{"id":174,"date":"2026-10-28T07:41:16","date_gmt":"2026-10-28T06:41:16","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-wednesday-28-october\/"},"modified":"2026-11-02T16:19:04","modified_gmt":"2026-11-02T15:19:04","slug":"patchwork-wednesday-28-october","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-wednesday-28-october\/","title":{"rendered":"Patchwork &#8211; Wednesday 28 October"},"content":{"rendered":"<p id=\"top\"><strong>This edition focuses on two vendors at the heart of the MSP landscape. WatchGuard yesterday published eighteen advisories for Fireware OS, seven of them critical, including pre-auth code execution in the SIP proxy and the Access Portal, among others. Veeam is closing an unauthenticated authorisation bypass in Backup &amp; Replication 13. In addition, since yesterday the Brotli flaw has been on CISA&#8217;s list of actively exploited vulnerabilities, with exploit traffic coming from a Dutch IP address; the patches for the Tailscale SSH flaws are out; and we briefly cover the latest developments around PHP2Shell: CISA confirms exploitation and NetScaler and PAN-OS are now patched.<\/strong><\/p>\n<ul>\n<li><a href=\"#watchguard\">WatchGuard fixes eighteen flaws in Fireware OS, seven critical<\/a><\/li>\n<li><a href=\"#veeam\">Veeam Backup &amp; Replication 13 vulnerable to unauthenticated authorisation bypass<\/a><\/li>\n<li><a href=\"#brotli\">Brotli flaw in Node.js, .NET and PAN-OS actively exploited, CISA adds it to the KEV catalogue<\/a><\/li>\n<li><a href=\"#tailscale\">Tailscale releases patches for SSH flaws that yield root within a tailnet<\/a><\/li>\n<li><a href=\"#php2shell\">PHP2Shell: CISA confirms exploitation, NetScaler and PAN-OS now patched<\/a><\/li>\n<\/ul>\n<h4 id=\"watchguard\">WatchGuard fixes eighteen flaws in Fireware OS, seven critical<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Eighteen vulnerabilities in WatchGuard Fireware OS 2025.1 to 2026.4, 12.0 to 12.12.4 and (T15\/T35) 12.0 to 12.5.22, plus a flaw in the Mobile VPN with SSL client for Windows. Seven are critical, including pre-auth code execution via the SIP proxy, the Access Portal and the AD authentication service, and missing authentication in FireCluster synchronisation<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-103594, CVE-2026-93865, CVE-2026-93866, CVE-2026-93857, CVE-2026-112709, CVE-2026-112710, CVE-2026-103593 (critical); also including CVE-2026-90465, CVE-2026-93434, CVE-2026-111107 and CVE-2026-115495<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.5 (WireGuard configuration), 9.2 (FireCluster, Access Portal, SIP proxy, AD authentication), 9.1 (logging)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, WatchGuard reported no exploitation as of 27 October 2026 and no public exploit code is known<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Fireware OS 2026.4, 12.12.4 and 12.5.22; a new client version for the SSL VPN client<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>WatchGuard published the eighteen advisories on 27 October on its <a href=\"https:\/\/psirt.watchguard.com\/CVE-2026-93865\" target=\"_blank\" rel=\"noopener\">PSIRT portal<\/a>. The most dangerous ones sit in components that are often exposed to the internet. A stack overflow in the SIP proxy and an integer overflow in the Access Portal can be hit without logging in, as long as a policy uses the SIP proxy or the Access Portal is enabled. The AD authentication service has two heap overflows that an attacker can exploit if they are able to influence traffic to the AD server. The highest score, 9.5, goes to a stack overflow in the WireGuard configuration, although that does require TLS-decrypted access between the Firebox and WatchGuard Cloud. In FireCluster set-ups, the synchronisation daemon lacks authentication, allowing an attacker with access to the cluster link to inject root actions, <a href=\"https:\/\/securityonline.info\/watchguard-fireware-os-vulnerabilities-2\/\" target=\"_blank\" rel=\"noopener\">SecurityOnline summarises<\/a>.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>Code execution on the firewall itself, and with it full control over a customer&#8217;s network traffic. Earlier WatchGuard flaws are listed in the CISA KEV catalogue, so attackers know the product and the appliances are easy to find through internet scans. Among Dutch SMEs, the Firebox sits at the network edge in many places, often at customers who leave management entirely to their MSP.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update all Fireboxes to 2026.4, 12.12.4 or 12.5.22 and update the Mobile VPN with SSL client on Windows workstations. If you cannot patch yet, disable the Access Portal and the SIP proxy where they are not needed, restrict the management interface to trusted addresses and isolate the FireCluster link. Also go through your list of T15 and T35 devices, as they run on a separate branch.