The number is not a typo.

Microsoft's October Patch Tuesday contained 1,413 defects: surpassing the company's previous annual record of 1,261 CVEs set in 2020. In a single month.

These include 1,102 flaws in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint. Of those, over 670 relate to privilege escalation, over 300 are remote code execution flaws, and 250 are information disclosure.

The actively exploited zero-day is CVE-2026-96951: a Windows Shell flaw that allows unauthorized attackers to bypass a security feature.

It lets attackers slip malicious files past Windows' Mark of the Web warning: the prompt that normally tells a user a file came from the internet.

CISA ordered federal agencies to patch it by October 16th.

Why so many at once?

Microsoft has said its growing use of AI to find and fix security vulnerabilities means users should expect more fixes in its monthly updates. So the AI is finding them faster than they used to. Good news and terrible news simultaneously.

Somewhere there's a sysadmin staring at 1,413 line items with the same energy as someone who asked for "a few emails to catch up on" and opened Outlook to find their entire inbox on fire. If that's you: good luck. Genuinely.

Sources:

• The Hacker News: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html
• Malwarebytes: https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack

To be clear, haven't lost my gig (yet). I'm the guy who posted last week about pulling off a near impossible new Hq build out with something like 6 weeks from lease sign to move in, and procurement couldn't even start until lease sign.

So why looking for a new job?

Because these fuckers are refusing to follow literally any best standards as it comes to securing the joint. I setup a complex wifi password (because they already overruled the price for cloud based NT authentication using portknox or something) and they now want it changed to simple dictionary words, capitals at the bginning, no symbols at all - despite my carefully prepared documentation on best practices.

We're talking about a venture capital firm that sits firmly between finance and biotech here - so heavily regulated space, BILLIONS of dollars on revenue...and they're refusing even the most basic of security best practices. Not even going to get started on the temper tantrum they threw when I insisted on actual access control practices since their HR sucks at...you know...doing HR things.

Anyway, just needed to vent. I'm getting everything in writing, including what they're refusing to allow me to do, so that when the shit DOES hit the damn fan, my name AINT gonna be the one associated with this crap.

I just keep pacing the floor in the soon to open HQ and muttering 'why the fuck did they hire an internal IT person, if they're going to ignore everything that internal IT person says'.

Unbelievably fucking frustrating...but hey, I suppose HealthCare22 is a nice secure wifi password anyway.

Idiots.

I analyzed 11,846 sending IPs from 494 clients’ DMARC reports against the new Spamhaus Sender Guidelines and found out that 13 Microsoft IPs fail them. In November, Spamhaus is rolling out a requirement that every sending IP must have a valid HELO, a PTR record, and a matching A record.

9 IPv4 and 4 IPv6 inside Microsoft published sending ranges (40.92.0.0/15 and 2a01:111:f403:c000::/51 in spf.protection.outlook.com) have no PTR record at all. Microsoft own DNS servers return NXDOMAIN for these:

40.93.1.5
40.93.1.7
40.93.1.15
40.93.18.1
40.93.18.4
40.93.19.1
40.93.20.26
40.93.64.30
40.93.65.15
2a01:111:f403:c000::1
2a01:111:f403:c105::3
2a01:111:f403:c202::5
2a01:111:f403:d901::

In my data, those IPs passed 2,389 emails for 133 clients. The volume is tiny just 0.14% of the 1.75 million emails our clients sent through Microsoft in 30 days.

One more IP (2a01:111:f403:c206::1) got a PTR between our two checks, so it seems like Microsoft is fixing them.

M365 users can’t fix this themselves, because only Microsoft can set PTR records for its IPs. If these aren’t fixed before Spamhaus enforcement, the IPs could get listed, and the businesses sending through them can’t do anything about it.

Has anyone seen M365 outbound IPs without PTR or raised this with Microsoft?

Apparently there’s a bug in the firmware that causes performance degradation after 65,535 power on hours.

Interesting that that just happens to be the exact maximum of a 16 bit unsigned integer.

source: https://www.dell.com/support/kbdoc/en-us/000464492/poweredge-micron-5xxx-series-solid-state-drive-performance-degradation-after-65-535-poh

We’ve recently had this debate in the office so reading out for others views.

My preference is always L3 on the core switch for inter VLAN traffic rather than firewall rules.

Views?

CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on Monday (Oct 26), with exploitation confirmed in the wild. Federal civilian agencies have until Thursday, Oct 29 to remediate. Both flaws are in the PHP runtime itself and allow unauthenticated remote code execution, and the PHP Group rates each of them at CVSS 9.2.

The fixes were released on Oct 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress, Drupal or any other application on top does not fix this, because the flaw is below the application. PHP 8.1 and older get no fix. Those installs need an upgrade to a supported branch or a vendor backport, and CISA directs systems that cannot be updated to be taken offline until they can.

Patching and restarting takes the following steps.

First, check the version the web server actually loads, not the CLI version. php -v on the shell can point at a different build from the one Apache mod_php, PHP-FPM, php-cgi or another SAPI is using. A phpinfo page served through the web server, or the FPM pool status, shows the loaded build.

Upgrade to one of the fixed releases above, or install the vendor package that backports the fix.

Restart the PHP workers or the web server after upgrading. Installing the new package alone leaves the old code running in the existing processes. For PHP-FPM that is a service restart, for mod_php an Apache restart, and container images need a rebuild and redeploy rather than an in-place package update.

Set session.upload_progress.enabled=0 as well. That is the mitigation PHP advised on Oct 23 for a separate unpatched RCE, CVE-2026-115560, which is fixed only in the next regular release.

The log check needs to go back to Oct 17, because exploitation attempts were reported from Oct 17, four days before the fixes were released, so a check that only covers the period after patching misses the earlier window.

On Oct 28, Palo Alto Networks reported attacks against internet-exposed PAN-OS management interfaces in connection with this flaw, so bundled and appliance PHP installs are in scope as well as standalone web servers. One earlier report has been withdrawn: Unit 42 retracted its report of a PHP2Shell break-in at a European government body.

BleepingComputer on the KEV listing: https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/

Though this might not be a very recent leak, previous FortiBleed 1.0 did miss some of newly reported domains and secrets. Many of those might already be patched, but it might still be worth checking out.

Newly obtained FortiGate configuration reports reveal 40,573 records containing cleartext secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The analysis also identifies 975 domain labels absent from FortiBleed 1.0. The configuration material dates to around February 2026, earlier than the likely May/June material examined in the first investigation.

Source: https://www.infostealers.com/article/fortibleed-2-0-975-new-domains-40573-exposed-secrets-claim-your-ethical-disclosure/

after a long, long run, we are moving our website from a self maintained VPS-hosted word press site to a big cloud e-commerce platform. that part is already done. the last thing to do though is to get our entire public DNS, including MX info and all that (100-200 entries all told) to a cheaper DNS host so this VPS can be shut down so we have one less monthly on our budget. our current domain host is Network Solutions, so that was my first thought, but I've read a lot of complaints on this sub specifically about them. we also have an account with GoDaddy for a couple of certs. would they be any better? is there someone else i should look at? Thanks for the recommendations.

connected with a buddy of mine from the trenches after a looong time the other day, got hit hard with a wave of nostalgia from the early 2000s. i was working tech in higher ed back then. we had this crazy overhyped $8 million setup. vbrick encoders, crestron touch panels running shitty windows ce overlays, all packed into these heavy wooden rolling carts. the whole system blew up practically every other day. whenever a faculty started panicking mid lecture our actual high tech fix was sending a 19 year old workstudy kid to crawl behind the cart and yank the main power strip out of the wall. lol! remember begging the dean to let us build a simple linux stack in house but they fell for the slick vendor presentation instead. honestly though the broken hardware wasnt even the point. it was the culture. At 5:00 pm on the dot, front door to the office got locked so faculty couldn't barge in askign for help with personal laptops. my guys would fire up doom on the office pcs while we waited for nt 4.0 service packs to to finish patching. terry the workstudy kid held down the helpdesk phone till 11 pm. we'd order pizza, test out new projectors on the office wall, unwrap new blades and just mess around and tinker. the human connection was real back then. senior admin assistants would drop off fresh homemade muffins or cookies just because you spent twenty minutes fixing an access shortcut or some broken ODBC driver for them so they didnt have to suffer through banner. you weren't a tier-1 support asset tag. you were their guy! I've been in executive roles for years now and looking at modern IT kinds breaks me a bit. everything today is servicenow tickets, outsourced helpdesks, AWS pipelines, zero trust, and liability policies. no personal favors, no late night lan games in the back room, no tinkering. sure the corporate dashboards look great and uptime is 99.9% but we sucked out and traded all the soul, warmth, and actual human connection for green SLAs. maybe it still exists somewhere, i don't know.

