Governed Today

PHP ships an emergency release today for two critical RCE flaws.

• Emergency fixes for CVE-2026-109618 and CVE-2026-109619.
• Browsers block all eight eMudhra intermediate CAs after their private keys proved trivially recoverable.
• ConnectWise Cloud Backup's slow phased restore.
• App Governance permissions move to Defender XDR Unified RBAC from mid-Nov.
• NIST, NSA and CISA incident-response practices for AI agents acting beyond their authority.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

October Windows Server cumulative updates are knocking over busy on-prem Exchange servers.

• Microsoft's workaround: raise the EpmapSavedContextCap registry value rather than uninstall the update.
• ConnectWise Cloud Backup is still down.
• Entra agent identity defaults take effect on 4 Nov.
• Purview DLP is coming to Microsoft Cowork.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

The ConnectWise Cloud Backup app-identity attack hit 173+ M365 tenants.

• ConnectWise Cloud Backup (ex-SkyKick): one case escalated to Global Administrator.
• BeyondTrust Remote Support CVE-2026-102764 is now in CISA KEV.
• MC1511052 moves SharePoint agents to Copilot Agent Builder.
• The Copilot Studio Teams app retirement.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

This week's CISA KEV deadlines meet AI agent ownership and governance.

• Ivanti is due today; PAN-OS and Ahsay on 17 Oct; Atlassian CVE-2026-21589 on 18 Oct.
• The second exploited Cisco Secure Email Gateway zero-day, CVE-2026-76461.
• The AgentIdentity CreateAsManager change.
• AI agent ownership and governance: who owns each agent?
• Copilot Pages content sits in SharePoint Embedded.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Patching alone can erase evidence of a compromise.

• The exploited Cisco Secure Email Gateway zero-day CVE-2026-76519.
• PAN-OS CVE-2026-0322 has a CISA deadline of 17 Oct.
• The Ivanti Connect Secure 25.1 exposure.
• Microsoft-managed Conditional Access for high-risk users turns on the week of 28 Oct.
• Copilot Studio agent governance.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

October Patch Tuesday brought about 1,411 CVEs, including an exploited Windows Shell MotW zero-day.

• Windows Shell MotW zero-day CVE-2026-96951 and critical Exchange, SharePoint and AD FS fixes.
• Entra agent blueprint and permission changes on 4 Nov.
• Copilot Studio model retirements.
• SAP Cloud SDK CVE-2026-89111.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

The EY breach happened through a third-party IT support platform.

• Helpdesk and ticketing tools need DLP, retention and access reviews.
• Copilot changes: work-data memory by default, Pages and Notebooks moving to OneDrive, Work IQ on by default, and agents getting directory identities.
• The early-November move to copilot.cloud.microsoft can break proxies and allow-lists.
• Wider passkey options in Entra and Teams protection against deepfakes and impersonation.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Conditional Access "All users" policies don't cover AI agents in Microsoft 365.

• The new Microsoft Execution Containers sandbox and Copilot's "Hybrid Intelligence" features.
• Extortion through stolen tokens and cookie theft; new MFA registrations are a key signal to watch.
• EWS allow-lists are due 10 Oct; DLP behavior changes on 12 Oct; Publisher 2021 support ends 13 Oct.
• Calendar Sharing on 15 Oct and Targeted Release on 31 Oct.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Wednesday's briefing opens with today's Citrix KEV deadline and EWS allow-lists due 10 Oct.

• ClickFix hides VBScript in the browser cache; how to hunt for it in Defender.
• AI-agent security: Defender agent runtime protection, Agent 365 observability, Artex and OpenAI agent incidents, and the MCP SDK token flaw.
• Purview label and DLP changes; Entra SMS/voice retirement and passkeys.
• The Intune Windows 11 26H2 baseline.
• Breaches including the Denmark CPR follow-up.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Tuesday's M365 and cyber governance briefing starts with patch deadlines.

• The out-of-band Exchange CVE-2026-96940 fix, tomorrow's Citrix NetScaler KEV deadline and the Dell System Update flaw.
• Antino hides command traffic in Microsoft Graph, Outlook and OneDrive; tips for hunting it in Defender.
• Entra MemberOf retirement on 3 Nov and the Denmark CPR breach.
• Exchange and Outlook changes, Purview updates and Copilot spending-policy settings.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.