thanks for coming to my ted talk.

PHP patch is now avaiable https://www.php.net/archive/2026.php#2026-10-21-5

Get it while its hot :)

Can we get a list going?

So far I found:
Synology
Unifi OS EDIT: I may be wrong about this one.
pfsense
fortinet

Anyone else sitting at working just spamming the update button on my Linux web hosts because the PHP repo servers are so overloaded they have basically been hit with a DDOS attack, so you just keep hitting update in the hopes it will eventually work or is that just me?

That's the subject line of an email from my personal website hosting this morning, advertising upgraded AI-assisted websites.

I'm taking it as a sign that my decision to retire early at the end of the year is a good one. But it's also really depressing, especially given the posts I've seen here lately of layoffs and other separations attributed to management confidence in AI as a substitute for skilled sysadmins. EDIT: I made my decision months ago, I had many reasons for retiring, it was NOT because of this marketing email.

Ultimately, I think the bubble will burst, and the value of experience will make itself obvious again, but it's going to be a rough ride for our profession until then.

Someone on our team changed numbers recently and it exposed something I’d never really thought about. A few weeks later we found out their old number had already been reassigned. That number had been used for years with vendors, former coworkers, contractors, delivery people, old MFA setups, random group chats and probably a hundred things nobody remembers anymore. Imagine being the person who gets it next. You don’t need to hack anything, people just start texting you assuming you’re the previous owner.

Obviously the answer is cleaning up accounts and not using SMS as an identity system in the first place but realistically nobody remembers every place their number has ended up. We’ve started thinking much more carefully about which relationships are tied to phone numbers at all. Signal for some people, Kibu for a few contacts where identity matters more, company managed accounts for work etc. Am I overthinking this or is phone number recycling a massively underrated social engineering risk? These two hit very different things like the first is invisible wealth, while the second is identity persistence after a phone number changes.

Hey fellow sysadmins, a significant chunk of our tech stack is hit today, affecting our main CRM (PM Tool) alongside our dev tools; wondering could this be caused by the PHP day0 discovered or you believe there's something else lingering in the background?

Wondering if anyone got any insights as to what's going on in here, any other global, widespread used apps that are affected?

Two critical PHP core RCEs (CVE-2026-109618 and CVE-2026-109619) leaked before disclosure, and the fixed releases are due today at 14:00 UTC. Reports say PHP 5 to 8 are affected and EOL branches may get no fix (BleepingComputer). Huntress's write-up has a practical checklist: inventory every install, including php.exe and php-cgi.exe bundled inside vendor software and control panels like cPanel and Plesk, and isolate EOL PHP from the internet (Huntress). The harder part is the external view: legacy sites and appliances on the internet that aren't in anyone's CMDB. This overview of handling zero-day exposure makes the same point: when patches are late or missing, asset visibility and temporary controls (restricting access, disabling the affected service) do most of the work.
What's your fastest reliable way to enumerate PHP across servers, appliances and your external footprint? Package queries, EDR inventory, banner scans, something else?

Lots of my jobs are failing or stuck and I'm told their is an issue with asynchronous job processing on their backend for US-1.

Specifically the SOAR part of the platform is dead right now.

How seriously was it taken? Was there genuine panic, or was it mostly business as usual? Did you spend months preparing for it, and what was the atmosphere like as midnight approached?

Would love to hear some firsthand stories, especially from those who were on duty that night.

Came across this in the wild today as a sysadmin, spoofed quarantine@messaging.microsoft.com email suggesting a forwarding group had a 98% full mailbox. Passed all SPF, DKIM, Dmarc checks because it came from a genuine Microsoft tenant. In the headers its given away by the actual tenant which was sirackoleji.onmicrosoft.com

Submitted to Microsoft for analysis and confirmed as a highly sophisticated spoof worth being vigilant.

Current setup:

• Main site in Houston with on-prem AD and Windows file servers. Users map drives network Drives
• Azure Hybrid environment with about 100 users.
• Brazil users connect back to Houston over FortiGate VPN, and file access is slow
• About 10 TB of data total.
• ½ of Brazil staff don't work from one office. They're spread out or remote. We have about 10 users now and may be expanding soon.
• Veeam for backup

Hope you guys can give me some reocmmendations on how can users from Brazil can access the data on on-prem faster. I looked into Azure Files and Azure FIle Syncs with and without local Brazil server. What do you guys recommend? Thanks.

Anyone trawling their estates currently gathering info for a big cleanup of affected software etc ?

PIP, Python, Homebrew, Ubuntu, Debian......just trying to get our heads round what needs updating and what doesn't.

Feels like Heartbleed all over again.....

Azure hybrid environment here. We currently append user email signatures via a transport rule. Looking at CodeTwo, but I still think I'll have to solve this problem.

Some users have professional credentials they want to list after their name. In the past, the handful of people we had, we just added it to the display name, which is kind of clumsy. We can continue with that I suppose, but I wonder if there's a better way (like, . Side note, how do you handle, if at all, credentials that require a trademark symbol?

I could add these as attributes and format them in the transport rule, but I'm wondering what other ways people are doing this...

