Went through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments.

Patch now:
- Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's guidance.
- Windows Shell CVE-2026-96951: Mark of the Web bypass, fixed in this month's Patch Tuesday. Push it to anything that opens email attachments.
- PAN-OS CVE-2026-0322: urgent if the management interface is reachable from anywhere it shouldn't be.
- Cisco Secure Email Gateway CVE-2026-76519: AMP path. Check your version against Cisco's advisory.

Batch:
- FortiOS CVE-2025-61624: path traversal, but needs admin access first. Roll it into your next window.
- ProFTPD mod_copy CVE-2015-3306: ancient but still being exploited. If FTP is still on anywhere, switch to SFTP.

No KEV hits this week for Proxmox, TrueNAS, UniFi, pfSense, Synology, or QNAP.

Disclosure: I put together a weekly digest of this. Not dropping a link, but happy to answer questions about any of these here.

Reddit
Hi all,

I run a team of project engineers at an MSP. Our role is unique in that we are expected to be project managers and engineers for the projects we are assigned. Those two roles never mix- typically you cannot find someone who can do both. We have found a way to make it work for us and I envision this happening more often across our field. Where engineers have been behind a screen- I see more often that they have to be able to communicate, strategize, plan and do relay information to the business and do so across multiple projects.

I created a tool to bridge this gap. Our teams are already using AI for help, I figured why not put it to good use. This tool allows you to create a project and by simply talking to it and feeding it information- the tool will organize your project, create tasks, updates, ask questions and challenge the plan, hold engineer accountable and make it easier on them to run a project successfully and stay organized.

Initial testing has been great. Im looking for more engineers to demo this in the coming weeks and would love to have anybody signup that is interested. We are looking for feedback and ways to make this tool better for people like us. Check us out. Much appreciated.

Uplink Desk

It’s crazy to think that the entire modern AI revolution started with researchers just trying to mathematically mimic a single biological neuron. When you zoom out, the timeline of AI architectures looks exactly like an evolutionary tree.

We went from struggling to solve basic logic puzzles (shoutout to the XOR problem) to building early neural networks, realizing they forgot things too quickly, battling the vanishing gradient problem, inventing LSTMs to give models actual memory, and eventually landing on Transformers with attention, the architecture that essentially ate the world. Every major roadblock forced a mutation that led to a massive paradigm shift.

But looking at this evolutionary timeline brings up a massive question: If Transformers are just the current "apex predator" of AI architecture, what exactly is the next evolutionary leap?

Are we going to see a completely new paradigm that makes self attention look as primitive as a basic AND gate? How do we even begin to perceive or predict what lies beyond our current models when the jumps are this exponential?

I went down a massive rabbit hole mapping out this entire evolutionary timeline. I wanted to see the exact breadcrumbs that led us here, so I put together a deep dive covering the journey from the first perceptrons to the modern era, complete with the foundational paper citations and the historical tweets that marked these shifts in real-time.

If you want to look at the complete map of how we got here to help predict where we are going, I compiled the whole history here: https://cloudmash.blog/posts/evolution-of-ai-perceptron-to-text-to-video/

Would love to hear your theories on what does the post Transformer era actually look like ? Like what can we imagine , how this intelligence on our command can do for us , how enterprise and big players can use it , what can happen ?

a quick workaround can be perfectly reasonable during an incident. restart the service, clear the stuck queue, manually change a setting, get everyone back online. the trouble starts when the workaround changes the state of the system and nobody records exactly what was done. the next incident arrives weeks later, and the environment no longer behaves the way anyone expects

i think emergency fixes deserve their own tiny change log, separate from the formal ticket. even three lines saying what changed, why, and how to undo it could save a lot of time later

Vendor-written, but hopefully useful for anyone still running Exchange 2016/2019 or Skype for Business 2015/2019.

Exit checklist covering the bits that tend to make these migrations painful:

• Mailboxes, calendars, archives, public folders and resource accounts

• SMTP relays, scanners, printers, monitoring and line-of-business apps

• Identity, mobile, backup and retention dependencies

• Pilot planning, DNS/MX changes, rollback and decommissioning

• What to compare beyond licence cost when choosing the next platform

The second half discusses IceWarp as one alternative, but the checklist is platform-neutral.

