In partnership with
One workspace where buyers, sellers, and AI close deals together
Instead of running your deals across scattered email threads and forgotten attachments, Aligned brings everything into one shared deal workspace.
Buyers get a single place to evaluate, loop in their team, and say yes. Sellers get visibility into what is actually happening when they're not in the room and AI Deal Insights that help you act accordingly, before it's too late.
Best part? Your first deal room takes only minutes to stand up.
Tuesday's theme: the patch is no longer the finish line. Attackers are beating fixes to the punch, vendors are hiding CVE details on purpose, and your users' sessions are walking out the door with no password required. Here is what actually matters today.
PHP2Shell: exploited four days before the patch existed
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) allow unauthenticated remote code execution. Amazon Threat Intelligence says exploitation began four days before PHP shipped fixes, after details leaked ahead of coordinated disclosure. CISA added both to its KEV catalog on October 26. Anything serving web requests on PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is exposed.
Why it matters: PHP sits behind a huge slice of client websites, portals and WordPress installs. Inventory it today, patch it, and take unpatchable boxes offline, which is the same guidance the UK NCSC gave. Sources: CISA, BleepingComputer, Bitsight.
Fortinet patched now, will tell you what it fixed on November 10
Fortinet shipped FortiOS, FortiManager and FortiAnalyzer updates on October 22 for critical and high severity flaws it says were found with frontier AI-assisted testing. CVE numbers and scores are held back until PSIRT advisories land on November 10. The stated reason: AI tools can diff a patch against the old build and produce a working exploit in hours or days.
Why it matters: You are being asked to patch blind. Treat it as an emergency change for internet-facing FortiGates and do not wait for the advisory. Source: IT Brief.
Token spraying hit 79 Microsoft 365 tenants, no passwords involved
Huntress tracked a campaign between July 14 and September 22 that replayed stolen session tokens, gathered through adversary-in-the-middle and device-code phishing. It logged 497 successful sign-ins, and the attacker hid victims' mail with inbox rules. Replays began within minutes of theft.
Why it matters: MFA alone did not save these tenants. Look at token protection, conditional access tied to compliant devices, device-code flow restrictions, and alerts on new inbox rules. Source: Help Net Security.
SafePay has now hit 600+ organizations, and the feds wrote down how
A joint #StopRansomware advisory (AA26-293A) from CISA, the FBI, the Secret Service and European partners landed October 20. SafePay gets in through exposed or brute-forced credentials, VPN access, phishing and edge-device CVEs, then deletes shadow copies and resets NAS backups before the extortion call. Reporting counts at least 600 victims since August 2024.
Why it matters: Entry points are the boring ones: VPN, credentials, unpatched edge gear. Use the advisory as a client-ready checklist, and check that your backups cannot be reached from a compromised domain. The advisory is a few days old, but it pairs neatly with today's Fortinet news. Source: CISA.
Also on KEV: Arista VeloCloud Orchestrator SQL injection
CISA added CVE-2026-114625, a SQL injection flaw in Arista VeloCloud Orchestrator, to the KEV catalog on October 23 on evidence of active exploitation. If you manage SD-WAN for clients, check your Orchestrator version now. Source: CISA.
That is the issue. Patch PHP first, schedule a Fortinet window, and go read your inbox rules. See you tomorrow.
The ChannelBytes team
