MSP Weekly

This week's news, matched to the services you sell. Select your offerings below to see where you sell the fix.

Issue: Week of 12 October 2026 · Last updated: 16 October 2026 10:19 UTC · Subscribe (RSS)

This week's standard client maintenance window

The KEV / critical set every client should patch on their normal cadence — package it as one scheduled window across the portfolio. This week's must-patch list → · why this sells →

My service offerings

Check the services you provide. We'll flag and float this week's items your services fix. Saved on this device only; no account needed.

Identity End-user elevation Help Desk validation MFA SSO

Applications AI/ML system security Vulnerability Management WAF

Email Email archiving Gateway IEP (M365 email protection) Phishing simulation Training

Data Backup & recovery DLP Entra ID backup Google Backup M365 backup Shadow AI discovery and control

Network AI-enabled attack detection Firewall SASE/SSE

Managed XDR Managed XDR Cloud Detection & Response Endpoint Detection & Response Identity Threat Detection & Response Network Detection & Response

GRC Compliance Risk Management Third-party

Show only items my offerings cover

Where your offerings are the answer this week

VulnerabilityKEV: CVE-2026-104935 — Ivanti Connect Secure (Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability)
CVE-2026-104935 is confirmed exploited in Ivanti Connect Secure (versions 25.1.1.1 and prior, 25.2.2 and prior, 22.8R2.4 and prior). Review all client instances and apply Ivanti's patch or mitigations now.
CVE-2026-104935 · CVE-2026-109412 · CVE-2026-76460 · CVE-2026-96951NIST 800-53 · AC-3 · AC-6 · CM-7NIST 800-53 · AC-3 · AC-6 · CM-7Best fit: Prevent: SSO · MFA Detect: Identity Threat DR Respond: Identity Threat DR
Also applies (8)
End-user elevation · Network DR · SASE/SSE · Cloud DR · Firewall · Managed XDR · Vulnerability Management · Endpoint DR
VulnerabilityNew critical CVE: CVE-2026-76519 — A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated…
Cisco added CVE-2026-76519 to the CISA KEV catalog. Check every client running on-prem Secure Email Gateway or Secure Email and Web Manager and update to the fixed AsyncOS releases immediately.
CVE-2026-0322 · CVE-2026-105133 · CVE-2026-105134 · CVE-2026-76519NIST 800-53 · AC-3 · AC-6 · IA-2NIST 800-53 · AC-3 · AC-6 · IA-2Best fit: Prevent: End-user elevation · WAF · Vulnerability Management
Also applies (6)
Network DR · Firewall · SASE/SSE · Cloud DR · Managed XDR · Endpoint DR
VulnerabilityMonths-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Confirm every client PAN-OS firewall is on 11.2.4-h1, 11.1.6-h1, 10.2.9-h1 or later; Qilin and Setra ransomware are actively exploiting the unpatched management-interface vulnerability.
CVE-2026-0322CSF 2.0 · DE.CM-09 · ID.RA-01 · PR.IR-01ISO 27001 · A.8.16 · A.8.20 · A.8.21Best fit: Prevent: End-user elevation · WAF · Vulnerability Management
Also applies (6)
Network DR · Firewall · SASE/SSE · Cloud DR · Managed XDR · Endpoint DR
VulnerabilityCSA Singapore alert: 16 October 2026 16 October 2026 Active Exploitation of Vulnerability in Palo Alto Networks Products Attackers are exploiting a high-severity vulnerability in Palo Alto Networks PAN-OS to execute arbitrary code with root privileges. Patch immediately.
CSA Singapore confirms in-the-wild exploitation of a root-privilege vulnerability in PAN-OS. Audit every client running Palo Alto firewalls, PAN-OS, Prisma Access, or Cloud NGFW and deploy the patch immediately.
CVE-2026-0322 · CVE-2026-76268 · CVE-2026-76281 · CVE-2026-76284CSF 2.0 · DE.CM-09 · ID.RA-01 · PR.IR-01ISO 27001 · A.8.16 · A.8.20 · A.8.21Best fit: Prevent: MFA · End-user elevation Detect: Identity Threat DR Respond: Identity Threat DR
Also applies (8)
WAF · SASE/SSE · Firewall · Vulnerability Management · Network DR · Cloud DR · Managed XDR · Endpoint DR
VulnerabilityKEV: CVE-2026-7273 — Zyxel GS1900 Series Switches (Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability)
Scan client environments for Zyxel GS1900 series switches. CVE-2026-7273 is confirmed exploited in the wild by a Chinese actor; push the Zyxel firmware update or mitigations across all affected devices now.
CVE-2026-102255 · CVE-2026-65660 · CVE-2026-67279 · CVE-2026-7273NIST 800-53 · AC-3 · AC-4 · AC-6NIST 800-53 · AC-3 · AC-4 · AC-6Best fit: Prevent: End-user elevation · Vulnerability Management Detect: Identity Threat DR Respond: Identity Threat DR
Also applies (7)
SASE/SSE · WAF · Network DR · Firewall · Cloud DR · Managed XDR · Endpoint DR
VulnerabilityAL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Confirm which clients run on-premises SharePoint Server and schedule the CVE-2026-65660 patch urgently; hosted M365 tenants are unaffected.
CVE-2026-65660NIST 800-53 · AC-6 · SA-11 · SA-15NIST 800-53 · AC-6 · SA-11 · SA-15Best fit: Prevent: End-user elevation · WAF · Vulnerability Management
Also applies (6)
Network DR · Firewall · SASE/SSE · Cloud DR · Managed XDR · Endpoint DR
VulnerabilityJ4Care dcm4che
Check every healthcare or imaging client running J4Care dcm4che / dcm4chee-arc-light; push the update past 5.35.1 immediately. CISA lists active exploitation that can delete images, leak PHI or inject forged studies.
CVE-2026-101021 · CVE-2026-105273 · CVE-2026-105279 · CVE-2026-105667CSF 2.0 · ID.RA-01 · PR.PS-02ISO 27001 · A.8.29 · A.8.8Your offering: Vulnerability Management
VulnerabilityCISA Malcolm
Check every client running self-hosted Malcolm: versions ≤26.07.1 and ≤26.08.0 are affected by multiple confirmed-exploited CVEs (CVSS 8.1). Patch to 26.07.2+ or migrate to the hosted service where possible.
CVE-2026-107333 · CVE-2026-107334 · CVE-2026-107335 · CVE-2026-107336CSF 2.0 · ID.RA-01 · PR.PS-02ISO 27001 · A.8.29 · A.8.8Best fit: Prevent: SSO · MFA Detect: Identity Threat DR Respond: Identity Threat DR
Also applies (7)
SASE/SSE · Network DR · Cloud DR · Firewall · Vulnerability Management · Managed XDR · Endpoint DR
VulnerabilityThermo Fisher Torrent Suite Software
Check client environments for Thermo Fisher Torrent Suite <=5.18 and apply the vendor update. CISA states this is under active exploitation allowing arbitrary file reads.
CVE-2026-107777CSF 2.0 · ID.RA-01 · PR.PS-02ISO 27001 · A.8.29 · A.8.8Your offering: Vulnerability Management
ClassRansomware / extortion claim — 120 items in the last 90 days
Prevent: Managed XDRDetect: Managed XDRRespond: Managed XDRRecover: Backup & recovery
A leak-site listing evidences an intrusion somewhere, and this class is evidenced to encrypt data and inhibit recovery. It does not name the platform that was hit, so the recovery play is named at the category level and no specific backup product is claimed.
ClassBreach disclosure filing — 4 items in the last 90 days
Prevent: Managed XDR · ComplianceDetect: Managed XDRRespond: Managed XDR
A filing evidences that an incident was material enough to disclose, not how it happened.
ClassExploit campaign — 1 item in the last 90 days
Prevent: Vulnerability Management · WAFDetect: Managed XDRRecover: Backup & recovery
Counted from stories carrying no CVE of their own; the CVE-bearing exploit stories are the per-story items above.
ClassInsider misuse — 1 item in the last 90 days
Prevent: DLPDetect: Managed XDR

