Action bulletin · October 22, 2026 · Open access
What your IT team should check this week
A practical action bulletin for Utah government, education and business. Match these checks to your environment and assign an owner for each applicable item. These are separate disclosures and update needs; this bulletin does not link them to one campaign.
Last reviewed: . This is a dated snapshot. Recheck the linked advisories before acting; vendors may revise scope and instructions.
Patch
PHP: check web runtimes and apply the emergency updates
- Affected scope
- PHP installations serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Include hosted applications and products with embedded PHP.
- Exploitation / incident status
- PHP reports a demonstrated unauthenticated exploit for mod_php. The reviewed PHP and ENISA notices do not confirm exploitation in the wild. Treat this as urgent without equating a demonstration with observed attacks.
- Immediate check / action
- Inventory the running web runtime with your application or hosting owner. Apply PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-confirmed backported fix for CVE-2026-109618 and CVE-2026-109619. For older branches, confirm vendor support or upgrade. Prioritize internet-facing systems; consider isolating exposed applications if patching must wait. Configuration workarounds are incomplete.
- October 23 follow-up
- Also review PHP’s session upload-progress notice. For the unusual serializer-switching configuration it describes, set
session.upload_progress.enabled=0until the next regular bugfix release. Keep that setting if already applied. - Verify completion
- Confirm patched runtimes and required configuration changes in the serving workers after restart. Check application health and record package/build evidence.
Last reviewed:
Rotate credentials + review activity
Railway: rotate stored secrets and review their use
- Affected scope
- Organizations using Railway to store environment variables, API keys, database credentials or private registry credentials. Railway recommends precautionary action for all users while its scope review continues.
- Exploitation / incident status
- Railway reports unauthorized access may have exposed encrypted environment variables and some decrypted contents. This is a credential-exposure response; installing software updates alone does not address it.
- Immediate check / action
- Inventory stored secrets and their dependent services. Rotate them at the issuing service, revoke or disable the old credentials, and update Railway and other consumers using each provider’s procedure. Review service, cloud audit and billing logs for unusual activity; preserve suspicious evidence and involve your incident-response owner.
- Verify completion
- Confirm applications use the replacement credentials and old credentials no longer work. Follow Railway’s current recovery instructions before redeploying; availability is changing. Check its live status page rather than assuming builds are paused for every workspace.
- Railway security disclosure
- Railway live status
- Railway AWS activity-review guidance
- Railway Google Cloud activity-review guidance
Last reviewed:
Patch + assess exposure
BeyondTrust: verify the BT26-05 patch on remote-access appliances
- Affected scope
- Remote Support versions through 26.2.3 are listed as affected by CVE-2026-102764. BeyondTrust also recommends the precautionary patch for self-hosted Privileged Remote Access because it shares the code; its testing had not identified an exploit path in PRA.
- Exploitation / incident status
- BeyondTrust confirms exploitation against two customers in August. Its October 16 update reported no evidence of adversary activity since August. Those limited historical cases do not establish widespread current attacks.
- Immediate check / action
- For self-hosted Remote Support, verify BT26-05-RS installation, including where automatic updates are enabled. Versions older than 24.3.1 need an upgrade before that patch can be applied. Follow the vendor’s separate PRA instructions if applicable. BeyondTrust says Remote Support SaaS instances were patched by October 9; confirm service notices with your owner.
- Verify completion
- Record patch evidence and review vendor investigation guidance and available external logs. Patching closes the vulnerability; suspected prior compromise also needs incident response and assessment of exposed credentials.
Last reviewed:
Deploy + verify updates
Microsoft: verify October updates reached the affected products
- Affected scope
- Check the October release against your installed Microsoft products, including Windows, Office, server products and developer tools; applicability varies by product and version.
- Exploitation / incident status
- The Canadian Centre for Cyber Security reports that Microsoft identified exploitation of CVE-2026-96951. This does not mean every vulnerability in the October release has been exploited.
- Immediate check / action
- Use Microsoft’s Security Update Guide to match inventory to applicable fixes, mitigations and known issues. Prioritize applicable exploited vulnerabilities and exposed systems. Schedule required restarts and follow product-specific deployment guidance.
- Verify completion
- Check deployment results and installed versions after restart; investigate failed or pending updates. Use vendor guidance to resolve exceptions rather than assuming a successful deployment job means every system is remediated.
Last reviewed:
Stay informed
Assign someone to review vendor security advisories and service-status notices for the products you actually use. Pair that with these durable official resources:
- CISA Known Exploited Vulnerabilities Catalog — Check whether vulnerabilities affecting your inventory have evidence of exploitation.
- CISA cybersecurity advisories — Review official technical guidance and mitigations.
- Utah Cyber Center — Use the state’s official channel for statewide coordination and incident-response resources.
- Microsoft Security Update Guide — Review product-specific updates and revisions.
Close the loop this week
- Identify an owner. Assign an accountable IT, application or service-provider owner and a due date for every applicable item.
- Verify exposure. Confirm affected products, versions, hosting arrangements and stored credentials. Record why an item is applicable or not applicable.
- Remediate using vendor guidance. Apply the relevant patches or rotate and revoke credentials as directed. Track blocked work with an owner and next review time.
- Verify completion. Record the installed build or patch, credential revocation, required restarts, health checks and log-review outcome. Escalate suspicious activity through your incident-response process.
For each item, keep a short record: owner · affected assets · action taken · evidence · completion date or next review.