A short clip from my IP subnetting video talking about how 16 million IP addresses were allocated. See the full video here: youtu.be/7hIbzlxbebc

CVE-2026-80097: Android Microsoft Authenticator could hand work tokens to a zero-permission app impersonating Teams/etc. Fixed in 6.2606.4246+. Enforce min version via MDM for work profiles. thehackernews.com/2026/10/mi… #identity

Huntress: M365 campaign replayed post-MFA session tokens across 79 orgs (497 successful sign-ins). Attackers registered rogue Entra devices, swapped MFA, and hid inbox rules. Password reset alone isn’t enough—revoke sessions, audit devices/MFA/rules, tighten Conditional Access. thehackernews.com/2026/10/mi… #cybersecurity #identity

RIP Walter Koenig

Arista patched CVE-2026-114625 (CVSS ~9.9) in on-prem VeloCloud Orchestrator: authenticated low-priv users can escalate to full operator via SQL injection. Active exploitation confirmed; hosted already fixed. Restrict VCO access and patch on-prem ASAP. bleepingcomputer.com/news/se… #cybersecurity #SDWAN

PHP2Shell (CVE-2026-109618/109619): unauth RCE in PHP core. Emergency builds out; CISA: patch or offline. Amazon saw pre-disclosure attempt Oct 17 and broad exploitation after release. Inventory PHP, prioritize internet-facing, WAF is stopgap only. cisa.gov/news-events/alerts/… #cybersecurity

eMudhra intermediate CA keys were so weak they were trivial to recover. Mozilla/Google/Apple blocked them; update trust stores and verify non-browser TLS stacks. bleepingcomputer.com/news/se…

PHP ships emergency fixes today ~14:00 UTC for two critical RCEs (CVE-2026-109618 / 109619, CVSS 9.2). Details leaked; prepare upgrade paths and inventory internet-facing PHP now—partial workarounds are not enough. bleepingcomputer.com/news/se… #cybersecurity

OpenCode Console: legacy-system breach may have exposed third-party AI API keys for ~1.4% of linked Console users. Revoke/rotate OpenAI, Anthropic, Google keys at the provider—not only in the tool—and audit usage. thehackernews.com/2026/10/op… #AIsecurity

Oct Windows Server security updates can break on-prem Exchange OWA/mail flow (Endpoint Mapper lookup limit under load). Not the Exchange CU itself—use Microsoft’s registry guidance; don’t yank Exchange security patches. bleepingcomputer.com/news/mi…

ConnectWise Cloud Backup (ex-SkyKick) app identities were abused to sign into Microsoft 365 tenants as the trusted backup principal. Vendor disabled 7 app IDs and suspended the service; audit Entra service principals, role grants, and app secrets. bleepingcomputer.com/news/se… #cybersecurity #M365

Chrome 155.0.8059.84/.85 patches 10 issues including critical prerender UAF CVE-2026-110922. No exploitation reported for this set—still prioritize fleet update. cybersecuritynews.com/google…

Cisco confirms active exploit of SEG CVE-2026-76519 (CVSS 9.8): unauth attacker emails a crafted attachment → arbitrary file write and root commands when AMP file reputation is on and scanner tools are outdated. Second SEG root issue since September. Patch/update scanner tools now. bleepingcomputer.com/news/se…

Palo Alto patched PAN-OS CVE-2026-0322 (CVSS 8.6): authenticated RCE as root via management interface; limited live exploitation confirmed. Cloud NGFW/Prisma Access not affected. Lock down mgmt access to trusted IPs and patch ASAP. bleepingcomputer.com/news/se…

New ClickFix twist (“Adception”): Google ads route via legitimate Bing redirects to a fake Claude macOS installer; copy button swaps the real install command for malware. Ad/search trust as the cloak. bleepingcomputer.com/news/se…

Cisco: five critical NX-OS flaws on Nexus 3000/9000 can yield root RCE or reload DoS when NX-API/NGOAM/MPLS OAM is on. Internal find; no known exploitation yet. Patch or disable unused features. bleepingcomputer.com/news/se…

FBI/DOJ seized 7 domains for Flax Typhoon–linked MicroScan + FishHub (Integrity Tech). Joint advisory: scanning, spear-phish, SoftEther persistence, email theft vs CI and others. CISA KEV adds 5 CVEs (due Oct 11). bleepingcomputer.com/news/se…