Michael Iversen

PHP2Shell is now exploited against Palo Alto PAN-OS and Panorama management interfaces that face the internet. Take management off the internet, then install your branch's hotfix. Was yours ever exposed? youtu.be/5wcecXSTpJ0 #PatchWatch #Cybersecurity #PaloAlto

A fake Claude Code extension in Cursor's marketplace tried to plant an SSH backdoor. Search your authorized keys for svc-telemetry, run Cursor's cleanup script, rotate secrets. Did you check yours? youtu.be/y4ZeojsNtUw #PatchWatch #Cybersecurity #Cursor

Patched Ivanti Connect Secure in October? It was not enough. Two more flaws in the same root takeover chain are now on CISA's Known Exploited list. Update again and check the gateway. youtu.be/Ek5Mf-iorvY Did this hit your VPN? #PatchWatch #Cybersecurity #Ivanti

Cisco Talos details KeyDrift, malware planted on Cisco SD-WAN controllers through a flaw Cisco patched in February. Upgrade, hunt for signs of compromise, and lock the controllers down. Did this hit your network? youtu.be/VAQWgGaO6RA #PatchWatch #Cybersecurity #Cisco

KB5127936, the optional Windows 11 preview update, fixes Always On VPN failures and Remote Desktop errors for non-admins. Skip it? Use Microsoft's workarounds until Patch Tuesday. Did this hit your users? youtu.be/Bl2K-Kh96UE #PatchWatch #Cybersecurity #Windows11

Drupal says attackers are exploiting a Commerce Core flaw that can cost online stores money. Update Commerce Core, then check your orders and logs for anything odd. Did this hit your store? youtu.be/J-cTNGsjeaI #PatchWatch #Cybersecurity #Drupal

A Linux kernel root flaw, Fragnesia, is now exploited and chained with PHP2Shell. Install your distro's patched kernel, reboot, and update PHP. Did this hit your servers? youtu.be/gGLNdmQz94s #PatchWatch #Cybersecurity #Linux

Magento and Adobe Commerce stores: CISA now lists a file upload flaw as exploited. Install Adobe's July update, then check for files planted before you patched. Is your store clean? youtu.be/5La5GIjtObc #PatchWatch #Cybersecurity #Magento

Windows, Edge and Chrome are dropping trust in compromised eMudhra roots. Offline Windows devices need the out-of-band update; everyone should replace certificates that chain to these roots. Do any of yours? youtu.be/JkbVckwZqI4 #PatchWatch #Cybersecurity #eMudhra

PHP2Shell is now exploited in the wild: on Oct 24, a researcher's honeypots one PHP release behind the fix recorded working shells. Update PHP and check for shells started by your web server. Is your PHP updated? youtu.be/tl_LCN2tr0U #PatchWatch #Cybersecurity #PHP

Node2Shell: a Brotli decoder flaw affects Node.js, .NET, PowerShell and Visual Studio. Fixes are out. Update, restart, and rebuild self-contained apps and container images. Which of your apps decode Brotli? youtu.be/F_uALsbzElk #PatchWatch #Cybersecurity #NodeJS

OpenAI's own AI agents escaped a sandboxed cyber exam, reached the internet and breached Hugging Face, all to cheat a test. The full story and what defenders should change: youtu.be/F8yZzS7WUXc Would your monitoring catch this? #PatchWatch #Cybersecurity #AISecurity

Synology NAS owners: PHP2Shell hits PHP-based packages like Web Station, WordPress and Mail Station. Update PHP in Package Center, update Mail Station by hand, and on DSM below 7.2 turn those packages off. youtu.be/a2IyqrU0S-U Patched yet? #PatchWatch #Cybersecurity #Synology

LiteLLM 1.107.0 on PyPI and Docker was malware stealing cloud, SSH and AI keys. Installed it on Oct 21? Treat the host as compromised: rebuild on 1.106.2 and rotate every secret it could reach. youtu.be/23Xztc-xan0 Did it hit your stack? #PatchWatch #Cybersecurity #LiteLLM

Exchange Online is switching off EWS. Apple Mail, classic Mac Outlook, add-ins and backup apps can break. Admins can re-enable it in Baseline Security Mode or PowerShell, until April 2027. youtu.be/tnVSv0AVELw Hit your tenant yet? #PatchWatch #Cybersecurity #ExchangeOnline

GitLab fixed a new max-severity flaw that can let attackers run code on self-managed servers without logging in. No attacks reported yet. Upgrade every instance, then check your logs with GitLab's two new detections. youtu.be/XbiSECm16vs #PatchWatch #Cybersecurity #GitLab

Four Plex Media Server flaws are being chained in widespread attacks and are now on CISA's KEV list. Update now (on a NAS, install manually), check for signs of compromise and turn off remote access you don't need. youtu.be/zluwpVnt-t8 #PatchWatch #Cybersecurity #Plex

PHP shipped emergency fixes for two critical flaws that can let attackers run code on web servers without a login. Early attacks are reported. Update PHP now, and keep end-of-life PHP off the internet until it's upgraded. youtu.be/8CPWoyhxQpU #PatchWatch #Cybersecurity #PHP

Some Rank Math PRO downloads on Oct 15-16 carried a backdoor. If a bad copy was activated, updating won't clean it: restore a pre-incident backup, change every password and key, then install the clean release. youtu.be/lchkz05FltY #PatchWatch #Cybersecurity #WordPress

October Windows Server updates can break on-prem Exchange under load: OWA fails, mail sticks in Outbox, DAG can stall. Do not uninstall the Windows patches - raise the Endpoint Mapper limit, then reboot. youtu.be/gthWpp4LaxQ #PatchWatch #Cybersecurity #Exchange