This morning's show was all patching: what is being attacked, what Microsoft fixed this week, and what a recent update broke that is still waiting on a fix. Here is the longer version, with the numbers and links that do not fit in three minutes.
The PHP flaws hit their federal deadline today
PHP is the programming language behind a large share of the web's sites and online stores. On Monday, CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog, its list of bugs attackers are using right now: CVE-2026-109618, which CISA names a "PHP Memory Corruption Vulnerability", and CVE-2026-109619. US federal agencies were given until today, October 29, to fix them. A three-day window is short, and that tells you how CISA rates the risk.
If your company runs its own website, or pays someone to host it, ask one question today: are we on a patched version of PHP?
Microsoft fixed the Remote Desktop error 0xC000000D
Since the September 2026 preview updates, some people who are not administrators could not connect with Remote Desktop to machines that have Administrator protection turned on. The connection failed with error 0xC000000D. Microsoft's release health page now lists the issue as resolved by the updates released on October 27: KB5127936 for Windows 11, versions 26H2 and 25H2, and KB5127653. BleepingComputer covered the fix the same day.
If you saw that error, install this week's update and try again.
Exchange: signing in to Outlook on the web, still not fixed
After the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". OWA is Outlook on the web. Microsoft lists it on Windows release health as Mitigated: there is a workaround, and there is not yet an update that fixes it. It covers Windows Server 2016, 2019, 2022 and 2025.
If you run your own Exchange server, read that entry before your next patch window, not after.
The install watch: quiet this week
Microsoft posted no new "this update fails to install" issues this week. A quiet week is still worth saying out loud, because it means a failed install on your machine is more likely local than a known problem. If one fails, write down the error code; it is the first thing IT will ask for.
Brotli2Shell: the next one to watch
Brotli is the compression that makes web pages smaller so they load faster, and it is built into a lot of software. CISA added CVE-2026-111497, a flaw in Google's Brotli decoder, to its exploited list on October 27, with a federal deadline of November 10. Tenable's FAQ calls it Brotli2Shell. Because Brotli lives inside other products, the fix arrives as updates from those products, so expect a run of them over the next two weeks.
If you do three things this week
- Ask whoever runs your website whether PHP is patched.
- Install this week's Windows update if Remote Desktop has been failing.
- If you run Exchange, read Microsoft's OWA entry before you patch the server.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.