The candy's been raided and the decorations are coming down, but this one's a treat with no trick.
October's headliner is Custom Detections:
Every customer and partner on a paid license can now create custom detections
- Create and manage your own detections in Blumira.
- Clone any real-time Blumira detection and edit its logic, or build one from scratch on any log type you're ingesting, then tune thresholds and exclusions as your environment changes.
- Saved custom reports in Report Builder can also be converted straight into a detection.
- Detection Rules and MSP Bulk Actions now show a Custom badge, an "Authored custom detections" filter, and a Status of Enabled, Disabled, Pending Enable, or Pending Disable, so MSPs can see exactly what's deployed in each child account.
HaloPSA - Two-Way Sync Generally Available: Two-way sync between Blumira and HaloPSA is out of beta and available to all partners, so updates flow in both directions without manual reconciliation. You can also set an optional default Category for tickets Blumira creates in HaloPSA.
We also shipped five new global detections. Two cover PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the unauthenticated PHP remote code execution bugs disclosed this month, by catching the web worker running an attacker's commands on Linux and Windows. A new Windows rule catches PowerShell reading saved Chrome and Edge browser data, a common credential-harvesting step, and two new JumpCloud rules cover login brute force and security policy changes. Four existing rules got noise reduction, including Suspected RDP Over Reverse Tunnel firing on vulnerability scanners and SentinelOne flagging Windows Installer rollback files as ransomware.
Detection Updates
| Log Type |
Details |
Windows
|
NEW - Browser Data Collection via PowerShell
This new detection identifies PowerShell reading saved browser data from the default Chrome or Edge profile folders, such as history, saved passwords, cookies, or bookmarks. Attackers collect this data to harvest credentials and session cookies they can reuse elsewhere, usually right before they exfiltrate it. Legitimate tools rarely read these files through PowerShell, so this pattern tested with very little noise.
Default state: Enabled |
Windows
|
NEW - Windows: PHP Web Worker Spawned Suspicious Process
This new detection identifies a PHP web server worker on Windows (php-cgi.exe under IIS, or httpd.exe with mod_php) starting PowerShell, a living-off-the-land binary, or a command shell that runs one. After a PHP remote code execution bug like PHP2Shell, this is how the attacker's first commands show up, and several of those steps were not covered under PHP parents before. Some PHP applications legitimately call these tools, so this one ships disabled, and it is worth enabling if you run PHP on Windows.
Default state: Disabled |
Linux
|
NEW - Linux: PHP Web Worker Ran Remote Code Execution Command
This new detection identifies a PHP web worker on Linux (php-fpm, php-cgi, lsphp, FrankenPHP, or Apache with mod_php) running commands that look like post-exploitation, such as piping a download into a shell, opening a reverse shell, or writing a webshell into the web root. PHP2Shell is exploited from the request body and the worker keeps serving traffic afterwards, so these follow-on commands are the most reliable sign that a server was compromised. Catching them early in the attack chain gives you time to patch PHP and contain the host before the attacker settles in.
Default state: Enabled |
JumpCloud
|
NEW - JumpCloud: Multiple User Login Failures
This new detection identifies five or more failed JumpCloud logins for the same user within 15 minutes. Repeated failures in a short window are the classic sign of password guessing or credential stuffing against your identity provider. Because JumpCloud often fronts access to everything else, catching brute force here protects every app behind it.
Default state: Disabled |
JumpCloud
|
NEW - JumpCloud: Security Policy Modified
This new detection identifies when a security policy in your JumpCloud tenant is created, changed, or deleted, including MFA and WebAuthn settings and organization-wide security settings. Attackers who gain admin access often weaken these policies first so their access survives a password reset. Admins change policies for legitimate reasons too, so this one ships disabled for teams that want a record of every change.
Default state: Disabled |
Windows
|
UPDATE - Suspected RDP Over Reverse Tunnel
We refined this detection to stop firing on vulnerability scanners that probe the host's own RDP port during routine scans. Real RDP-over-tunnel activity, like an mstsc.exe connection looping back through a tunnel, still matches.
|
Windows
|
UPDATE - Windows Defender: Suspected Remediation Exploitation Attempt
We tightened how this detection links a Defender alert to a process, so it no longer blames an unrelated process that happened to be running at the same time.
|
Windows
|
UPDATE - New Remote Monitoring Tool
We updated this detection so a generic InstallShield helper used during routine software updates is no longer flagged as a remote monitoring tool.
|
SentinelOne
|
UPDATE - SentinelOne: Unresolved Malicious Threat
We refined this detection to ignore Windows Installer rollback files that SentinelOne flags as ransomware during normal software maintenance. The exclusion is tightly scoped, so a real ransomware event during an install still fires.
|
Bug Fixes and Improvements
Bug Fixes
- Findings - Workflow Error: We fixed a rare race condition where two findings using the same workflow at the same time could cause the finding workflow to show an error message instead of the next step.
- PSA Integrations - Ticket Reassignment: We fixed a bug where unassigning or reassigning a ticket in your PSA never removed the previous responder from the Blumira finding. Assignment changes in the PSA now sync to Blumira correctly.
Improvements
- PSA Integrations - Cases-Only Syncing: For partners in the Kindling Cases to PSA beta, a new "Enable syncing findings" toggle lets you send only Kindling cases to ConnectWise, Autotask, or HaloPSA, rather than one ticket per finding. HaloPSA now has the same Kindling Cases sync settings as ConnectWise and Autotask, and case tickets now carry the case analysis in the ticket body.
- Findings - Resolution Permissions: Resolving a finding that falls under Blumira Analyst jurisdiction, or editing its resolution note, now requires the Analyst role in that finding's organization, including for Administrators and Managers. Contact Blumira Support if you need one of these findings closed.
- Parsing - New HTTP Ingestion and Syslog Sources: Bitdefender webhook events and Cytracom ControlOne logs sent through HTTP Ingestion are now parsed into their existing log types, so existing detections and reports work no matter how the logs arrive. ConnectWise ScreenConnect (self-hosted) server logs are now parsed as well.
September 2026 Release Notes
In case you missed the September updates, you can find and review those notes here.
