🔐 Password reset ≠ threat contained. On Oct. 27, see a live OAuth attack simulation and learn how attackers retain Microsoft 365 access, plus how CompassOne detects and contains the threat. 🕐 1 PM ET | 45 min Register: blackpointcyber.com/webinar/… #MSP #ITDR

UPDATE 2: PHP patches are out. Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now. PHP confirms unauthenticated RCE for CVE-2026-109618 and CVE-2026-109619 and says there are no complete mitigations. 8.1 and older get no official packages. Exploit code is public, early attacks reported. Live SitRep, updated in place: blackpointcyber.com/blog/php… #PHP #CVE2026109618 #php2shell

PHP Critical Security Update - Two (RCE) vulnerabilities 🚨 Security Advisory: Critical PHP Remote Code Execution Vulnerabilities 🚨 The PHP development team has announced emergency security updates addressing two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The updates are scheduled for release tomorrow, October 21, 2026, at 14:00 UTC (10:00 AM ET), following reports that information about the vulnerabilities was leaked ahead of their planned disclosure. While full technical details and affected versions have not yet been officially disclosed, organizations operating PHP based applications and services are strongly encouraged to prepare for these updates and prioritize patching as soon as fixes become available. The Blackpoint Adversary Pursuit Group (APG) is actively monitoring developments and conducting further research into these vulnerabilities. We will share additional findings and guidance as more information becomes available. Recommended actions Identify PHP installations: Review your infrastructure and customer environments for PHP-based applications, including WordPress, Magento, and custom web applications. Prioritize internet-facing systems: Identify publicly accessible PHP applications and prepare them for emergency updates. Coordinate with hosting providers: Confirm who is responsible for deploying PHP security patches and establish an update plan. Prepare to patch immediately: Apply the appropriate vendor security updates once available, and validate application functionality afterward. Review exposure: Consider restricting unnecessary external access to vulnerable systems where immediate patching may not be possible. Important: Updating application plugins or themes alone does not replace the need to patch the underlying PHP runtime. How Blackpoint is Protecting Partners Our Adversary Pursuit Group (APG) has proactively reviewed available security telemetry for suspicious activity potentially associated with these vulnerabilities. We are continuing to evaluate emerging intelligence and opportunities to strengthen coverage for our Partners as technical details become available. Our Blackpoint Response Operations Center (BROC) continues to monitor supported environments around the clock, investigating suspicious activity and responding to identified threats. Existing Blackpoint detections are designed to identify suspicious activity associated with exploitation and post-exploitation. These detections provide an additional layer of visibility into malicious behavior across supported and monitored environments. For the latest official information, visit the PHP Security Announcement. php.net/archive/2026.php#202… Blackpoint Cyber Adversary Pursuit Group (APG)

Some threats don’t stay dead. Others just come back wearing a different costume. This October, Inside the SOC Episode 8 is getting a Cybersecurity Awareness Month takeover with Spooky Stories from the SOC. Join Blackpoint’s SOC and threat research teams as we open the case files on: ChainScript: A Node.js RAT using a Polygon smart contract based C2 resolver to keep its infrastructure flexible. RemotePanel + BoundSiphon: A combination of persistent remote access and rapid credential, browser data, and cryptocurrency theft. Cybersecurity Awareness Month: Practical lessons MSPs can use to strengthen their own defenses and help protect their customers. Same threats. Different costumes. New ways to get caught. Tuesday, October 6 | 10:00 AM MT Register here: blackpointcyber.com/webinar/… No demo. No sales pitch. Just real threat research and practical insights from the SOC. #Cybersecurity #ThreatIntelligence #MSP #CybersecurityAwarenessMonth #ThreatResearch See less

For the #msp and #cybersecurity communities. Sharing a critical threat notice. ⚠️ CRITICAL Threat Notice: Citrix NetScaler ADC and NetScaler Gateway ⚠️ support.citrix.com/support-h…

Kimsuky, the North Korean threat group, is stealing credentials via QR codes in its latest round of attacks, @SCMagazine reports. 🔎 hubs.ly/Q03__ryT0 | #Cybersecurity #Quishing

MSPs, are you still paying the SIEM tax? 💰 The truth: Compliance doesn't need to be complex... or expensive. Get the full breakdown: hubs.ly/Q03_WQZf0 | #Cybersecurity #MSP

ClickFix. Rogue RMM. VPN siege. 🔍 The threats of 2025 were defined by deception. The defense of 2026 needs to be defined by verification. hubs.ly/Q03_JMRg0 | #Cybersecurity #MSP #ThreatIntel

APT28 is targeting NATO-aligned energy and defense groups, @SCMagazine reports. 👇 hubs.ly/Q03_ttH90 | #ThreatIntel #MSP

We're proud to see @BlackpointUS CEO Gagan Singh recognized by @CRN as one of the 10 Biggest IT CEO Moves of 2025. 🗞️ hubs.ly/Q03_7fYc0 | #Cybersecurity #MSP

What a week at #CES2026! 🙌 'Good enough' won't stop the next global outage, as @BlackpointUS' Manoj Srivastava explained during his @CES panel. hubs.ly/Q03-YFwq0 | #Cybersecurity #MSP

Juggling siloed tools and drowning in alerts? Trust us — you need to watch this. 👀 hubs.ly/Q03-Bck30 | #Cybersecurity @CIOonline

How do you get the majority of your clients to adopt MDR in just 60 days? 👇 hubs.ly/Q03-n2080 | #Cybersecurity #MSP

Over 5,000 vulnerabilities were disclosed last month — with more than 2,300 rated high or critical. 🚨 hubs.ly/Q03-gLm_0 | #Cybersecurity #ThreatIntel

Cyber insurance carriers have raised the bar — and alerts alone won't cut it anymore. 👇 hubs.ly/Q03ZMhNs0 | #Cybersecurity #MSP

Start your engines, MSPs! 🏁 We'll see you in a few weeks at #RightOfBoom2026 in Las Vegas, and @BlackpointUS is bringing the ultimate giveaway for anyone who loves speed. We're giving away a VIP weekend to the 2026 #Indy500! hubs.ly/Q03ZKSyl0 | #Cybersecurity #MSP

The spreadsheet says building a SOC is feasible. The reality says otherwise. 😬 To run a true 24/7 operation, the math changes drastically. In 2026, your clients don't care if you own the SOC. They care that they're secure. hubs.ly/Q03Zwxq90 | #MSP

Happy New Year, from everyone at @BlackpointUS! 🥂 We wish our partners and their clients a secure, successful 2026. And as always, we're on the watch year-round for everyone. #Cybersecurity #MSP #MSSP #MDR

Threat actors are hijacking @WhatsApp Web sessions to deliver Astaroth — a stealthy banking malware. 👀 hubs.ly/Q03ZcKx00 | #ThreatIntel