rebuilt on a patched base before the fix takes effect. Software composition data that only checks the operating system&rsquo;s Brotli package will miss runtimes that ship their own copy, so check Node.js, .NET, Bun and Python environments separately.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.securityweek.com\/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages\/\">SecurityWeek (Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>2. PHP2Shell, week two: a three-day federal deadline and a long tail of forgotten PHP<\/h4>\n<p class=\"meta\">Federal News Network &middot; CSO Online &middot; October 27&ndash;29, 2026<\/p>\n<p>CISA added both PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, confirming active exploitation rather than scanning or proof-of-concept activity, and gave federal civilian agencies until October 29 to fix them. Under a binding operational directive issued earlier this year, CISA reserves that three-day deadline for the highest-risk flaws and has said it wants agencies to move faster still where they can. For a SOC that tracks KEV as a service level, the message is that &ldquo;critical and exploited&rdquo; now means days.<\/p>\n<p>The harder part is what the CSO analysis describes as a long tail. VulnCheck found that 42% of 2.6 million internet-facing PHP hosts run end-of-life branches, and PHP also sits inside NAS boxes, firewalls, VPN gateways, printers, building management panels and OT HMIs that cannot be patched directly. Cogent Security counted an average of 2,266 affected assets per Fortune 500 environment, 122 of them internet-exposed, and that only covered servers and virtual machines. Version-banner scanning can mislead in both directions, because distribution backports can carry version numbers lower than upstream&rsquo;s fixed releases. &ldquo;With PHP, much of the forgotten infrastructure will be found, but won&rsquo;t have an upstream fix,&rdquo; said Sai Molige of Forescout.<\/p>\n<p>Where you cannot patch, compensate. Move vulnerable applications off insecure segments, add firewall rules, and turn off embedded HTTP management where SSH or another channel can do the job. Do not lean on a WAF alone, since attackers can pad payloads past inspection limits, and remember that IPS detection needs HTTPS decryption. Hunt for PHP_SESSION_UPLOAD_PROGRESS alongside a PHPSESSID cookie, multipart uploads to endpoints that never take uploads, web workers spawning shells, and new or modified .php files in web roots. The Log4Shell precedent is sobering: a year on, nearly three-quarters of organisations still had vulnerable assets.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/federalnewsnetwork.com\/technology-main\/2026\/10\/cisa-gives-agencies-days-to-patch-critical-php-bugs\/\">Federal News Network (CISA gives agencies days to patch critical PHP bugs)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4241941\/php2shell-will-persist-in-enterprise-environments-for-years.html\">CSO Online (PHP2Shell will persist in enterprise environments for years)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>3. Exploitation is becoming the front door, and it arrives within days<\/h4>\n<p class=\"meta\">Help Net Security &middot; CSO Online &middot; SecurityWeek &middot; October 27&ndash;29, 2026<\/p>\n<p>Three data sets point the same way. Rapid7&rsquo;s Q3 report (covered last week from a different angle) finds high-severity flaws exploited about three days after disclosure on average, with 71% of exploitation in the first week. Of 43 newly exploited high and critical flaws, 34 needed neither authentication nor user interaction, and 41 of 63 underground posts Rapid7 monitored were selling RDP or network access. LevelBlue&rsquo;s incident data shows exploitation as the initial access route in 14% of Q3 cases, up from 4% in Q2, while phishing and social engineering fell from 65% to 42%. Verizon&rsquo;s 2026 DBIR puts exploitation at the centre of 31% of breaches, ahead of credential abuse for the first time. Edge appliances from SonicWall, Fortinet, Palo Alto Networks, Ivanti and BeyondTrust dominate the most-exploited lists. &ldquo;They&rsquo;re exposed by design, and a working exploit puts the attacker directly on the network,&rdquo; said Scott Doerr of ForeGuard Advisory Group.<\/p>\n<p>Rapid7&rsquo;s Christiaan Beek adds a caution: &ldquo;Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation.