Five things breaking this week: PHP attacks, Exchange, Always On VPN, Smart App Control and NTLMv1
Attackers are already going after the PHP flaws, October's Windows updates are knocking over some Exchange servers, an Always On VPN fix turned out not to be one, Smart App Control can get stuck off, and NTLMv1 hardening may break Wi-Fi and VPN sign-in. Here's what to check and what to do for each.
On this page
It's been one of the toughest weeks for IT and security teams in a long time. If you only have five minutes, here's what's breaking, who it affects and what to do about it.
1. PHP: attackers have started
Yesterday's critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, are now being targeted. The security firm watchTowr says it's seeing active exploitation attempts against both. OpenAI, whose model was one of those used to find them, says that to its knowledge AI found these flaws before attackers did. That head start is now over.
What to do: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On Azure App Service, move internet-facing apps to the Latest release channel and rebuild custom containers. The full steps are in yesterday's PHP post.
2. Exchange Server: OWA sign-in and mail flow problems after October's Windows updates
Microsoft has confirmed that the October 2026 Windows security updates can make some on-premises Exchange servers unstable on Windows Server 2019 and later. Users may not be able to sign in to Outlook on the web, mail can sit in the Outbox, and mailbox moves can struggle. Some servers log Event ID 1006 with MapiExceptionMdbOffline.
The cause is a new default limit on how many simultaneous Endpoint Mapper lookups Windows will handle: 512. A busy Exchange server can need more. Not every server is affected, because it depends on load.
What to do: Microsoft says not to uninstall the updates. Its temporary workaround is to raise the limit, from an elevated Command Prompt on each affected Exchange server, then restart:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /fKeep an eye on the servers afterwards. A permanent fix is in progress.
3. Always On VPN: the fix that wasn't
Since September's updates, Always On VPN profiles on Windows 11 24H2 and later that use automatic protocol selection, falling back between IKEv2 and SSTP, could get stuck on Connecting or fail with "The specified port is already in use". Microsoft marked this fixed in October's update, then said that was a mistake and moved it back to Mitigated. A real fix is planned in the coming weeks.
What to do: if your users are affected, set the profile to a single protocol, SSTP only or IKEv2 only, until the fix arrives.
4. Smart App Control: can't be turned back on
After the October update for Windows 11 24H2, 25H2 and 26H2, KB5127648, some devices that have Smart App Control turned off can't turn it back on, because the option is greyed out. Devices where it's already on aren't affected and stay protected.
What to do: nothing urgent if Smart App Control is already on. If you need to turn it back on, Microsoft has published registry and Group Policy workarounds in KB5127648 while it works on a fix.
5. NTLMv1: Wi-Fi and VPN sign-in may break
This one is a planned change, not a bug, but it's landing now. From the October 2026 update, Windows 11 24H2, 25H2 and 26H2 and Windows Server 2025 block NTLMv1-derived credentials for single sign-on by default on devices without Credential Guard. If your Wi-Fi, wired or VPN connections use MS-CHAPv2, users may fail to connect through single sign-on.
What to do: find any MS-CHAPv2 connections and plan the move to certificate-based authentication, such as EAP-TLS with certificates from Intune. Microsoft documents a temporary registry setting to allow and audit these connections while you migrate, in KB5066470. Then switch enforcement back on.
The short version
- Patch PHP everywhere today, internet-facing first.
- On busy Exchange servers, apply the Endpoint Mapper registry workaround. Don't uninstall the update.
- Set Always On VPN profiles to a single protocol if users can't connect.
- Leave Smart App Control alone if it's on. Use the KB's workaround if you need it back.
- Find MS-CHAPv2 Wi-Fi and VPN profiles and plan the move to certificates.
Sources
- watchTowr: PHP2Shell exploitation
- Axios: the PHP flaws and the week's cyber emergency
- Microsoft Exchange Team: Exchange servers may become unstable after October 2026 Windows updates
- BleepingComputer: October Windows Server updates break Exchange sign-in and mail flow
- BleepingComputer: Microsoft says October updates didn't actually fix VPN issues
- KB5127648: October 2026 security update for Windows 11
- Windows message center and KB5066470: NTLMv1 hardening
Suggest a topic or a tool
Related posts
Azure Security · What's new NEWThe PHP flaw that took websites offline worldwide: what AI found, and what to do in Azure today
Two critical PHP flaws, found with the help of AI, sent organisations around the world scrambling to take websites offline today. PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix them. Here's what happened, and how to find every PHP app you run in Azure and get the fix as quickly as possible.
Entra Security · What's newFrom November, every user can create agent blueprints in Entra unless you turn it off
Message Center MC1506733: starting in early November 2026, default users can create agent identity blueprints unless an admin switches off a new user setting. What a blueprint controls, who's affected, and how to turn it off before the rollout.
Intune Security · What's newMicrosoft's deadline week: four products retire tomorrow, and Secure Boot's last 2011 certificate expires next Monday
13 October 2026 ends support for Windows 11 24H2 Home and Pro, Windows 10 2016 LTSB and Office LTSC 2021, and moves Windows Server 2022 into extended support. On 19 October the Windows Production PCA 2011 certificate expires. Pick what you run for your own action list, and check any device's Secure Boot status in seconds.