Monday's M365 briefing leads with the Citrix NetScaler SAML zero-day.
- Citrix CVE-2026-88779 has a CISA KEV deadline of 7 Oct.
- Warlock/ToolShell SharePoint ransomware.
- Identity threats: TA419 AiTM cookie theft and the DTU Denmark breach.
- Purview/Copilot retention and AU-scoped Copilot DLP changes.
- Defender App Governance role shifts and near-term deadlines for Nordic consultants.
This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.