&rdquo; The practical answer is a metric that measures exposure rather than volume. Qualys CISO Nathan Smolenski argues for tracking the average window of exposure, from the moment a confirmed exploit is present in your environment until the fix is verified, instead of mean time to remediate from disclosure. His team found that only 357 of 48,172 vulnerabilities disclosed in 2025, about 0.74%, were both remotely exploitable and weaponised. Layering KEV status, business context and safe exploitability testing cut one customer&rsquo;s 62.5 million alerts to about 60,000. He recommends rolling out autonomous patching by asset tier, low-risk systems first, with rollback ready and human review for staged changes.<\/p>\n<p>Tod Beardsley&rsquo;s NetScaler column makes the optimistic case for the same trend. Citrix&rsquo;s September zero-days were spotted and patched over a weekend, Citrix cut its average time from discovery to CVE from about 40 days to 17 after setting up a dedicated NetScaler CNA, and CISA made a rare Sunday KEV addition. His advice is to keep emergency patch pipelines primed: there is a gap in Citrix&rsquo;s reserved CVE numbers, from CVE-2026-88779 to CVE-2026-88787, which suggests more advisories could follow.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/27\/rapid7-vulnerability-exploitation-trends-q3-2026-report\/\">Help Net Security (71% of vulnerability exploitation starts within a week of disclosure)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4241912\/vulnerability-exploitation-rising-as-the-root-cause-of-many-breaches.html\">CSO Online (Vulnerability exploitation rising as the root cause of many breaches)<\/a> &middot; <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/29\/nathan-smolenski-qualys-ai-vulnerability-management\/\">Help Net Security (Qualys CISO on what security teams can do as exploit campaigns grow)<\/a> &middot; <a href=\"https:\/\/www.securityweek.com\/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal\/\">SecurityWeek (This is Fine: What NetScaler Zero-Days Tell Us About the New Normal)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>4. The rest of the patch queue: Tailworm, Oracle EBS, Veeam and Juniper<\/h4>\n<p class=\"meta\">SecurityWeek &middot; October 27&ndash;29, 2026<\/p>\n<p>Cyberdione Labs published Tailworm, 11 findings in the Tailscale 1.104.2 client and the self-hosted headscale 0.29.5 control server, before any patch existed. Six are rated high, and four concern Tailscale SSH, which performed some forwarding operations with root privileges behind safeguards that could be bypassed. An attacker who already controls one device on a tailnet could get root on any server that device may reach over Tailscale SSH with forwarding allowed. In the lab, a chained attack moved from server to server in under a second per hop with no user interaction. Tailscale said exploitation needs prior access and depends on how SSH access is configured: &ldquo;Based on our current assessment, we&rsquo;re not recommending that everyone disable Tailscale SSH.&rdquo; Its interim advice was to tighten SSH policies and set TS_SSH_DISABLE_FORWARDING=1 where forwarding is not needed. It has since shipped version 1.104.4 with four security bulletins. No in-the-wild exploitation has been reported.<\/p>\n<p>Oracle&rsquo;s October update fixed CVE-2026-101767 (CVSS 9.8), an unauthenticated SQL injection in the E-Business Suite Thin Client Framework servlet that chains to remote code execution in versions 12.2.3 to 12.2.15. Defused&rsquo;s honeypots recorded exploratory exploit attempts from October 27, and Shadowserver tracks more than 670 internet-exposed EBS instances. Oracle EBS has been a mass-exploitation target before, so treat this as urgent even before it reaches KEV.<\/p>\n<p>Adobe, Veeam and Juniper fixed more than three dozen flaws between them, none reported exploited. The ones that matter most for operations are Veeam&rsquo;s: a critical Backup for Microsoft 365 bug allowing cross-tenant configuration read\/write and code execution, and a critical unauthenticated authorisation bypass in Backup &amp; Replication. Backup servers are a ransomware operator&rsquo;s first stop. Juniper fixed 18 flaws in Session Smart Router and Conductor, two of them critical unauthenticated command execution bugs, and Adobe fixed eight critical bugs in Campaign Classic and one in Connect. Juniper also says PHP2Shell&rsquo;s CVE-2026-109618 is present in Junos OS but not exploitable.