Governed Today

An Ivanti VPN chain is being used to hunt admin passwords and BitLocker recovery keys, and one KEV deadline is today.

• Ivanti Connect Secure: CVE-2026-111357 due in KEV today, CVE-2026-118527 on 13 Nov
• Conditional Access for individual Teams meetings (MC1532256) and MemberOf retiring 3 Nov
• Teams Copilot meeting policy splits in two (MC1532253); Copilot Studio warns on unevaluated agents
• New CallActivityEvents table in Defender XDR; Purview DLP for non-Microsoft apps slips to late December
• AI-run attacks, the Binance TraderTraitor attribution, Polymarket, TeamViewer and NIST IR 8547

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Week in review, 26–30 October: the five biggest M365 governance and security stories, ranked.

• PHP2Shell on CISA KEV, chained with Fragnesia (CVE-2026-46300) to root 25 firewall servers and attack Active Directory; Palo Alto confirms attacks.
• Edge devices: Cisco ASA/FTD and GitLab KEV due 1 Nov; Fortinet fixes ahead of 10 Nov; FortiBleed 2.0 exposes LDAP bind records.
• Brotli HTTP2Shell (CVE-2026-111497): out-of-band .NET, Visual Studio and PowerShell fixes; KEV due 10 Nov.
• Identity attacks: token replay at 79 organisations, fake Teams IT support, SkyW4lker device code phishing, Authenticator for Android flaw.
• MemberOf retires 3 Nov (MC1529463); SMS first-factor sign-in winding down ahead of 1 Feb 2027.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Firewalls are the front door this week, with two new KEV deadlines on Sunday.

• Cisco ASA/FTD CVE-2026-76418 exploited; CISA KEV due 1 Nov.
• Palo Alto confirms PHP2Shell attacks on internet-exposed management interfaces.
• GitLab CVE-2026-97229 (CVSS 10) in KEV, due 1 Nov; self-built installs also need a Ruby update.
• Fortinet critical fixes ahead of 10 Nov disclosure; FortiBleed 2.0 exposes AD LDAP bind records.
• MC1530948: Purview auto-labels legacy Office files; MC1530959 and MC1530368 for Copilot memory and cost controls.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

PHP2Shell and a Linux kernel flaw took attackers from 25 firewalls into Active Directory.

• PHP2Shell plus Fragnesia (CVE-2026-46300) rooted 25 firewall servers, then hit Active Directory; PHP2Shell KEV due today, Fragnesia due 31 Oct.
• MC1465763: SMS first-factor sign-in disabled in low-use tenants; MC1529463: MemberOf retires 3 Nov.
• Entra Agent ID inactivity policy disables idle agents at 90 days.
• MC1529472: Frontier previews expand to Teams, new Outlook, OneDrive and SharePoint.
• Orange Tsai's Edge logic-bug chain, Skyw4lker device code phishing and Volt Typhoon's Silent Train.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

A fake Teams app could take work tokens from Microsoft Authenticator for Android.

• Microsoft Authenticator for Android (CVE-2026-80097): a fake Teams app could get work-account Graph tokens; fixed in 6.2606.4246.
• MC1450134: Windows Hello for Business and macOS Platform SSO count as standalone MFA from early November; MC1528000 SMS/voice MFA retires 1 Feb 2027.
• CISA KEV: Brotli CVE-2026-111497 and Adobe Commerce/Magento due 10 Nov; PHP2Shell due 29 Oct.
• MC1481315: Purview DSPM classic and DSPM for AI classic retire late January 2027.
• Warp breach exposes AI agent logs; CyberStrikeAI runs attacks with 44 AI agents.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

PHP2Shell moves from scanning to confirmed exploitation, with a CISA KEV deadline on Thursday.

• PHP2Shell (CVE-2026-109618/109619) confirmed exploited and added to CISA KEV, due 29 Oct; Windows PHP needs the rebuilt -1 packages.
• Brotli HTTP2Shell (CVE-2026-111497): out-of-band fixes for .NET, Visual Studio and PowerShell; re-download the Scan Cab (MC1525374).
• Huntress: M365 token-replay campaign hits 97 accounts at 79 organisations.
• Poisoned AGENTS.md files hijack AI coding agents.
• Teams fake 'IT Support' scams lead from mail bombing to Quick Assist and ransomware.
• MC1450133 passkey-first MFA in Entra; MC1220762 Defender Advanced Hunting API retires 1 Feb 2027.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Two KEV deadlines land today while AI agents move from helpers to intruders.

• CISA KEV deadline today for Collabora Online in Nextcloud (CVE-2026-110447) and Arista VeloCloud Orchestrator (CVE-2026-114625).
• ConnectWise Cloud Backup restores expected early this week.
• ScubaGear v2.0 blocks high-risk Entra AI agents; Zero Trust Assessment 3.1 adds an AI-agent owner/sponsor view and DLP; Maester 3.0 release candidates.
• AI agents run intrusions: the Phantom ransomware kill chain and Unit 42's partly retracted PHP2Shell agentic attacker.
• k0t edge-device broker exposes 70,000 credentials; LiteLLM root cause is an unrevoked leaked master key.
• MC1523084, MC1456780, MC1454973 (review by 30 Oct), MC1523076 and MC1523085.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Week in review, 19–23 October: the five biggest M365 governance and security stories, ranked.

• Microsoft attributes the ConnectWise Cloud Backup attack to China state-aligned Storm-0940, which used the ARTEX agentic AI framework against more than 2,250 tenants.
• PHP2Shell: two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) patched Wednesday and already exploited.
• Agent sprawl gets new doors: MC1519871 and MC1521616, with Entra agent blueprint and CreateAsManager defaults enforced on 4 November.
• Microsoft-provided SMS and voice MFA retires on 1 February 2027 (MC1519855).
• October Windows Server updates knocked over on-premises Exchange; Microsoft's workaround is the EpmapSavedContextCap registry value.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

ConnectWise sets a restore timeline while APT41's BlackX bootkit bypasses fully patched Windows.

• ConnectWise targets restored Cloud Backup access early next week.
• Microsoft publishes a guide to troubleshooting revoked Entra application credentials.
• Kaspersky links APT41 to BlackX; fully patched Windows remains vulnerable unless the KB5025885 Secure Boot revocation is applied.
• The exploited Arista VeloCloud Orchestrator zero-day CVE-2026-114625.
• PHP2Shell probing began before disclosure.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Microsoft names China state-aligned Storm-0940 behind the ConnectWise Cloud Backup attack.

• The ARTEX agentic AI framework ran the attack at machine speed against 2,250+ tenants.
• PHP2Shell patches as exploit attempts begin.
• The LiteLLM 1.107.0 credential-stealer release.
• GitLab's CVSS 10 unauthenticated RCE.
• Microsoft-provided SMS and voice MFA retire on 1 Feb 2027.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.