Monday opens with a federal patching deadline that is already here, set just three days ago. Here is the longer version of today's five, with the version numbers, KB numbers and links that do not fit in three minutes.
Ivanti Connect Secure: the deadline is today
In early October, Volexity watched an attacker chain three zero-day flaws in Ivanti Connect Secure VPN appliances to get full root control with no sign-in, on a device that was fully patched at the time. Ivanti fixed the first flaw, CVE-2026-104935, on October 13, as BleepingComputer reported. Last week Ivanti shipped fixes for the remaining two, the root-level privilege escalation CVE-2026-111357 and the predictable-identifiers flaw CVE-2026-118527, and on October 30 CISA added both to its Known Exploited Vulnerabilities catalog: CVE-2026-111357 is due today, November 2, and CVE-2026-118527 is due November 13. Ivanti's advisory lists no workaround; the fix is the upgrade, to Connect Secure 25.1.1.3 (from 25.1.1.2 and prior) or 22.8R2.6 (from 22.8R2.5 and prior). If the appliance has not been upgraded since the Volexity report, treat it as needing an investigation as well as a patch.
The fix watch: quiet weekend, one recap
Microsoft posted no new fixes over the weekend. If last week passed you by: the October 27 updates carry both recent repairs. KB5127936 resolves the Smart App Control switch that sat grayed out on Windows 11 versions 25H2 and 26H2 (version 24H2 still relies on Microsoft's workaround), and KB5127653 and KB5127936 resolve the Remote Desktop sign-in failure with error 0xC000000D for non-admin users.
Exchange: Outlook on the web sign-in, day twenty
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". Windows release health still lists it as Mitigated, a workaround but no fix, across Windows Server 2016, 2019, 2022 and 2025. Today is day twenty. If you run your own Exchange server, read that entry before this week's patch window, and note the affected updates include KB5126646, KB5126655 and KB5126651.
The install watch: still quiet
Microsoft posted no new "this update fails to install" issues through the weekend; the most recent known-issue changes remain the two fix entries above, from October 28. A quiet week means a failed install on your machine is more likely local than a known problem. If one fails, note the error code before calling IT.
PHP2Shell reaches the Palo Alto firewalls
The two PHP flaws behind last month's emergency releases, CVE-2026-109618 and CVE-2026-109619, are now being used against firewalls. Palo Alto Networks updated its advisory on October 28 to confirm active exploitation against PAN-OS management interfaces exposed to the internet, and Unit 42's threat brief says it independently verified what Dream Research reported: 25 compromised PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea, with the PHP flaws chained to a Linux kernel privilege escalation for root. Palo Alto says the exposure is limited to the small share of devices with management interfaces reachable from the internet, its hotfixes are released, and its standing guidance is the fix that costs nothing: restrict the management interface to trusted internal addresses. The PHP fixed versions themselves, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, have been out since October 21.
If you do three things this week
- If you run Ivanti Connect Secure, upgrade to 25.1.1.3 or 22.8R2.6 today, and check the appliance for signs of compromise.
- If you run Exchange, read Microsoft's OWA release health entry before you patch this week.
- Check that no firewall management interface, any vendor, answers from the open internet.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.