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.securityweek.com\/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws\/\">SecurityWeek (Tailscale Rushes Patches After Uncoordinated Disclosure of Tailworm Flaws)<\/a> &middot; <a href=\"https:\/\/www.securityweek.com\/hackers-start-probing-fresh-oracle-ebs-vulnerability\/\">SecurityWeek (Hackers Start Probing Fresh Oracle EBS Vulnerability)<\/a> &middot; <a href=\"https:\/\/www.securityweek.com\/adobe-veeam-juniper-networks-patch-critical-vulnerabilities\/\">SecurityWeek (Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>5. Fake help desks over Teams, and where to talk when the attacker can listen<\/h4>\n<p class=\"meta\">Infosecurity Magazine &middot; Help Net Security &middot; CSO Online &middot; October 27&ndash;30, 2026<\/p>\n<p>Arctic Wolf documented more than 400 incidents in which attackers abused Microsoft Teams external chat. The pattern starts with email bombing, flooding the victim&rsquo;s inbox with newsletter and subscription confirmations. A fake service desk account such as &ldquo;IT Service Desk &ndash; Liam&rdquo; then offers to fix the problem. In 30-40% of cases the attackers used default onmicrosoft.com tenant domains, which need no verification and take minutes to set up. Victims were walked into Windows Quick Assist, the attackers moved to AnyDesk or ScreenConnect for persistence, and a payload ran less than 15 minutes after first contact. Ransomware groups including Black Basta have used the technique.<\/p>\n<p>Cisco Talos Incident Response saw the same playbook in Q3 by phone, email and Teams, and notes how little the attackers needed: &ldquo;The attackers appeared to know employee names and email addresses,&rdquo; said Talos researcher Aliza Johnson, with no sign of deeper profiling. Anyone susceptible was a target, not only senior or technical staff. In one VYPR ransomware case a vishing call led to a Quick Assist session, an RMM tool and a PowerShell-delivered installer. The operators reused Conti-derived code, used vulnerable drivers to disable EDR and exfiltrated over several days. Across Talos engagements, insufficient logging was the most common weakness, found in over 40%. Talos recommends phishing-resistant MFA, help desk identity verification before any MFA enrolment, and at least 90 days of centralised log retention.<\/p>\n<p>When one of these lands, the response team may be coordinating in the same Teams and email tenant the attacker is in. Andy Lunsford, CEO of incident-response software firm BreachRx, writes in CSO that &ldquo;most incident response plans assume a safe place to coordinate&rdquo;. Plans cover losing collaboration tools far more often than tools that still work but can no longer be trusted. He recommends mapping whether primary and backup channels share an identity provider, device management or admin credentials. Participants should be verified through a process that does not rely on the accounts under investigation, and tabletop exercises should rehearse the decision to move channels, not just the move.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/exploit-teams-chat-breach\/\">Infosecurity Magazine (Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes)<\/a> &middot; <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/30\/cisco-talos-it-help-desk-vishing\/\">Help Net Security (Fake IT help desk callers got by on little more than names and email addresses)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4242184\/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them.html\">CSO Online (Everyday channels are available in an incident, but you may not want them)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>6. SOC tooling: governed agents, self-hosted SOCs and the context layer<\/h4>\n<p class=\"meta\">Help Net Security &middot; SiliconANGLE &middot; TechCrunch &middot; October 27&ndash;28, 2026<\/p>\n<p>The common thread in this week&rsquo;s launches is control over what agents can do. Swimlane&rsquo;s Turbine update lets teams run their own detection logic over large data sets, with one big-data action evaluating tens of thousands of records. Results feed its AI SOC, which routes each case to deterministic automation, AI-assisted investigation or a fully agentic investigation depending on the reasoning needed. New detections target