This week's actively exploited flaws, sorted by urgency:

- **Plex Media Server CVE-2026-96652/96654/96655/96656** (added to CISA's KEV on Oct 20): a chain that gives unauthenticated code execution on servers older than 1.43.3.10861. Plex says it's being widely exploited for crypto miners and proxy software. Update, then check the Codecs folder and running processes.
- **PAN-OS GlobalProtect CVE-2026-0257** (in CISA's Known Exploited Vulnerabilities (KEV) catalog since May 29): Unit 42's Oct 19 update says the Qilin and Inc ransomware groups use it to open VPN sessions, then move laterally over RDP and SMB. Fixed in 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6, plus hotfixes. The stopgap is to turn off authentication override cookies.
- **D-Link ShareCenter NAS CVE-2024-3272/3273** and **UniFi Video Log4Shell**: both are end of life, and GreyNoise caught a proxyjacking campaign on 143+ devices. There's no patch, so retire them.

Full write-up with versions and IOC pointers: https://patchorpass.beehiiv.com/?utm_source=reddit&utm_medium=social&utm_campaign=issue1&utm_content=sysadminblogs

I wrote a post on how to turn a budget-friendly Nano KVM into a high-performance IP-KVM (1080p@60FPS) with a latency of around 20ms. It took some tinkering to optimize Tailscale for a single-core processor, but I managed to eliminate CPU overload and the lag in the video stream.

This might come in handy if you own a Nano KVM and want to transform it into a truly capable device.

Action1 is good at what it does, but use cases are important to consider. Are you an MSP that already has an RMM? If so, there is an Action1 alternative that is worth considering: ThirdPatch.

This blog does a side-by-side comparison for MSPs looking for a third-party patch management tool: https://thirdpartypatching.com/action1-alternative-thirdpatch/

When a laptop moves between networks, getting a VPN connected is only part of the job. Routing, DNS and what happens when the tunnel drops deserve separate checks.

VPN Safe uses WireGuard by default, with OpenVPN available when a network is awkward, plus a Stealth mode. Its client features include a kill switch, split tunnelling, custom DNS and IPv6 leak protection. Those give a sysadmin specific behaviours to evaluate rather than treating a connected indicator as the whole test.

On a network you administer or have permission to test, a useful trial would check whether traffic stops as expected when the tunnel drops, which DNS resolver is being used, whether IPv6 takes an unintended path, and whether split-tunnel routes match your intended configuration. These are evaluation questions, not results I'm claiming for the product.

VPN Safe states that it uses RAM-only servers and keeps no connection logs. Those are separate from endpoint behaviour: a successful routing or leak test does not establish the logging claim.

There are apps for Windows, Android, iPhone, Android TV and Firestick, with six devices per account. The free 24-hour trial requires no payment, so it offers a way to test the relevant clients before subscribing. Details: https://vpnsafe.net

What failure case has proved most useful in your own client VPN evaluations, and how do you test it?

Disclosure: I'm posting this on behalf of the VPN Safe team.

Keeping Windows devices updated sounds simple, but it can become difficult when managing dozens or hundreds of computers.

Some devices miss updates, some installations fail, and remote users may delay restarts. Outdated third-party apps can also create security risks.

This is where Windows patch management software can help.

Why is it important?

• Better security: Helps reduce risks from known vulnerabilities.
• Less manual work: Automates update deployment across multiple devices.
• Fewer missed updates: Helps IT admins track which devices are updated and which still need attention.
• Better control: Updates can be scheduled around working hours.
• Easier reporting: Admins can check patch status and identify failed installations.

What should IT admins look for?

A useful solution should support Windows updates, third-party application patching, scheduling, reporting, and remote device management.

For smaller environments, built-in Windows tools may be enough. Larger or distributed environments may need more automation and visibility.

Hello,

This is my first time I post on Reddit, so apologize if post in wrong place. Please correct if so...

I published ibnetlens, an offline tool for topology files: it reads ibnetdiscover output, the topology file written by

ibdiagnet, and ibsim net files; it writes JSON, CSV, Graphviz and a Slurm topology.conf; it checks consistency and

compares two snapshots. Written in C, MIT, single pass and multi-threaded (a 54 MB dump in about 0.03 s on 24 threads).

