IT Daily Roundup: October 20, 2026
1. October Windows Server patch broke Exchange
Microsoft confirmed that this month's Windows Server security updates, for Server 2019 and later, cause problems on servers running Exchange. Users cannot sign in to Outlook on the Web (OWA), or the login page hangs, and sent messages sit in the Outbox instead of being delivered. The cause is a default memory cap on the Endpoint Mapper that the update set to 512 concurrent calls. Under heavier load, Exchange may not get enough.
Do not uninstall the updates. Microsoft published a workaround: on the Exchange server, run reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f from an elevated Command Prompt, then reboot. If the problem returns, raise the limit further. A permanent fix is in progress with no release date given.
Why this matters: If your Exchange runs on Windows Server and users started reporting mail or OWA problems after Patch Tuesday, this is where to look. The registry change is a two-minute fix that takes effect after a reboot.
2. Broadcom Wi-Fi chips in millions of routers: attack without a password from radio range
Security researcher Quentin Kaiser published a flaw on October 19 in Broadcom's Wi-Fi Protected Setup (WPS) implementation. An attacker within Wi-Fi range can send crafted setup messages that corrupt router memory and run code as root on the device. No network password or pairing is needed. Kaiser demonstrated password extraction and opening a remote shell using only Wi-Fi frames.
Affected chips include BCM3380, BCM3383, and BCM33834 (older eCos platforms, no fix will come for these) and BCM3390, BCM65xx, and BCM68xx (a fix is technically possible here, depending on device manufacturers acting). Broadcom reportedly knew about the bug since 2018 and shipped an incomplete fix. No CVE has been assigned and no patch exists. In Belgium, gateways from Proximus, Orange Belgium, and VOO were confirmed vulnerable.
Why this matters: ISP-supplied gateways tend to sit in offices for years without a firmware update. No real-world attacks have been reported yet, but the flaw is confirmed and demonstrated. Ask your ISP whether your gateway uses Broadcom WPS chips and when a firmware update is planned. For older eCos-platform devices, no patch is coming: replacement is the practical option.
3. Rank Math PRO 3.0.123 contained a backdoor rated 9.8
The Rank Math PRO WordPress plugin, one of the most widely used SEO tools, was compromised for 11 hours. Copies of version 3.0.123 downloaded or updated between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware. Backdoor CVE-2026-111862 reinstates itself on every site visit, so deleting files alone does not clean the infection. An affected server may also carry additional PHP backdoors, rogue admin accounts, altered .htaccess rules, scheduled tasks, or unauthorized SSH keys. Wordfence rated the vulnerability 9.8 out of 10.
Version 3.0.124 is the clean release. Installing it replaces the plugin but does not find or remove malicious files the malware may have written elsewhere on the server. Rank Math has not said how many customers received the tainted package.
← All postsWhy this matters: Check when you last updated Rank Math PRO. If it was between October 15 at 20:02 UTC and October 16 at 07:12 UTC, installing 3.0.124 is not enough: review WordPress admin accounts, .htaccess, and scheduled tasks, then run a security scan. If we manage your site, we will check this for you.