local model use, unsanctioned AI accounts, prompt injection and bypassed guardrails. Turbine now works as both an MCP host and an MCP server under existing role-based access, and AI-generated app changes stay unsaved until a person accepts them. &ldquo;MCP is most useful when it becomes part of the operating model, not just another integration,&rdquo; said COO Srikant Vissamsetti. FireMon&rsquo;s agentic AI for firewall policy has three agents that answer policy questions, design rules and turn access requests into staged changes. They pause for a practitioner when judgment is needed, nothing is saved until a person accepts it, and nothing is pushed to firewalls automatically. The AI is off by default, supports self-hosted models and logs everything; it ships in November at no extra charge for the first release.<\/p>\n<p>Sekoia went the other way on deployment. Sekoia Self-Hosted runs its SOC platform inside the customer&rsquo;s own infrastructure for government, defence, critical infrastructure and regulated buyers, including isolated, limited-connectivity and OT networks. Customers decide where data lives, how AI is deployed and where human approval is required. &ldquo;Cloud is a deployment choice, not a definition of modern security,&rdquo; said CEO Freddy Milesi. No availability date or pricing was given.<\/p>\n<p>Two funding stories show where investors see the gaps. Northstar launched with a $7 million seed led by Wing Venture Capital for a security context graph that pulls from more than 70 tools, including Okta, GitHub and Workday. It looks for &ldquo;toxic combinations&rdquo; and exposes the graph to outside agents over MCP; CEO Amer Deeba says security teams are &ldquo;drowning in data but starving for context.&rdquo; Upwind raised $400 million at a $3.8 billion valuation, led by Bessemer, after Datadog tried to buy it without offering a premium. The runtime security vendor says it is adding $20 million to $30 million in annual recurring revenue a quarter, all company-reported figures.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/28\/swimlane-turbine-platform-capabilities\/\">Help Net Security (Swimlane connects custom detections to AI-led investigation and response)<\/a> &middot; <a href=\"https:\/\/siliconangle.com\/2026\/10\/27\/exclusive-firemon-unveils-ai-agents-to-handle-the-legwork-behind-firewall-policy-changes\/\">SiliconANGLE (Exclusive: FireMon unveils AI agents to handle the legwork behind firewall policy changes)<\/a> &middot; <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/27\/sekoia-self-hosted\/\">Help Net Security (Sekoia introduces self-hosted deployment for organizations with strict data controls)<\/a> &middot; <a href=\"https:\/\/siliconangle.com\/2026\/10\/28\/northstar-launches-with-7m-to-give-ai-agents-the-context-to-act-on-security-risks\/\">SiliconANGLE (Northstar launches with $7M to give AI agents the context to act on security risks)<\/a> &middot; <a href=\"https:\/\/techcrunch.com\/2026\/10\/28\/upwind-raises-400m-after-walking-away-from-datadog-acquisition-offer\/\">TechCrunch (Upwind raises $400M after walking away from Datadog acquisition offer)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>7. Microsoft: local agent discovery reaches GA, and Sentinel&rsquo;s October changes<\/h4>\n<p class=\"meta\">Microsoft Tech Community &middot; October 28&ndash;30, 2026<\/p>\n<p>Microsoft Defender&rsquo;s discovery of local AI agents and their configured MCP servers on Windows and macOS is now generally available, with coverage expanded to more than 50 supported agents and MCP servers, up from over 20 at Build. Discovery begins automatically on onboarded devices once Defender observes an agent running. Agents appear under Assets &gt; AI agents and can be queried in advanced hunting through the AgentsInfo table. The baseline licence is Defender for Endpoint Plan 2, but risk levels, risk indicators and recommendations need Microsoft 365 E7 or Agent 365. Runtime protection for local agents on Windows remains in preview. &ldquo;As local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough,&rdquo; the post says. For SOCs this is a shadow-AI inventory you can hunt on, whatever you decide about the paid risk layer.