Sysmon 15.22 for Windows (https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon) is out now and I have created some advanced configuration files to include these the new features. I have both Windows and Linux advanced detection configurations available. Let me know what you think.

https://github.com/THEVER1TAS/sysmon-config

Or at least don't before reading this because I'd hate for someone else to have to go through this. If you want to use their app or view the slides online, you literally have to sign up for their Fullstack Online Devmio Subscription. They say it's free for one year, and if you want to continue it's only 10 dollars a month. I never put my credit card information into it when you get the free first year, so I kind of forget about it.

Well now a year later I get an email that I am being charged €120 for automatic renewal, yes it's $10 (actually 10 EURO) a month but it's charged yearly. I immediately cancel my subscription on the day but now I get a follow up email threatening to send me to collections. I get on call with their customer service and they say that in order to cancel, you must request a cancellation IN WRITING 6 weeks before the automatic renewal date.

Worst thing is that the headquarters is based in Germany so if you didn't know about taking the (0) out and adding (011) in front for international calls, your call just won't go through. Hell if you can even make international calls with your phone plan. And now you have to take timezones into account so I called in at 10 AM EST and I can barely get a hold of anyone because it's 4 PM there which means it's basically 5 PM any they're going home.

Anyways not sure if people will even see this post since the conferences were not that big (hell was it even that good?) but there's literally no reviews about Devmio online so I figured I would put this out in writing for anyone who is googling DevMio or iJS in the future like I was. Holy shit.

Hey everyone,

Within my tenant multiple users have been sending Teams meeting invites that have been getting automatically encrypted due to our Email Security Filters within Proofpoint. After looking into the messages, copying the 16 digit numbers that are present within the auto generate meeting link, and putting them into an online Luhn Checksum tool. Sure enough the numbers come up as valid credit card numbers thus firing off our email security system.

From what I have seen online the only explanation for this is that it is a statistical coincidence, but this has happened for at least 4 people within the past week which is a lot for the size of our org. This also seems to occur more often than not for the only explanation being a statistical coincidence. You would think that Microsoft might check for this when creating Meeting links.

What can be done about this? The only solution I have so far is to recommend users to recreate the teams invite so that a new number is generated.

For those running service businesses: how do you track renewals? Spreadsheet, CRM, calendar, memory? And has one lapsed on you recently that you expected to keep?

It's that time of year again, where I find out that Lansweeper increased their renewal rate, again.

I have about 200 devices. I don't need to pay for 2000 assets. When I could pay for 500, that was nice. I'm the type that is willing to pay for good software and experience.

But I don't use the cloud stuff. I don't use anything they are developing currently. I don't use a lot of the "features" the software has. In fact, I could still be on a version from 10 years ago and be happy.

So when this latest increase came up, I decided to spend $100 on Claude and got something that does what I need.

Does it do everything Lansweeper does? Of course not, but like I said, I didn't want or need it.

The added bonus is that now I get a few of the things I've wanted it to do, like some basic real time monitoring so I can ditch the prtg server too.

So, if you are looking for a Lansweeper alternative....there are definitely options now for a lot cheaper.

PS - I hate AI and the way the industry is going, but this was a nice success story that is slowly warming my cold, dead heart.

We inherited an AWS account that we'll be using as a testing environment, but the group that has it before us left a bunch of junk (s3 buckets, subnets, random ec2 instances, etc). I've been able to get rid of most of it, but i'm still stuck with 106 S3 buckets, none of which are empty, all with weird individual names, and some with versioning enabled. I know for a fact none of this needs to be kept, but from what i'm seeing AWS doesn't have any nuclear option to just wipe it all out at once, and I either have to go through each one via the GUI and emtpy/delete them, or try to script something via the AWS cli (which still requires me to have each individual name added to said script). Any chance i'm missing something here that would make this process easier or is this just one of the many reasons AWS admins get paid well?

our company doesnt have a wsus server. we tried multiple settings but our internet keeps capping out every patch tuesday. does ANYONE have any working settings PLEASE. our internet is about 1TB but more like 500Mbps realistically

Anybody spinning up server instances in Rackspace Cloud OSPC Flex environment? I see they have a managed backup offering through Cohesity but nothing for Flex. How are you handling backup and restore strategy? TYIA

The last two days, we have been unable to successfully load the Quarantine list from: Quarantine - Microsoft 365 security . Just wondering if anyone else has noticed this?

