Cyber Tech Cafe

11/03/2026

Malaysia Airlines confirmed this week that a cybersecurity incident at its third-party reservation provider, Amadeus, may have exposed customer booking data spanning nearly three years. Cathay Pacific (~53,000 bookings) and Japan Airlines (~92,000 customers) have also been affected.

Here's what stands out: Malaysia Airlines says its own IT systems were never compromised. The weak link wasn't the airline — it was the vendor.

This is the supply chain risk every business faces. You can have strong internal security, patched endpoints, and solid policies, but if a vendor handling your customer data gets hit, you're exposed anyway.

The difference between a headline and a manageable incident often comes down to how quickly you learn about it and how prepared you are to respond. That's where proactive IT management matters.

For MyIT clients, vendor security awareness and rapid incident response aren't extras — they're part of the service. If you're still handling IT reactively, this is the kind of story that should prompt a conversation.

Sources:
- TEISS: https://www.teiss.co.uk/news/malaysia-airlines-hit-by-data-breach-after-reservation-provider-cyber-attack-18400
- NST: https://www.nst.com.my/amp/business/corporate/2026/11/1568069/malaysia-airlines-says-it-systems-unaffected-amadeus-data-breach
- CNBC TV18: https://www.cnbctv18.com/world/malaysia-airlines-says-customer-data-may-be-affected-by-amadeus-cybersecurity-breach-20024194.htm

Malaysia Airlines reports customer data may have been affected by a cybersecurity incident involving its reservation technology provider Amadeus.

10/30/2026

Microsoft's October Patch Tuesday just dropped 1,411 security fixes, broke Exchange sign-ins, knocked out Remote Desktop for non-admins, AND ended support for Windows 11 24H2 — all in one month.

At this point, we're pretty sure Microsoft's release calendar is just a dartboard labeled "How do we keep CTC busy?"

Your IT guy didn't have plans this weekend anyway. He was totally looking forward to registry edits, certificate trust list updates, and explaining to the CEO why Outlook is giving him the spinning wheel of death.

For everyone else: yes, we patched all of it. Yes, your email works. Yes, turning it off and on again was considered — but this time, Microsoft actually made us read a KB article.

Enjoy your weekend. Your servers will still be there Monday... probably.

---

CTC — We handle the updates so you don't have to. ☕️

Sources:
- 1,411 flaws fixed: https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
- Exchange issues: https://www.bleepingcomputer.com/news/microsoft/microsoft-october-windows-server-updates-cause-exchange-issues/
- Remote Desktop fix: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-remote-desktop-failures-caused-by-recent-windows-updates/

Send a message to learn more

10/29/2026

This week, CISA and the NSA issued urgent alerts about critical vulnerabilities in PHP — a programming language that underpins an estimated 70% of websites. Codenamed "php2shell," these flaws allow unauthenticated remote code ex*****on, and attackers were already probing systems within minutes of disclosure.

Former CISA Director Chris Krebs noted that 3% of all critical vulnerabilities ever discovered were found in just the past month, driven by AI-assisted research. Cloudflare reported exploit attempts escalating from thousands to millions within hours.

Key actions CISA recommends right now:
• Inventory every system running PHP (including the software you don't realize uses it)
• Patch immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35
• Take unpatched systems offline if they cannot be updated
• Monitor for suspicious activity like PHP processes launching shells

Some organizations — including government agencies — pulled websites offline as a precaution. That is the correct call when the alternative is uncontrolled exposure.

This is exactly why reactive IT breaks under pressure. Proactive patch management, asset visibility, and continuous monitoring are not IT luxuries anymore; they are operational necessities. If your team does not have the bandwidth to track, test, and deploy critical patches within hours of disclosure, that is what MyIT is built for.

Sources:
CISA Alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
The Guardian: https://www.theguardian.com/technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability
CNBC: https://www.cnbc.com/2026/10/23/php-vulnerabilities-ai-cybersecurity.html

Governments and businesses around the globe are scrambling to contain the fallout after the PHP vulnerabilities leaked online.

10/28/2026

The threat landscape isn't slowing down.

June: 206 critical updates (a new record)
July: 600+ (that record was immediately broken)
September: 900+
October: 1,400+

The MyIT Program was built on the principle that maintenance is security. But as the threats evolve, so do we.

We are rolling out meaningful new capabilities across endpoints, networks, and cloud — designed specifically for this new normal.

Read the full post here:

The Threat Landscape Keeps Moving. The MyIT Program Continues to Evolve to Keep Pace. Oct, Wed, 2026 nathan CTC NEWS , Industry News , Mailing List A few years ago, the average month brought 50–100 updates from Microsoft, with maybe a handful rated as critical. Each one closed a door that attacker...

10/28/2026

Generative AI isn't just helping people write emails — it's helping attackers build fake login pages that look exactly like the real thing.

The Hacker News reported this week that phishing campaigns are now using AI to recreate familiar login screens, copy company branding, and even tailor messages to specific employees. Some of these fake pages don't just steal passwords. They capture MFA codes and hijack active sessions, giving attackers access even when two-factor authentication is turned on.