<\/p>\n<p>Sentinel&rsquo;s October release matters most to MSSPs and multi-tenant teams. Cross-tenant delegated access is now GA: analysts sign in with a home-tenant account rather than keeping B2B guest or local admin accounts in each tenant, and each governed tenant approves exactly which roles and scopes to grant. The ASIM EmailEvent schema is GA too, so email detections can be written once across sources. In preview, an SAP BTP analytics rule alerts only when a custom app with open high or critical vulnerabilities is actually used. Unified Data Management, also in preview, brings connectors, tables, ingestion health and estimated cost into one Defender portal view. Both posts are Microsoft product blogs.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/microsoftthreatprotectionblog\/now-generally-available-discover-local-ai-agents-with-microsoft-defender\/4568216\">Microsoft Tech Community (Now generally available: Discover local AI agents with Microsoft Defender)<\/a> &middot; <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/microsoftsentinelblog\/what%E2%80%99s-new-in-microsoft-sentinel-october-2026\/4568804\">Microsoft Tech Community (What&#x27;s new in Microsoft Sentinel: October 2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>8. Supervising agents, and preparing the SOC for adversaries that reason<\/h4>\n<p class=\"meta\">Dark Reading &middot; CSO Online &middot; Security Boulevard &middot; October 26&ndash;30, 2026<\/p>\n<p>As agents take on investigations, the analyst&rsquo;s job shifts to directing, reviewing and correcting their work, and a Dark Reading piece argues that supervision should be a qualification, not an assumption. Supervisors should prove they can spot a convincing but flawed investigation through blind reviews seeded with incomplete evidence, misleading conclusions, scope violations and inappropriate actions. Authorisation records should say which agents, systems, actions and risk levels each analyst may oversee, with a higher bar for disabling accounts or isolating hosts than for read-only work. Each accepted, modified or rejected conclusion should be recorded with the reason. A second Dark Reading piece adds containment patterns: task-scoped access, identity checks at every tool call, keeping the agent and its human creator as separate identities, and decoy credentials that stop the run, revoke access and rotate secrets the moment an agent touches them. It also warns against asking engineers to approve the same routine action fifty times a day.<\/p>\n<p>Keith Lawson, CISO of London Health Sciences Centre, writes in CSO that the old 1-10-60 response benchmark is too slow for autonomous attackers. He treats every agent as a privileged identity with short-lived, scoped credentials, requires human approval before agents create identities, compute or network paths, and puts agents behind egress allowlists. His approach is tiered autonomy: automate narrow, reversible containment, and keep humans on irreversible or clinically risky actions. &ldquo;We cannot rely on strokes of luck.&rdquo; Anton Chuvakin reaches a similar design from the defence-in-depth side. Guard models often share the failure modes of the models they watch, irreversible actions such as moving money, deleting data or changing permissions need synchronous deterministic gates, and a defensive AI is both a new layer and a new common point of failure. &ldquo;AI makes your layers more correlated and your edge slower than the attacker, so design for correlated failure and for speed.&rdquo;<\/p>\n<p>The talent question sits underneath all of this. If agents absorb the entry-level triage work that used to train analysts, Dark Reading argues, capture-the-flag competitions may be one of the few remaining ways to build the judgment supervisors need.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.darkreading.com\/cybersecurity-operations\/your-ai-agent-has-a-supervisor-are-they-qualified-\">Dark Reading (Your AI Agent Has a Supervisor. Are They Qualified?)<\/a> &middot; <a href=\"https:\/\/www.darkreading.com\/cybersecurity-operations\/redefining-security-for-the-agentic-enterprise\">Dark Reading (Redefining Security for the Agentic Enterprise)<\/a> &middot; <a href=\"https:\/\/www.csoonline.com\/article\/4242253\/beyond-deterministic-worms-preparing-the-soc-for-reasoning-adversaries.html\">CSO Online (Beyond deterministic worms: Preparing the SOC for reasoning adversaries)<\/a> &middot; <a href=\"https:\/\/securityboulevard.com\/2026\/10\/how-to-solve-the-mystery-of-ai-defense-in-depth\/\">Security Boulevard (How to Solve the Mystery of AI Defense in Depth?)