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"veeam\">Veeam Backup &amp; Replication 13 vulnerable to unauthenticated authorisation bypass<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Authorisation bypass in the CDP Coordinator Service of Veeam Backup &amp; Replication 13.1.1.18 and earlier (13.1) and 13.0.2.29 and earlier (13.0), both on Windows and on the Veeam Software Appliance. Version 12.x is not affected. The same release fixes two path traversal flaws and a local privilege escalation in Veeam Agent for Linux 13.1.1.4 and earlier<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-108142; also CVE-2026-108140, CVE-2026-108141 and CVE-2026-105477<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.1 (CVSS v4); the others 5.9 and 7.3<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, Veeam reported no known exploitation as of 27 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Backup &amp; Replication 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63); Agent for Linux 13.1.2 (build 13.1.2.11)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.veeam.com\/kb4948\" target=\"_blank\" rel=\"noopener\">Veeam KB4948<\/a>, an attacker without valid credentials can bypass the authorisation check of the CDP Coordinator Service and thereby perform operations on the backup server. The two path traversal flaws do require an account with the Restore Operator role and allow files to be written outside the intended directory. Veeam warns that the patch could quickly be reverse-engineered, and previous Veeam flaws were picked up by ransomware groups within weeks.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>The backup server is the first target for ransomware groups, because destroyed backups remove the victim&#8217;s bargaining position. Access to CDP coordination means access to replication jobs and the associated environments. For MSPs running Veeam for dozens of customers, a single unpatched server immediately affects multiple environments.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update to 13.1.2 or 13.0.3 and update the Linux agents via the backup server. Check whether the backup server is reachable from the internet or from customer networks on the CDP service ports, and close off that access where it is not needed. The secondary report of a flaw in Veeam ONE (KB4951, CVSS 8.5) is, at the time of writing, only known second-hand; check that bulletin yourself if you use Veeam ONE 13.1.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"brotli\">Brotli flaw in Node.js, .NET and PAN-OS actively exploited, CISA adds it to the KEV catalogue<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Out-of-bounds write in Google&#8217;s Brotli decoder (versions 1.0.3 up to and including 1.2.0), bundled in Node.js (before 22.23.4, 24.22.1 and 26.12.1), .NET (before 8.0.33, 9.0.22 and 10.0.14), the Windows builds of PHP, Bun, Envoy and Istio, among others. Palo Alto Networks PAN-OS 11.2 and 12.x with Brotli inspection and TLS decryption, and VMware SDDC Manager 9.1.1 (CVSS 9.8) are also affected<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-111497<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.2 (CVSS v4, Google); Microsoft uses 8.1<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, CISA added the flaw to the KEV catalogue on 27 October 2026; ELLIO observed exploit traffic from an IP address geolocated to the Netherlands, Previdian an attempt on a honeypot<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes for Brotli (1.0.10, 1.1.1, 1.2.1), Node.js and .NET; PAN-OS partially, with several hotfixes to follow between 27 and 30 October; VMware SDDC Manager still without a patch, mitigation in KB460732 and KB460734<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>A server that decompresses Brotli-compressed data can be made to write outside the buffer using a crafted stream, leading to code execution. According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/adobe-commerce-polyshell-attacks-breach.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, security firm ELLIO observed exploit traffic from the address 94.154.43.7, an IP geolocated to the Netherlands that had previously also carried out PHP2Shell attacks. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/27\/node2shell-broccoli2shell-vulnerability-cve-2026-111497\/\" target=\"_blank\" rel=\"noopener\">Help Net Security<\/a> points out that the flaw reaches far beyond Node.js: the decoder is also found in .NET, Python packages, container images and network equipment. Palo Alto Networks updated <a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-111497\" target=\"_blank\" rel=\"noopener\">its advisory<\/a> on 27 October and Cisco is still investigating which products are affected.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>The Dutch NCSC already issued a warning last week, when no exploitation was yet known. With the addition to the KEV catalogue, that has changed. The tricky part is that updating the system library does not touch the bundled copies in Node.js, .NET and container images. Every application and every image has to be rebuilt or updated separately. On a firewall with Brotli inspection and TLS decryption, moreover, it is the inspection itself that is vulnerable.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Take stock of where Brotli is in use: Node.js runtimes, .NET services, PHP on Windows, reverse proxies and container images. Update Node.js to 22.23.4, 24.22.1 or 26.12.1 and .NET to the runtimes listed, and rebuild images rather than just patching the base OS. For PAN-OS: check which hotfix is already available for your version and temporarily disable Brotli inspection if it is not yet out. For SDDC Manager, Broadcom&#8217;s workaround applies until a patch is available.