After about a 5 minute wait, I get a "Failed to load data. Please try again later" message.

I've tried using Chrome & Edge, cleared cache and tried incognito. I had a remote user try to load the page. I have tried from a Domain Controller at one of our offices in a different state.

A tracert seems to possibly indicate a routing issue on their end?

tracert security.microsoft.com

Tracing route to b-0037.b-msedge.net [13.107.6.192]

over a maximum of 30 hops:

   1     1 ms     1 ms     1 ms  domain.com [10.60.1.1]

  2     2 ms     1 ms     1 ms  syn-074-062-096-025.biz.spectrum.com [74.62.96.25]

  3     6 ms     6 ms     6 ms  lag-202.mcr01milzwift.netops.charter.com [76.58.45.160]

  4     5 ms     5 ms     5 ms  lag-9.rcr11milzwift.netops.charter.com [65.29.45.210]

  5     8 ms     9 ms     7 ms  lag-18-10.chctilwc00w-bcr00.netops.charter.com [66.109.6.206]

  6     9 ms     9 ms    10 ms  lag-41.chcgildt87w-bcr00.netops.charter.com [66.109.0.228]

  7     8 ms     7 ms     8 ms  lag-0.pr2.chi10.netops.charter.com [66.109.5.225]

  8    15 ms     *        *     ae84-0.chg-96e-1.ntwk.msn.net [104.44.198.255]

  9     8 ms     *        *     po21.rwa03.ch4.ntwk.msn.net [51.10.39.149]

 10     *        *        *     Request timed out.

 11     *        *        *     Request timed out.

 12    10 ms     8 ms     8 ms  ae1013-0.icr02.ch4.ntwk.msn.net [13.106.210.54]

 13     9 ms     9 ms     8 ms  ae23-0.ch1-96c-1b.ntwk.msn.net [104.44.233.96]

 14     *        *        *     Request timed out.

 15     8 ms     8 ms     9 ms  13.107.6.192

SO we aew using apc battery backups with added network cards for monitoring, but I am toren between what the best solution is to safely shutdown vmware and windows servers.

The software that apc provides looks ok but its pricey and its per server.

NUT is what we currently have set up but I am yet to install the NUT modules onto vmware because it seams just a bit sketchy to install unsupported modules on each hypervisor.

What is everyone else doing for this? Are there any other options besides switching to eaton?

I want to start keeping track of what I do at work, maybe on a daily basis, as a kind of personal portfolio. I sometimes forget the details of tasks I’ve worked on, and I’d like to have something to refer back to when preparing for future interviews.

For those of you who do something similar, how do you go about it? Do you keep a daily log, use a specific tool, or have a particular structure for documenting your work?

For reference: Transition from folder redirection : r/sysadmin

Essentially, I have to unwind redirection of the "My Documents" folder from a server to OneDrive.

I want to test disabling the redirection GPO for a group of individuals. I don't do GPO's often, so it's always a learning curve. Here's what I did:

• Created an AD group "ExcludeMyFolderRedir"
• Added my user name to that group
• Edited the GPO
  • In "delegation", added this new group
  • set the rights of the group in delegation to "read/write" allowed, and "Apply Group Policy" to "Deny"
• save

Logout of Windows and back in, and the folder is still redirected. Tried doing GPUPDATE / FORCE, and waiting 24 hours. The folder is still redirecting.

What lever did I forget to pull?

Hi everyone!

I'm so exhausted being an M365 admin these days. Technology and AI are moving at crazy speeds and I just can't keep up!

Hearing about all the big tech layoffs makes the stress twice as bad. I honestly feel like I could easily be replaced by an AI agent.

Am I overthinking this or are you feeling this pressure too? Maybe burnout?

Hey guys, the company I’m working for has no form of back up active right now and id like to set that up. I’ve looked into the Microsoft back up but it doesn’t feel reliable because why would I keep the back up for the environment within the environment

I’ve looked at Rubrik but it’s expensivee, and I’ve looked at Veeam web which also looks expensive

So how is everyone backing up the data for your organisations? It’s mainly for our Microsoft environment in the event of a ransom attack etc. I’m looking for cheap options as management does not want to spend a lot of money

Plss help : (