Automox

The secret to a productive IT team: automated endpoints and a very motivated golden retriever.

Coffee in hand ✅
87 tabs open ✅
Do not disturb ✅

Extra credit: How many Otto action figures can you spot?

(01) Lego set
- probably unfinished, if we're honest

(02) Mechanical keyboard
- with the perfect clack

(03) Water bottle
- with all the conference stickers

(04) Sticky notes
- To-dos, don't forgets, and all the small things

(05) YubiKey
- or some MFA device

(06) Noise-cancelling headphones
- to block out the haters

(07) Rubber ducky
- iykyk

What did we miss?

this is who makes your life soooo much easier

⚠️ The big one this month: CVE-2026-21265 Microsoft's 2011 Secure Boot certificates expire in June and October 2026.

If you have hardware from 2012-2025, you need both OS patches and BIOS updates. Miss either one, and you're still vulnerable to boot-level attacks. Start auditing your BIOS versions now. You’ve got 6 months.

Also on the radar:

⚠️ CVE-2026-20816 (CVSS 7.8) - Windows Installer elevation of privilege. TOCTOU race condition that can take a local user to SYSTEM. Not exploited yet, but a likely candidate.

⚠️ CVE-2026-20805 (CVSS 5.5) - Desktop Window Manager info disclosure. Already exploited in the wild. No admin rights needed. Can break sandbox isolation in virtualized environments. Patch this one first.

Full breakdown on our podcast: https://okt.to/PiHJt5 Happy patching!

Wishing you a joyful and secure holiday season ❄️

Our team will be on a company-wide holiday shutdown next week, taking time to rest, recharge, and celebrate together!

Holiday wish lists look a little different in IT. What's on your list this year?

🎄 These vulnerabilities are ready to crash your holiday party! Pay special attention to them this ⬇️

- React2Shell (CVE-2025-55182)

This unauthenticated RCE in React Server Components may impact you through upstream libraries, even if you don’t use React on the frontend. Check your versions now as holiday coverage thins.

- CVE-2025-62550 (Azure Monitor Agent RCE)

This vulnerability lets an attacker operate as the syslog user, enabling quiet movement with built-in utilities. It raises real risks of log tampering and low-noise enumeration.

- CVE-2025-62565 (Windows File Explorer EoP)

This Windows Shell use-after-free bug can escalate privileges with minimal interaction, sometimes from a single file click. Automatic previews and metadata lookups make it easy to miss.

Dive into our analysis for more: https://okt.to/CbFh67