Nothing this week names the services you selected. That is the week, not a gap in what you sell — the Coverage Demonstrator shows the worked cases and the 90-day record for every service.

For your client sectors

This week’s stories across all client sectors — pick your sectors in the header above to focus on the industries you serve.

UK Legal Aid Agency: Hackers stole records dating back to 1978
Leak-site claim: THE SEVEN DEADLY SINS lists Hospital Sírio-LibanêsHospital Sírio-Libanês
Leak-site claim: thegentlemen lists Martin LLPMartin LLP
Leak-site claim: thegentlemen lists Suhai Segurana PessoalSuhai Segurana Pessoal
Leak-site claim: thegentlemen lists SBI Audiovisual MedinboxSBI Audiovisual Medinbox
Leak-site claim: thegentlemen lists Saga UniversitySaga University
Leak-site claim: thegentlemen lists Netcore UnbxdNetcore Unbxd
Leak-site claim: thegentlemen lists Museum SiamMuseum Siam
Leak-site claim: thegentlemen lists Skin CenterSkin Center
Leak-site claim: thegentlemen lists Thai Ha PCL KASETThai Ha PCL KASET
Leak-site claim: thegentlemen lists Inovar Packaging GroupInovar Packaging Group
Leak-site claim: thegentlemen lists Engineers IrelandEngineers Ireland

More for MSPs: Coverage demonstrator Weekly client KEV Advisory Portfolio exposure Your toolchain The playbook

How we write these. Every item names the control that fixes it and the service you offer to deliver it. We never flag a threat without its fix; revenue is a bonus, not the pitch.