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"tailscale\">Tailscale releases patches for SSH flaws that yield root within a tailnet<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Eleven flaws in Tailscale SSH, tailscale serve, the experimental app connector and Headscale, collectively referred to as Tailworm. An authorised user can reach root-only sockets via SSH forwarding, such as the Docker socket and the tailscaled API. Found in Tailscale 1.104.2 and Headscale 0.29.5<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned; Tailscale bulletins TS-2026-014 to TS-2026-017 inclusive<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, Tailscale reports no exploitation; the proof of concept has not been made public<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Tailscale 1.104.4; no fix for Headscale had been reported as of 28 October. Workaround: disable SSH forwarding with TS_SSH_DISABLE_FORWARDING=1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>The flaws were discovered by Cyberdione Labs and reported on 27 October by Dutch news sites <a href=\"https:\/\/www.security.nl\/posting\/959265\/\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a> and <a href=\"https:\/\/internet.headliner.nl\/item\/tailscale-waarschuwt-voor-lek-waarmee-hackers-rootrechten-kunnen-krijgen-tweakers-223995\" target=\"_blank\" rel=\"noopener\">Tweakers<\/a>; Tailscale confirmed them in <a href=\"https:\/\/tailscale.com\/blog\/tailscale-ssh-findings-fixes\" target=\"_blank\" rel=\"noopener\">a blog post of its own<\/a> alongside the fix release. The crux: Tailscale SSH runs as root and allowed a logged-in user, via unix socket forwarding, to reach sockets that the user would normally have no rights to. Via the Docker socket or the tailscaled API, that amounts to root on the host in a few steps, and from that host an attacker can repeat the same trick on other nodes in the same tailnet. Hence the wormable name.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>Many MSPs and small IT teams use Tailscale as a management layer to customer servers, precisely because it is simple. A single compromised device with SSH access is then enough to gain root on other servers via the tailnet. Exposure depends on the SSH policies: the broader the access, the greater the reach.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update all nodes to 1.104.4 and review the SSH policies so that only the accounts that genuinely need it are granted SSH access. If you run Headscale as your control server, disable SSH forwarding using the environment variable until a fix is available. On nodes running Docker, check whether the socket was unintentionally reachable and review Tailscale&#8217;s audit logs for unexpected SSH sessions.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"php2shell\">PHP2Shell: CISA confirms exploitation, NetScaler and PAN-OS now patched<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Last week&#8217;s two PHP flaws, now also patched in Citrix NetScaler and Palo Alto Networks PAN-OS<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-109618, CVE-2026-109619<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.2<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, confirmed by CISA since 26 October 2026 (KEV catalogue); first independently confirmed successful shells on honeypots<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; now also updates for NetScaler and PAN-OS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>What&#8217;s new?<\/strong><\/p>\n<p>Patchwork <a href=\"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-woensdag-21-oktober\/\" target=\"_blank\" rel=\"noopener\">already wrote about PHP2Shell last week<\/a>; since then, three things have changed. CISA added both flaws to the KEV catalogue on Monday, thereby confirming exploitation, after having seen no successful attacks last week, <a href=\"https:\/\/www.theregister.com\/cyber-crime\/2026\/10\/27\/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits\/5305681\" target=\"_blank\" rel=\"noopener\">The Register reports<\/a>. Researcher Adel Karimi counted 35 successful shell executions on honeypots on 24 October, and the Threat Intelligence Lab at Dutch university TU Delft recorded more than 50,000 exploit requests from over 600 IP addresses in seventy countries. Sophos and Palo Alto, by contrast, withdrew earlier claims of successful intrusions. In addition, Citrix (NetScaler, critical) and Palo Alto Networks (PAN-OS, high) released their own patches, <a href=\"https:\/\/www.security.nl\/posting\/959263\/\" target=\"_blank\" rel=\"noopener\">Security.nl writes<\/a>, with Palo Alto bringing forward scheduled releases.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>If you still had NetScaler or PAN-OS on your list as &#8216;waiting on the vendor&#8217;, you can now cross them off. The NCSC now considers the likelihood of large-scale exploitation to be lower, but Shadowserver still counts almost 20,000 unsupported PHP installations in the Netherlands that will no longer receive a patch. For those, the only remedy is upgrading or taking them offline.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This edition focuses on WatchGuard, with eighteen Fireware OS advisories including seven critical pre-auth flaws, and Veeam, which fixes an unauthenticated authorisation bypass in Backup &#038; Replication 13.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169449,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-woensdag-28-oktober\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-mittwoch-28-oktober\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-R.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-R-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"This edition focuses on two vendors at the heart of the MSP landscape: WatchGuard and Veeam.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-174","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=174"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/174\/revisions"}],"predecessor-version":[{"id":175,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/174\/revisions\/175"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=174"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}