{"id":178,"date":"2026-10-27T07:41:05","date_gmt":"2026-10-27T06:41:05","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-tuesday-27-october\/"},"modified":"2026-11-02T16:21:11","modified_gmt":"2026-11-02T15:21:11","slug":"patchwork-tuesday-27-october","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-tuesday-27-october\/","title":{"rendered":"Patchwork &#8211; Tuesday 27 October"},"content":{"rendered":"<p id=\"top\"><strong>This edition focuses on PHP, which runs on most web servers: two critical flaws have been confirmed as actively exploited and were added to the CISA catalogue yesterday. In addition, attackers are stealing Microsoft 365 tokens that render MFA no obstacle, and Tailscale SSH is awaiting a patch for serious privilege escalation.<\/strong><\/p>\n<ul>\n<li><a href=\"#php\">Critical PHP2Shell flaws in PHP actively exploited: CISA gives US government agencies until 29 October<\/a><\/li>\n<li><a href=\"#m365\">Token replay in Microsoft 365: 97 accounts at 79 organisations taken over despite MFA<\/a><\/li>\n<li><a href=\"#tailscale\">Tailscale SSH: researcher demonstrates privilege escalation to root, patch expected within 24 hours<\/a><\/li>\n<\/ul>\n<h4 id=\"php\">Critical PHP2Shell flaws in PHP actively exploited: CISA gives US government agencies until 29 October<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Two critical vulnerabilities in PHP (PHP2Shell) that allow unauthenticated remote code execution: memory corruption under low-memory conditions and a stale internal request state<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-109618 and CVE-2026-109619<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.2 (both)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes. CISA added both to the KEV catalogue on 26 October 2026; successful code execution on a honeypot reported on 24 October<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released on 21 October 2026)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/cisa-confirms-active-exploitation-of.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, Adel Karimi of Perplexity reported on 24 October that he had successfully executed code on honeypots using a public exploit. He cautions, however, that this was achieved in a deliberately favourable setup with a single mod_php worker, so reliability in other configurations remains unknown. Meanwhile, Palo Alto Networks&#8217; Unit 42 withdrew its claim that a breach at a European government was linked to these flaws.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>PHP runs on around 70 per cent of all websites, and Censys counts more than 32.5 million PHP services running a vulnerable version. For MSPs with hosting or web clients, this means CMS sites, online shops and customer portals could be taken over directly. The PHP developers are also warning of a third RCE risk for which no patch is yet available. Windows builds additionally received a second update because of a Brotli bug, which is reachable via cURL when automatic decompression of HTTP responses is enabled.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Take an inventory of all PHP servers, both your own and your clients&#8217;, including shared hosting and containers, and update to one of the patched versions. On Windows, install the rebuilt packages with the fixed Brotli library. Disable automatic decompression in cURL where you do not need it, and check logs for unusual requests with large cookies since 21 October.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"m365\">Token replay in Microsoft 365: 97 accounts at 79 organisations taken over despite MFA<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Abuse of stolen Microsoft 365 sign-in tokens via phishing pages that sit between the user and Microsoft (adversary-in-the-middle) and via device code phishing. This involves abuse of legitimate sign-in flows, not a software bug<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, observed by Huntress from 14 July to 22 September 2026 (published on 26 October)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, this is not a software flaw. It can be mitigated with Conditional Access and by cleaning up residual access<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/microsoft-365-token-replay-attacks.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, Huntress based its findings on almost 200,000 failed login attempts from the 193.26.115.0\/24 range, which resulted in 497 successful sign-ins. The attackers stole tokens via spoofed login pages, device code phishing and social engineering, and replayed them within minutes from their own systems. Huntress calls this &#8216;token spraying&#8217;. Because the token has already been issued after the MFA step, the attacker no longer needs a second factor.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>In total, 97 accounts at 79 organisations were affected. In at least 19 organisations, the attackers removed existing MFA methods and registered their own method within three hours. Some 48 fake devices were registered in Entra, which continue to provide access until the devices are removed. Hidden inbox rules deleted or moved emails about salaries, deposits and bonuses, and one mailbox sent spam to hundreds of external recipients. This is consistent with preparation for invoice and payment fraud.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Revoke sessions and reset passwords for suspicious accounts. Check Entra for unknown devices, changed MFA methods, new enterprise applications and inbox rules with cryptic names. Restrict the device code flow with Conditional Access and enforce MFA for all users, all cloud apps and all client types.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"tailscale\">Tailscale SSH: researcher demonstrates privilege escalation to root, patch expected within 24 hours<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Multiple vulnerabilities (&#8216;Tailworm&#8217;, 11 findings) in Tailscale SSH and related components. In the lab, a compromised device can gain root on other servers if SSH forwarding is enabled. Tested on Tailscale 1.104.2 and headscale 0.29.5<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, no exploitation reported; the findings come from lab tests on 25 October 2026 and the proof of concept is not public<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Not yet. Tailscale confirmed serious issues on 27 October and is aiming for a release within 24 hours; until then, the measures below apply<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How could the vulnerability be exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/unpatched-tailscale-ssh-flaws-could-let.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, the research was published by Erica Windisch of Cyberdione Labs. The attacker must already control a device on the network that the access rules permit to reach the target. Using SSH forwarding, a swapped socket and a race condition, she was able in the lab to gain root and to have her own machine accepted as a trusted server. The claim that the flaws are &#8216;wormable&#8217; is disputed by other researchers, and the final step did not work with Tailnet Lock enabled.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>For MSPs that use Tailscale for administrative access to client servers, a single compromised device could escalate to root privileges on multiple systems. Tailscale VP Mike Shaver does not recommend disabling Tailscale SSH, and Tailscale describes the issues as primarily privilege escalation.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Disable SSH forwarding, either per rule in the hosted service or with TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment (the only option on headscale 0.29.5). Write access rules as individual source-destination pairs and remove broad identity or tag grants. Remove app connector permissions and tailscale serve forwarding to a Unix socket if you do not need them, and enable node key expiry. Install the update as soon as it becomes available.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Critical PHP flaws are being actively exploited, attackers steal Microsoft 365 tokens despite MFA and Tailscale SSH awaits a patch for privilege escalation to root.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169421,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-dinsdag-27-oktober\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-dienstag-27-oktober\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"PHP2Shell flaws in PHP actively exploited, Microsoft 365 token replay hits 79 organisations and Tailscale SSH flaws await a patch.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-178","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=178"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/178\/revisions"}],"predecessor-version":[{"id":179,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/178\/revisions\/179"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=178"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}