A heads up in case you weren't aware, a patch is being released tomorrow for two RCEs found in PHP core by Calif^\1].) It affects PHP version 5 onwards^\2].)

The RCE appears to work on default installations of many commonly deployed services and frameworks such as WordPress, Magento, Laravel and more^\3].)

If you have deployed any service that runs on PHP, prepare to patch ASAP. As soon as the patch drops, attackers will begin to weaponise the vulnerability at scale.

Patch is reportedly being released at 14:00 UTC, however as per PHP's announcement (We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.), it may well drop sooner since details are beginning to leak.

[1] https://www.php.net/index.php#2026-10-20-1
[2] https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
[3] https://x.com/k_firsov/status/2112641845926989944

EDIT 03:00 UTC - A PoC for the vulnerability has dropped within the past hour: https://jackalsyn.com/posts/php-up-2026.html. This post mentions potential mitigations, but to be safe you should take any internet-facing PHP apps offline ASAP until you can patch properly, less you risk getting pwned. 🫡

EDIT - Patches are out: https://www.php.net/archive/2026.php#2026-10-21-5

https://www.cyber.gov.au/essentials

We've been working towards E8, thankfully don't need to start from scratch.

Any other (Aussie) E8 sysadmins have an opinion on these new principals?

Anyone else seeing boot loops after the 10/14/2026 BIOS update on Dell Pro Max 14/16 systems?

We’ve had a few, but not all, get stuck rebooting with a “trouble connecting to the network” message after installing the update through Dell Command Update.

The workaround we found was to disable Intel TXT in BIOS, let the update/boot complete, then re-enable Intel TXT afterward. The machines boot normally after that.

https://emudhra.we-have-a-problem.com/

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Key got pwned. Update your cert stores now!

If those work you are vulnerable:

curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

Google impersonation:

curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'

This might be really niche and limited to mainly Energy sector IT but I'm a bit frustrated with this damn thing and thought I'd see if anyone else had experience with this. Some of my understanding of this might be off or limited. I've inherited this damn thing.

Petrel is a subsurface software platform developed in house by the ever irritating Schlumberger. It uses the annoyingly antiquated practice of having a physical hardware licence key that its licence server pretty much constantly challenges to make sure it's valid. I've used these things before. Even going back to ones in print media that fitted to parallel ports with pass through to things like printers.

The server that runs the app\licence server is up in azure as the company in question has no local hardware that can really run it. So right now i'm getting away with having digi usb over ip hub and mounting that on the azure server. The problem is the office internet connection is.... not the most reliable. Its fine for a user but even a blip in the connection is enough to kill the licence server and force intervention from me.

I was trying to work out if we could clone the dongle somehow, but didn't expect any real success there without getting into some.... grey territory.

The next step might be to make the client suck it up and colocate a bit of hardware just for this purpose, that would solve the issue.

So yeah, anyone else had something like this and have a manageable way to work it?

Been facing this issue since Oct 16 where the queue fills up (stuck in RETRY status) over night. A reboot resolves the issue for less than a day.

Errors seen in queue viewer:

432 4.3.2 STOREDRV; mailbox database is offline; STOREDRV.Deliver.Exception:MailboxOfflineException.MapiExceptionMdbOffline; Failed to process message due to a transient exception with message Cannot open mailbox

I opened a case with Unified Support (Sev B) on Monday and the engineer just kept asking me to provide output of powershell commands. He took 24 hours to reply each time. Today I opened a Sev A case and the PFE immediately told me about the below with a potential fix:

https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382

Recently discovered Action1, which gets rave reviews. I already have NSight RMM, which does patching, and Intune, with everything it does.

If I use Action1, should I turn off the patching capabilities of the other two? Will they conflict? Or how should I use them effectively together?

Reported 5 domains (mix of .org .com .ca) not resolving NS queries, or even not querying anything at all validated via cmd line and 3 online tools including Google dig. Look fine in the admin console. Support confirmed no holds with compliance (and I already knew that, they would look different if that were the case).

Get told to check if hosting provider made any changes - SMH. Mix of systemdns, our own NS, and an external webhost but that's irrelevant if a query can't even find the domain in the first place (.com on icann) to get the NS records first.

I only went thru about 50 domains so far and found 5 "missing" :( so 10% gone

We're a small shop: 40-50 desktops, 5-6 servers, Watchguard firewall, mixture of older Catalyst switches we are looking to replace, Ubiquity mesh network over a few buildings connected by AirFiber. Nothing too fancy.

Recently our awesome rep at Connection (formerly PC Connection) left, and I've had a hell of a time getting through to them to be reassigned. I eventually gave up and placed an order with CDW, who has a SMB team. Fine...I get not having a dedicated rep for a company of our size. Initially it was okay placing the first order, they made a mistake with the order and I'm still working on having it cleared up. Emails go ignored, so I've had to call to get any movement, which is inconvenient.

I reached out to Insight but had a similar experience to Connection: calls unanswered, misrouted or long hold times just to speak to someone in sales about setting up a new account.

Is this just the landscape now for SMBs? To those in similar environments, who do you use and who do you recommend? I need a reseller to get various licenses from, network hardware, etc.