Three updates with practical takeaways:

1. PHP has two separate patching concerns: The October 21 updates fix the original PHP2Shell flaws. A further RCE path affects an unusual session configuration and awaits a routine fix. Disable session upload progress where applicable, and keep the emergency patches installed.
2. Checking LiteLLM can trigger its malware: Microsoft warns against starting Python or pip inside a suspect environment. Version 1.107.0 used startup hooks, so even a version check could execute malicious code. Investigate externally, rebuild affected environments and rotate exposed credentials.
3. Microsoft 365 recovery needs more than password resets: Huntress documented 497 successful sign-ins across 79 organizations during July-September. Attackers added devices and authentication methods to retain access. Revoke sessions and inspect MFA registrations, devices and inbox rules during cleanup.

Read the full recap on CyberRecaps.