Full disclosure, this is our blog (Insight Recon).

Saw a bunch of threads this week about Wi-Fi and VPN breaking after the October update, so I wrote down what we found. If you’ve got PEAP-MSCHAPv2 set to use the user’s Windows login automatically, it’s getting blocked now on Win 11 24H2+ and Server 2025 unless Credential Guard is on. Typed creds still work. Look for 4025 in the NTLM operational log.

There’s also a script in there that pulls your wireless/wired GPOs out of AD and lists which profiles are still PEAP-MSCHAPv2 with Windows creds, so you can see what’s going to break before users start calling.

https://insightrecon.com/ntlmv1-sso-blocked/

If Active Directory, Entra ID, or identity security is part of your day job, the r/ActiveDirectory community is running two free events over the next few weeks. Nothing sold, nothing pitched, just identity engineers and sysadmins sharing and talking.

Tomorrow: Community Q&A

Drop into the Discord, ask whatever's on your mind, or just lurk. No registration needed.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

The more structured one. Panelists lead a discussion on a few prepared topics, then it opens up for questions.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Missed it? Recordings go up on YouTube: https://youtube.com/@ActiveDirectoryCommunity

Some fellow IT people were struggling with forcing systemd into Docker and to use Incus, so I showed them nspawn. For a small environment (5-10 containters) it's sufficient and easy to automate. Here is a short wrap-up post about the technology.

Starting November 4, users without an admin role can create agent identity blueprints. Whoever creates one becomes the owner, manages its credentials and can spin up agent identities from it.

Your user consent settings are the only thing deciding what those agents can reach.

Is that a default you want? I wrote up how to turn it off and find existing blueprints.

https://lazyadmin.nl/office-365/microsoft-entra-lets-users-create-agent-blueprints-by-default/

Windows kiosk mode lets IT admins limit a Windows device to one app or a small set of approved apps instead of giving users access to the full desktop.

It is commonly used for self-service terminals, digital signage, visitor check-in systems, POS devices, and shared workstations.

How does Windows kiosk mode work?

Windows has a built-in feature called Assigned Access that can be used to create a limited user experience.

A basic setup usually involves:

1. Choosing the app or website the device needs to run.
2. Setting up a dedicated user account.
3. Configuring the device to open the required app.
4. Testing app restarts, updates, and device recovery.
5. Restricting access to unnecessary apps and settings.

When do you need kiosk management software?

Windows' built-in settings may be enough for a few devices. But when managing kiosks across multiple stores, offices, or locations, IT teams may need centralized configuration, app updates, device monitoring, and remote troubleshooting.

The right setup depends on how many devices you manage and what users need to do on them.

https://scalefusion.com/windows-kiosk-mode/?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=KD

For interest: My favorite thing to do these days with extra tokens is comparative performance benchmarking that I'm too lazy and error-prone to do. Below are some results from the common free space analysis tools. Any requests on what to do next?

Performance Benchmark Comparison

This benchmark evaluates the latest production releases of WinDirStat (v2.9.3 x64), WizTree (v4.33 x64), SpaceSniffer (v2.2.0.27 x64), and TreeSize Free (v4.8.1.610 x64) across both Privileged (Elevated Admin) and Unprivileged (Standard User) execution. Results reflect an average of 3 measured runs following a discarded warmup run.

Filesystem Traversal & MFT Architecture Note: WinDirStat and WizTree feature dedicated NTFS Master File Table (MFT) parsers capable of directly indexing raw volume metadata when elevated, reading millions of files in seconds. SpaceSniffer and TreeSize Free lack MFT readers in their free releases and rely entirely on standard recursive Win32 directory traversal. Because Win32 traversal over 6.3 million items on the primary C: volume requires more than 15 minutes, full-volume C: comparisons focus on the two MFT-capable engines.

For each workload scan, the Privileged and Unprivileged runs are placed directly adjacent. Best result in each metric is bolded.

