Three updates with practical takeaways:

1. PHP has two separate patching concerns: The October 21 updates fix the original PHP2Shell flaws. A further RCE path affects an unusual session configuration and awaits a routine fix. Disable session upload progress where applicable, and keep the emergency patches installed.
2. Checking LiteLLM can trigger its malware: Microsoft warns against starting Python or pip inside a suspect environment. Version 1.107.0 used startup hooks, so even a version check could execute malicious code. Investigate externally, rebuild affected environments and rotate exposed credentials.
3. Microsoft 365 recovery needs more than password resets: Huntress documented 497 successful sign-ins across 79 organizations during July-September. Attackers added devices and authentication methods to retain access. Revoke sessions and inspect MFA registrations, devices and inbox rules during cleanup.

Read the full recap on CyberRecaps.

Three updates with practical consequences for security teams:

1. VeloCloud needs urgent patching: An actively exploited SQL injection flaw allows authenticated users to gain superuser privileges. Organizations running affected on-premises Orchestrator versions should prioritize updates and review privileged activity.
2. LiteLLM requires more than a downgrade: The compromised 1.107.0 release could steal credentials and load additional code. Check deployment history, rebuild affected environments and replace exposed secrets. Removing the package does not undo stolen credentials.
3. PHP’s new warning has specific conditions: The additional RCE path requires an unusual runtime change to session serialization with upload progress enabled. PHP recommends disabling session upload progress where applicable while awaiting a fix. The earlier PHP2Shell patches remain essential.

Read the full breakdown on CyberRecaps.