<\/a> &middot; <a href=\"https:\/\/www.darkreading.com\/cybersecurity-operations\/why-ctf-more-important-than-ever\">Dark Reading (Why CTF Competitions May Be More Important Than Ever)<\/a><\/p>\n<\/p><\/div>\n<p>            <!-- Calls to action --><\/p>\n<h2>Calls to action<\/h2>\n<ul style=\"font-size:14.5px;line-height:1.6;color:#1f2937;padding-left:20px;margin:0 0 14px 0;\">\n<li><strong>Finish Node2Shell properly.<\/strong> Update Brotli, Node.js (22.23.4, 24.22.1, 26.12.1), .NET, PowerShell, Bun, Envoy, Istio and the Python Brotli\/brotlicffi packages, then restart services and rebuild container images. Where you cannot patch yet, consider blocking Content-Encoding: br at the proxy for inbound traffic.<\/li>\n<li><strong>Hunt the PHP2Shell long tail.<\/strong> Find end-of-life PHP and PHP embedded in appliances, segment or firewall what cannot be patched, disable embedded HTTP management, and search logs for PHP_SESSION_UPLOAD_PROGRESS with PHPSESSID, unexpected multipart uploads, shells spawned by web workers and new .php files in web roots.<\/li>\n<li><strong>Patch Oracle E-Business Suite now.<\/strong> Apply the October CPU for CVE-2026-101767 on 12.2.3 to 12.2.15, take EBS off the public internet where you can, and watch for unusual requests to the Thin Client Framework servlet.<\/li>\n<li><strong>Update Tailscale to 1.104.4 or later.<\/strong> Until every node is updated, set TS_SSH_DISABLE_FORWARDING=1 where forwarding is not needed and replace broad SSH grants with specific source-to-target rules.<\/li>\n<li><strong>Patch your backup servers first.<\/strong> Apply Veeam&rsquo;s fixes for Backup for Microsoft 365 and Backup &amp; Replication, then Juniper&rsquo;s Session Smart Router and Conductor updates.<\/li>\n<li><strong>Lock down Teams external access.<\/strong> Allowlist partner domains, block trial tenants, restrict Quick Assist to IT roles, and alert on Quick Assist sessions followed by new RMM installs.<\/li>\n<li><strong>Harden the help desk.<\/strong> Require identity verification before any MFA enrolment or reset, move privileged users to phishing-resistant MFA, and keep at least 90 days of centralised logs.<\/li>\n<li><strong>Stand up an out-of-band incident channel.<\/strong> Make sure it does not share an identity provider, device management or admin credentials with your production tenant, and pre-verify contacts for counsel, forensics and insurers.<\/li>\n<li><strong>Inventory local AI agents.<\/strong> If you have Defender for Endpoint Plan 2, query the AgentsInfo table; otherwise use EDR process telemetry to list coding assistants and MCP servers running on endpoints.<\/li>\n<li><strong>Write down who may supervise which agent.<\/strong> Record, per analyst, which agents, systems and actions they can approve, and require a recorded reason when an agent&rsquo;s conclusion is accepted or overridden.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<p>        <!-- Footer --><\/p>\n<tr>\n<td class=\"footer\">\n<p class=\"brand\">Security Operations Weekly<\/p>\n<p>A weekly intelligence bulletin from Security Radar LLC.<br \/>\n            Curated by Paul Davis &middot; <a href=\"mailto:paul.davis@security-radar.com\">paul.davis@security-radar.com<\/a><\/p>\n<p>&copy; 2026 Security Radar LLC. All rights reserved.<\/p>\n<p>Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.<\/p>\n<p>*|LIST:ADDRESS|*<\/p>\n<p><a href=\"*|ARCHIVE|*\">View this email in your browser<\/a> &middot; <a href=\"*|UNSUB|*\">Unsubscribe<\/a><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>November 1, 2026 &middot; Weekly Edition Security Operations Weekly Node2Shell patches spread from Node.js to .NET and Python, PHP2Shell got a three-day federal deadline and a long tail of end-of-life PHP, and exploitation is overtaking stolen credentials as a way in. Tailworm, Oracle EBS and Veeam fill the patch queue,&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38],"tags":[],"class_list":["post-6211","post","type-post","status-publish","format-standard","hentry","category-security-operations"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6211"}],"version-history":[{"count":1,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6211\/revisions"}],"predecessor-version":[{"id":6213,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6211\/revisions\/6213"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}