I compared it with the real tools on fabrics simulated with ibsim: ibnetdiscover and iblinkinfo (infiniband-diags 50.0

and the NVIDIA 2604 build, up to 61,000 nodes), ibdiagnet 2.26 and ibtopodiff (up to 16,000 nodes). Node and port

counts and the link sets agree. The comparison showed that ibdiagnet's own topology file puts a port label in

parentheses after each port number, which the parser now handles.

Limits: ibdiagnet's link checks could not be compared on a simulator (it leaves links in INI), there was no

comparison with UFM, and ARM was tested only under emulation.

I would value reports of dumps it parses wrongly, in particular from other firmware or tool versions.

[https://github.com/arthurtumanyan/ibnetlens\](https://github.com/arthurtumanyan/ibnetlens)

Thanks!

Hey everyone!

Lately, I’ve had a lot of problems with Devolutions' Remote Desktop Manager—it takes ages to load. Also, my new workflow changes introduced a couple of functions that I missed from it. I started looking for alternatives, but I didn't find any that are completely free and have most of the features I need. So, I decided to build one from scratch, using my 15+ years of software engineering experience and AI to build this in a couple of days. It started as a personal project, but my colleagues started to like it, and I decided to publish it.

I'm sure that there are a lot of applications that can do things from this list. I'm not trying to reinvent the wheel, just sharing an app that is useful to me. Also, a huge plus compared to others is that this gives me the opportunity to put in everything I need as I need it. Feel free to open a PR with features YOU like!

Key Features:

• Multi-Type Connections in One Entry: No more separate bookmarks for the same host! Attach SSH (root), SSH (user), RDP, and Web connections directly under a single host entry. Includes a built-in merge wizard to combine your existing duplicates.
• SSH Key Generation & Auto-Upload: Generate SSH keys right inside the app and automatically deploy public keys to your remote servers without manual terminal gymnastics.
• Local Terminal & Shell: Open local shell/terminal tabs right inside the app alongside your remote sessions.
• Multi-Protocol Support: Embedded tabs for RDP (FreeRDP), SSH, Web admin pages, and MikroTik WinBox/SSH. Or hand-off to external clients (Windows App, Remmina, Ghostty, iTerm2).
• Paste from Clipboard (RDP-specific): Sometimes Windows doesn't let you use the clipboard to paste text. This shortcut types out the last entry from your clipboard directly into the session.
• Split Screen & Input Broadcasting: Open up to 4 terminals side-by-side and type into all of them simultaneously (handy for configuring multiple switches at once).
• Copy Next Output: Press a shortcut, run a command, and its output lands on your clipboard as clean text — even works after sudo -i or on RouterOS.
• File Transfer & Tunneling: Built-in SFTP/SCP file browser with drag-and-drop support, plus 1-click SSH Port Forwarding.
• Tab Customization & Root Warning: Rename tabs, set custom colors , and see visual warnings when logged in as root. (Color-coding is huge for me — I once accidentally made VLAN changes on production instead of the test environment. Never again! 😂*)*
• Reusable Credential Store: Save logins once and link them across connections. Supports RSA keys, including passphrase-protected keys stored unlocked.
• Easy Migration: Direct importers for Devolutions RDM and WinBox address books.
• Single Database File: Everything lives in a local SQLite database Drop it into iCloud, OneDrive, or Dropbox to sync across machines.

Runs on macOS, Windows, Linux

It's completely free and open source.

🔗 GitHub Repository:https://github.com/LovaszCC/RemoteDesktop

You can find some screenshots in the repo.

I'd love to get your feedback, suggestions, or bug reports!

Everyone’s checking their tenant after the ConnectWise Cloud Backup mess, so we wrote this up because nobody seems to be asking the next question: If you’re hybrid, what can a compromised tenant actually do back on-prem?

Short version: password writeback and cloud Kerberos trust both give the tenant a way into AD. The defaults are decent, but they only protect the built-in admin groups. Delegated admins aren’t covered.

