Attackers are using PHP2Shell against Palo Alto firewall management pages, an exploited flaw crashes Cisco ASA and FTD VPNs, and Talos found an SD-WAN implant that steals network keys. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: What finally got your certificate renewals automated? Reply in the comments or at feedback@defensivesecurity.org.

1. Update: PHP2Shell hits Palo Alto management pages - CVE-2026-109618, CVE-2026-109619, CVE-2026-46300 - federal due 2026-10-31 - Do: Take PAN-OS management off the internet - https://security.paloaltonetworks.com/CVE-2026-109618

2. Exploited flaw crashes Cisco ASA and FTD VPNs - CVE-2026-76418 - Do: Patch Cisco ASA and FTD VPN firewalls - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

3. Attackers try a new Oracle EBS flaw - CVE-2026-101767 - Do: Apply Oracle's October patch to E-Business Suite - https://www.oracle.com/security-alerts/cpuoct2026.html

4. SD-WAN implant steals the network's keys - CVE-2026-20127 - Do: Hunt SD-WAN controllers for KeyDrift - https://blog.talosintelligence.com/uat-11473-keydrift/

5. Exploited ESX flaw hides admin actions from logs - CVE-2026-41709 - Fixed: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 - federal due 2026-11-11 - Do: Apply VMware's July ESX updates - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

6. WatchGuard fixes seven critical Firebox flaws - CVE-2026-93857, CVE-2026-93865, CVE-2026-93866 (+ 4 more) - Fixed: Fireware 2026.4, 12.12.4, 12.5.22 (T15/T35) - Do: Update WatchGuard Fireware - https://psirt.watchguard.com/CVE-2026-93857/

7. Firefox 159 fixes 167 security flaws - Fixed: Firefox 159; ESR 153.6, 115.44; Thunderbird 159, 153.6 - Do: Push the Firefox update - https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/

8. Entra drops SMS and voice MFA in February - Do: Move Entra users off SMS and voice codes - https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

9. WordPress 7.1.4 fixes an update-time RCE - Fixed: 7.1.4 (backports to 4.7.39) - Do: Update WordPress core - https://wordpress.org/news/2026/10/wordpress-7-1-4/

10. Seven unpatched Ultralytics code-execution flaws - CVE-2026-118613, CVE-2026-118614, CVE-2026-118615 (+ 4 more) - Do: Load Ultralytics files only from sources you control - http://www.zerodayinitiative.com/advisories/ZDI-26-818/

11. Few teams automate nearly all TLS renewals - Do: Automate your TLS certificate renewals - https://www.helpnetsecurity.com/2026/10/29/tls-certificate-automation-report/