Friday note · Oct 30, 2026
PHP is being exploited. Patch the kernel too.
1. PHP: the flaws are now being exploited, and a Linux kernel bug makes it worse.
On Oct 26 CISA added PHP CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. CISA's Oct 21 PHP alert was updated Oct 26 to note both CVEs were added to KEV. On Oct 28 CISA added Linux kernel CVE-2026-46300 and says it can be chained with the PHP flaws to implant PHP webshells and run commands as root. If you self-host anything that runs PHP, patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 today, then patch the kernel on the same servers. Our estimate: half a day for a small shop with a few servers.
Source: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching · https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)
2. C2: during the admin window, you can ask EPC to recalculate your budget.
On Oct 22, 2026 USAC updated EPC so school and library applicants can request a Category Two budget recalculation during the FY2027 EPC Administrative Window if student counts or library square footage has changed. USAC calls this a "replacement C2 budget" request, and it is optional. EPC will also remind you with a popup when you update that profile data. To file one, USAC points to Module 6, "How to File a C2 Budget Replacement Request," in the EPC Administrative Window learning module. Our advice: if your counts or square footage moved, do this before the window closes, not the week the 471 opens.
Source: https://www.usac.org/e-rate/resources/announcements/#epc-category-two-c2-updates
3. FCC E-Rate and CIPA review: reply comments due Nov 12.
The FCC's review of E-Rate (FCC 26-41) covers protecting children on E-Rate-funded networks, broadband access, and whether its current reading of CIPA is the best one. Initial comments closed Oct 13. Reply comments are due on or before Nov 12, 2026. Our advice: if your state association or consortium is filing, read their reply rather than writing your own.
4. CISA's free Microsoft 365 and Google Workspace config checkers got easier.
On Oct 27 CISA announced ScubaGear v2.0 (Microsoft 365) and ScubaGoggles v1.1.0 (Google Workspace). ScubaGoggles now has a graphical interface instead of hand-edited YAML files; ScubaGear's configuration interface was upgraded. ScubaGoggles also adds an "assured controls" baseline CISA says is aimed at resource-strapped teams. Our inference: that's now practical for a two-person shop. Run it once against your tenant and fix the top findings. Our estimate: two hours.
Source: https://www.cisa.gov/news-events/news/cisa-publishes-significant-updates-scubagear-and-scubagoggles
5. FCC suspends an E-Rate consultant and proposes a three-year debarment.
In an Oct 20, 2026 letter (DA 26-1123), the FCC's Enforcement Bureau suspended Richard Bernstein from E-Rate and all universal service programs and proposed debarring him for three years. He pleaded guilty to conspiracy to violate the Travel Act, a kickback scheme involving E-Rate and the COVID-era Emergency Connectivity Fund (ECF), the FCC says. If you have a contract with him, opposition requests are due within 30 days of receiving the suspension letter or by Nov 27, 2026, whichever comes first. Our advice: if a consultant files for you, confirm it isn't him or one of his companies.
Source: https://docs.fcc.gov/public/attachments/DA-26-1123A1.pdf · 91 FR 67572 (Oct 27, 2026) https://www.federalregister.gov/documents/2026/10/27/2026-21850/notice-of-suspension-and-commencement-of-proposed-debarment-proceedings
Ignore this
SchoolSafety.gov re-featuring CISA's existing K-12 cybersecurity tabletop exercise as "New." It isn't new. Run it when you have a quiet afternoon, not because of the label.
Source: https://www.schoolsafety.gov/cybersecurity
Forward this to the other person on the team. The Friday note is free. No vendor pitches.
The Maddux Report is not legal, procurement, or E-Rate filing advice.