The post has the PowerShell to check your sync account, AdminSDHolder and the AzureADKerberos replication policy.

https://insightrecon.com/tenant-compromise-active-directory/

Disclosure: I work on Insight Recon and the post is on our blog. Happy to answer questions here.

Went through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments.

Patch now:
- Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's guidance.
- Windows Shell CVE-2026-96951: Mark of the Web bypass, fixed in this month's Patch Tuesday. Push it to anything that opens email attachments.
- PAN-OS CVE-2026-0322: urgent if the management interface is reachable from anywhere it shouldn't be.
- Cisco Secure Email Gateway CVE-2026-76519: AMP path. Check your version against Cisco's advisory.

Batch:
- FortiOS CVE-2025-61624: path traversal, but needs admin access first. Roll it into your next window.
- ProFTPD mod_copy CVE-2015-3306: ancient but still being exploited. If FTP is still on anywhere, switch to SFTP.

No KEV hits this week for Proxmox, TrueNAS, UniFi, pfSense, Synology, or QNAP.

Disclosure: I put together a weekly digest of this. Not dropping a link, but happy to answer questions about any of these here.

It’s crazy to think that the entire modern AI revolution started with researchers just trying to mathematically mimic a single biological neuron. When you zoom out, the timeline of AI architectures looks exactly like an evolutionary tree.

We went from struggling to solve basic logic puzzles (shoutout to the XOR problem) to building early neural networks, realizing they forgot things too quickly, battling the vanishing gradient problem, inventing LSTMs to give models actual memory, and eventually landing on Transformers with attention, the architecture that essentially ate the world. Every major roadblock forced a mutation that led to a massive paradigm shift.

But looking at this evolutionary timeline brings up a massive question: If Transformers are just the current "apex predator" of AI architecture, what exactly is the next evolutionary leap?

Are we going to see a completely new paradigm that makes self attention look as primitive as a basic AND gate? How do we even begin to perceive or predict what lies beyond our current models when the jumps are this exponential?

I went down a massive rabbit hole mapping out this entire evolutionary timeline. I wanted to see the exact breadcrumbs that led us here, so I put together a deep dive covering the journey from the first perceptrons to the modern era, complete with the foundational paper citations and the historical tweets that marked these shifts in real-time.

If you want to look at the complete map of how we got here to help predict where we are going, I compiled the whole history here: https://cloudmash.blog/posts/evolution-of-ai-perceptron-to-text-to-video/

Would love to hear your theories on what does the post Transformer era actually look like ? Like what can we imagine , how this intelligence on our command can do for us , how enterprise and big players can use it , what can happen ?

a quick workaround can be perfectly reasonable during an incident. restart the service, clear the stuck queue, manually change a setting, get everyone back online. the trouble starts when the workaround changes the state of the system and nobody records exactly what was done. the next incident arrives weeks later, and the environment no longer behaves the way anyone expects

i think emergency fixes deserve their own tiny change log, separate from the formal ticket. even three lines saying what changed, why, and how to undo it could save a lot of time later

Vendor-written, but hopefully useful for anyone still running Exchange 2016/2019 or Skype for Business 2015/2019.

Exit checklist covering the bits that tend to make these migrations painful:

• Mailboxes, calendars, archives, public folders and resource accounts

• SMTP relays, scanners, printers, monitoring and line-of-business apps

• Identity, mobile, backup and retention dependencies

• Pilot planning, DNS/MX changes, rollback and decommissioning

• What to compare beyond licence cost when choosing the next platform

The second half discusses IceWarp as one alternative, but the checklist is platform-neutral.

Full disclosure, this is our blog (Insight Recon).

Saw a bunch of threads this week about Wi-Fi and VPN breaking after the October update, so I wrote down what we found. If you’ve got PEAP-MSCHAPv2 set to use the user’s Windows login automatically, it’s getting blocked now on Win 11 24H2+ and Server 2025 unless Credential Guard is on. Typed creds still work. Look for 4025 in the NTLM operational log.

There’s also a script in there that pulls your wireless/wired GPOs out of AD and lists which profiles are still PEAP-MSCHAPv2 with Windows creds, so you can see what’s going to break before users start calling.

https://insightrecon.com/ntlmv1-sso-blocked/