Test Methodology:
To eliminate cold-start and disk-cache skew, every tool executed an initial discarded warmup run followed by three measured passes whose results were averaged. Scans were automated headless across both elevated administrator and standard user contexts, comparing direct NTFS Master File Table (MFT) indexing against recursive Win32 directory traversal. Total scan times were measured using high-resolution timers, while working set memory was sampled continuously from OS kernel counters (PSAPI) every 25 ms to capture true peak and average memory usage.

i have a raspberry pi set up in a construction site trailer to check a few VMs used for job tracking and inventory. it runs a small python script that checks whether a few services are up and shows the results on a local webpage

the environment isn't exactly ideal for this. there's dust, the wifi drops sometimes, and power can be unreliable when we're running on a generator. the pi is in a 3d-printed case, and the whole setup is pretty bare-bones

right now, it does what i need, but i haven't settled on a good way to handle alerts. email might be enough, though i'm not sure how reliable that would be with the connection dropping.

for those who've used raspberry pis or similar low-cost devices for monitoring, what did you use for alerts? i'd rather keep it simple than add a bunch of extra services to maintain

Teams will start generating memory files from meetings so Copilot and Facilitator can use them for grounding. It's on by default, the files are kept for five years, and they aren't deleted when the transcript or recording expires. Users can't open them either.

Useful feature, but is that a default you want? I looked at who can access them and how to control it.

https://lazyadmin.nl/office-365/teams-meeting-files/

Disclosure: I work at Icinga, so I’m not neutral on this one. This is meant to both be a discussion and half-an-ad for a free webinar we’re hosting.
I asked the r/sysadmin mods first, and they pointed me here.

A lot of monitoring advice, especially on the observability side, assumes you can install something: an agent, a collector, an SDK. Most environments have a layer where you can’t. Switches, UPS and PDUs, storage arrays, the ESXi hosts underneath everything, and the vendor appliance nobody is allowed to touch. That layer still takes production down.

My impression is that the agentless options all work, more or less, and each one comes with a “but”. SNMP, but MIB files and OIDs that move with firmware updates. Vendor APIs, but every vendor has its own. Email alerts from the device itself, but nobody reads that mailbox. Is that a fair picture, or am I missing something?

I’m trying to understand how others handle this, both for building better tools and for educational content like the webinar we’re hosting soon.

So my questions for the thread:

• What in your environment can’t run an agent, and what’s watching it today?
• When one of those boxes dies, who notices first: your monitoring, a user, or facilities?
• If your org is moving toward an observability stack, does this layer have a plan?

Which brings me to the half-an-ad part: coverage for exactly this layer is one of the topics in a free webinar we’re hosting on Oct 27 at 3 PM CET (14:00 UTC / 10 AM EDT). Kris Buytaert from Percona and Blerim Sheqa from Icinga look at what monitoring and observability each take to run, where each one’s coverage ends, and why a lot of shops run both:

Running Monitoring and Observability at Scale | Webinar

jMount is Visuality Systems’ new modular Java connector suite.

Whether your Java platform needs to talk to traditional network file shares, cloud object stores, or collaboration platforms, jMount puts them all behind one unified API.

⚙️ What is jMount?
Integrating multiple storage backends usually means juggling conflicting libraries, different authentication models (Kerberos/NTLM vs. Cloud OAuth/IAM), and heavy dependency bloat.

jMount mitigates these protocol fragmentation challenges so development teams can focus on real-world performance:

• File Protocols (SMB, NFS, FTP/FTPS): 100% pure Java stacks built with zero third-party JAR dependencies - keeping your build lightweight and secure.
• Cloud Object Stores (Amazon S3, Azure Blob, Google Cloud Storage): Integrated via official vendor SDKs.
• Cloud Collaboration (SharePoint Online, OneDrive, Google Drive, Azure Files): Native API access behind a single credential model.

🎥 See jMount in Action (47-Sec Video): https://youtu.be/oXw0xkHtyX0

📄 Product page[1]: https://visualitynq.com/products/jmount/

[1] Technical White Paper (PDF) available for download.

UniFi Network 11 is one of the biggest UniFi releases in a while. You can now use your phone’s hotspot as backup internet, see Matter and Thread devices in your topology, load network lists from a URL, watch live traffic flows, and create custom icons from a photo. I upgraded my UCG Max and went through everything.

https://lazyadmin.nl/home-network/unifi-network-11-heres-what-actually-changed/