Microsoft’s October 28 preview update, KB5127936, fixes Remote Desktop failures that blocked non-admin users on hosts with Administrator Protection enabled. The issue followed earlier updates and affected connections with error 0xC000000D; Microsoft’s fix builds on the resolution covered in its Windows 11 Remote Desktop error update.

Source

Microsoft says the October 28 KB5127936 preview update finally fixes Windows 11 Always On VPN failures, after it had to retract its claim that October’s update resolved the bug. Always On VPN creates secure connections between devices and corporate networks; September’s security updates broke some profiles using automatic protocol selection or fallback between IKEv2 and SSTP. Affected connections could hang at “Connecting” or report that the specified port was already in use.

Source

Cisco has tasked 27-year-old engineer Padmanabhan Krishnamurthy with rewriting 98% of its legacy code within 24 months, giving him unlimited AI-coding tokens. The first test is a four-week proof of concept. The ambitious target comes after Krishnamurthy proposed that a two-person team could do the work.

Source

Cisco Catalyst SD-WAN controllers manage connections between an organization’s sites. Talos says attackers used a critical authentication flaw to plant KeyDrift, malware that can collect encryption key material from controller traffic. Separately, Lumen reports Volt Typhoon exploited the same flaw from late 2025, but has not linked that activity to KeyDrift.

Source

Cisco has released fixes for CVE-2026-76418, a zero-day attackers are exploiting to remotely crash Cisco Secure Firewall ASA and FTD devices. The flaw affects reachable SSL VPN services when secondary authentication is configured on a tunnel group; attackers don’t need to log in. Shadowserver is tracking more than 51,000 Cisco ASA SSL VPN devices exposed online, though that count does not show how many remain vulnerable.

Source

Cisco has open-sourced Project Quarry, a detection engine that looks for risky behavior across an AI agent’s full session rather than judging tool calls in isolation. The release includes a command-line scanner, a Python SDK, and plugins for Claude Code, Codex, and other MCP-compatible agents. Cisco says Quarry is already used in AI Defense and plans to bring it to DefenseClaw.

Source

PHP2Shell’s reach extends beyond websites: embedded PHP can leave firewall, VPN, and other appliance management interfaces exposed to remote code execution. CISA has confirmed active exploitation of the flaws, and added them to its Known Exploited Vulnerabilities catalog. Appliance customers often cannot patch PHP themselves; they must wait for vendors to issue updated firmware.

Source

A fix for critical EDK II vulnerability CVE-2026-97631 has been merged into the project’s code, but no stable release includes it yet. The flaw can let an attacker run code in firmware while a server boots over the network, before Secure Boot checks startup components. Until hardware vendors ship firmware updates, organizations that do not need PXE boot can disable it to reduce exposure.

Source

Tailscale creates a secure private network connecting devices, and Tailscale SSH lets approved devices connect across it without passwords or keys. A researcher’s Tailworm report described how a foothold on an approved device could lead to root access on reachable servers; Tailscale has now released version 1.104.4 to fix flaws that could let a permitted session reach root-only services. The Tailscale SSH server runs on Linux and the open-source macOS build.

Source

Tailscale SSH lets approved devices connect across a Tailscale network without relying on conventional SSH passwords or keys. A new report says that, with port forwarding enabled, an attacker who already controls an approved device could exploit the feature to gain root access on reachable servers. The findings come from lab tests, and Tailscale has not confirmed the specific claims.

Source

VeloCloud Orchestrator (VCO) is a web-based portal for managing software-defined wide-area networks (SD-WAN) and their edge devices. Arista says attackers are exploiting a critical flaw in on-premises VCO that lets any authenticated user gain elevated operator privileges. Customers should upgrade to a fixed release and check for signs of compromise.

Source