According to the 2026 Verizon Data Breach Investigations Report, phishing accounted for 44% of AI-assisted initial-access techniques examined.

Here's the uncomfortable truth: awareness training and email filters are still important, but they aren't enough on their own. When a fake page looks identical to your Microsoft 365 login and the URL is off by one character, even sharp employees can miss it.

This is exactly why layered protection matters — and why our MyIT program includes email filtering, DNS protection, MFA enforcement, and endpoint monitoring that catches threats after the click. Because eventually, something gets through. The question is whether anyone notices before damage is done.

If your IT security is basically "hope nobody clicks the wrong link," let's talk.

Source: The Hacker News —

Learn how AI-generated fake login pages steal passwords, MFA codes and session tokens, and how organizations can reduce the risk of account takeovers.

10/27/2026

We're aware of an issue where one of our Remote Management and Monitoring tools may be rebooting servers without notice. We are working with the vendor now and will be posting to the linked article beow.

Update: RMM Tool Issue — Investigating Unexpected Server Reboots Oct, Tue, 2026 nathan CTC NEWS , Mailing List We are currently working with the vendor for our Remote Monitoring and Management (RMM) tool to identify an issue causing some servers to reboot without notice. We are working closely wit...

10/27/2026

Windows Server 2016 will go End of Life in January 2027. Your 2019 firewall firmware isn't getting patches anymore. That SQL box you built in 2018 is one failed drive away from a very bad Monday.

"The most dangerous phrase in IT is 'if it ain't broke, don't fix it.'"

Here's the truth: in cybersecurity, "broke" doesn't always look like smoke and sparks. Sometimes it looks like a server that boots fine but hasn't received a security patch in 18 months. Sometimes it looks like a firewall that passes traffic perfectly but has a known vulnerability that attackers are already scanning for.

We've spent October helping clients replace end-of-life firewalls, migrate off unsupported servers, and close gaps before they become headlines. Proactive replacement beats emergency recovery every single time.

If your IT strategy is "wait until it breaks," you're already behind. MyIT exists to keep you ahead of the curve — scheduled refreshes, tested patches, and infrastructure that doesn't surprise you.

What's the oldest piece of critical infrastructure in your network? Yes, this includes the Windows Server 2003 box that maintains the database for the key system.

10/26/2026

Cybersecurity teams are calling it "Black October." Researchers using AI models discovered critical vulnerabilities in PHP — the programming language powering nearly 70% of all websites. Within hours of disclosure, Cloudflare and Amazon reported millions of exploit attempts globally. Former CISA Director Chris Krebs noted that 3% of all critical vulnerabilities ever discovered were found in just the last month.

For small and medium businesses, the message is clear: patch fast, scan constantly, or take legacy systems offline. But if you're managing IT internally, "patch fast" is easier said than done — someone has to know the vulnerability exists, test the fix, and deploy it without breaking something else.

That's the core of what MyIT does. We monitor, validate, and deploy patches so your team doesn't have to drop everything when the next Black October headline drops.

Sources:
https://www.cnbc.com/2026/10/23/php-vulnerabilities-ai-cybersecurity.html
https://www.reuters.com/world/asia-pacific/cloudflare-sees-millions-exploit-attempts-after-php-disclosure-2026-10-22/

Global firms and governments rushed ​to patch critical flaws in the PHP programming language that underpins much of the internet, as a cloud firm reported millions of hacking attempts after vulnerabilities were disclosed.

10/23/2026

Happy Friday. It's Cybersecurity Awareness Month, and this week's headlines made sure we're ALL aware — whether we wanted to be or not.

We had web servers getting new exploits named "[Thing]2Shell," because apparently that's just what we do now. We had AI agents quietly removing their own safety controls and then lying about it, which means we've officially reached the "teenager sneaking out at night" phase of artificial intelligence. And somewhere out there, a certificate authority discovered their private keys were described as "easily guessable" — a very professional way of saying someone used "password123" to protect the internet.

At some point every IT person asked: "Is it me, or is everything on fire this week?"

Spoiler: it's not you. Everything was genuinely on fire.

You patched. You rotated. You kept the lights on. You've earned your weekend.

Go touch grass. Monday will bring whatever Monday brings.

10/22/2026

October 2026 Patch Tuesday just shattered records: 1,411 vulnerabilities — nearly double September's already-record 974. For perspective, that's more than Microsoft patched in all of 2025 combined.

The standout this month isn't just volume. It's how easy the attack vectors are getting.

Five Outlook Preview Pane RCEs mean an attacker can own a workstation with zero user interaction — your employee just scrolls past a malicious email. That's it. No clicks, no attachments, no "Enable Macros." Just scrolling.

The perimeter is under equal pressure. SonicWALL SMA 1000 (CVSS 10.0), Fortinet FortiMail zero-day, Cisco SD-WAN Manager, F5 BIG-IP — all actively exploited or with confirmed attacks in the wild before patches shipped.

If you're still treating "check the firewall" as a quarterly afterthought, this is the month that changes. Your perimeter devices are getting hit first, and they're getting hit hard.

Full breakdown here: https://www.ctc.co/2026/10/22/october-2026-news-updates-new-record-again/