M365 Cyber Governance Daily

ConnectWise sets a restore timeline while APT41's BlackX bootkit bypasses fully patched Windows.

• ConnectWise targets restored Cloud Backup access early next week.
• Microsoft publishes a guide to troubleshooting revoked Entra application credentials.
• Kaspersky links APT41 to BlackX; fully patched Windows remains vulnerable unless the KB5025885 Secure Boot revocation is applied.
• The exploited Arista VeloCloud Orchestrator zero-day CVE-2026-114625.
• PHP2Shell probing began before disclosure.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Microsoft names China state-aligned Storm-0940 behind the ConnectWise Cloud Backup attack.

• The ARTEX agentic AI framework ran the attack at machine speed against 2,250+ tenants.
• PHP2Shell patches as exploit attempts begin.
• The LiteLLM 1.107.0 credential-stealer release.
• GitLab's CVSS 10 unauthenticated RCE.
• Microsoft-provided SMS and voice MFA retire on 1 Feb 2027.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

PHP ships an emergency release today for two critical RCE flaws.

• Emergency fixes for CVE-2026-109618 and CVE-2026-109619.
• Browsers block all eight eMudhra intermediate CAs after their private keys proved trivially recoverable.
• ConnectWise Cloud Backup's slow phased restore.
• App Governance permissions move to Defender XDR Unified RBAC from mid-Nov.
• NIST, NSA and CISA incident-response practices for AI agents acting beyond their authority.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

October Windows Server cumulative updates are knocking over busy on-prem Exchange servers.

• Microsoft's workaround: raise the EpmapSavedContextCap registry value rather than uninstall the update.
• ConnectWise Cloud Backup is still down.
• Entra agent identity defaults take effect on 4 Nov.
• Purview DLP is coming to Microsoft Cowork.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

The ConnectWise Cloud Backup app-identity attack hit 173+ M365 tenants.

• ConnectWise Cloud Backup (ex-SkyKick): one case escalated to Global Administrator.
• BeyondTrust Remote Support CVE-2026-102764 is now in CISA KEV.
• MC1511052 moves SharePoint agents to Copilot Agent Builder.
• The Copilot Studio Teams app retirement.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

This week's CISA KEV deadlines meet AI agent ownership and governance.

• Ivanti is due today; PAN-OS and Ahsay on 17 Oct; Atlassian CVE-2026-21589 on 18 Oct.
• The second exploited Cisco Secure Email Gateway zero-day, CVE-2026-76461.
• The AgentIdentity CreateAsManager change.
• AI agent ownership and governance: who owns each agent?
• Copilot Pages content sits in SharePoint Embedded.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Patching alone can erase evidence of a compromise.

• The exploited Cisco Secure Email Gateway zero-day CVE-2026-76519.
• PAN-OS CVE-2026-0322 has a CISA deadline of 17 Oct.
• The Ivanti Connect Secure 25.1 exposure.
• Microsoft-managed Conditional Access for high-risk users turns on the week of 28 Oct.
• Copilot Studio agent governance.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

October Patch Tuesday brought about 1,411 CVEs, including an exploited Windows Shell MotW zero-day.

• Windows Shell MotW zero-day CVE-2026-96951 and critical Exchange, SharePoint and AD FS fixes.
• Entra agent blueprint and permission changes on 4 Nov.
• Copilot Studio model retirements.
• SAP Cloud SDK CVE-2026-89111.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

The EY breach happened through a third-party IT support platform.

• Helpdesk and ticketing tools need DLP, retention and access reviews.
• Copilot changes: work-data memory by default, Pages and Notebooks moving to OneDrive, Work IQ on by default, and agents getting directory identities.
• The early-November move to copilot.cloud.microsoft can break proxies and allow-lists.
• Wider passkey options in Entra and Teams protection against deepfakes and impersonation.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Conditional Access "All users" policies don't cover AI agents in Microsoft 365.

• The new Microsoft Execution Containers sandbox and Copilot's "Hybrid Intelligence" features.
• Extortion through stolen tokens and cookie theft; new MFA registrations are a key signal to watch.
• EWS allow-lists are due 10 Oct; DLP behavior changes on 12 Oct; Publisher 2021 support ends 13 Oct.
• Calendar Sharing on 15 Oct and Targeted Release on 31 Oct.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Wednesday's briefing opens with today's Citrix KEV deadline and EWS allow-lists due 10 Oct.

• ClickFix hides VBScript in the browser cache; how to hunt for it in Defender.
• AI-agent security: Defender agent runtime protection, Agent 365 observability, Artex and OpenAI agent incidents, and the MCP SDK token flaw.
• Purview label and DLP changes; Entra SMS/voice retirement and passkeys.
• The Intune Windows 11 26H2 baseline.
• Breaches including the Denmark CPR follow-up.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Tuesday's M365 and cyber governance briefing starts with patch deadlines.

• The out-of-band Exchange CVE-2026-96940 fix, tomorrow's Citrix NetScaler KEV deadline and the Dell System Update flaw.
• Antino hides command traffic in Microsoft Graph, Outlook and OneDrive; tips for hunting it in Defender.
• Entra MemberOf retirement on 3 Nov and the Denmark CPR breach.
• Exchange and Outlook changes, Purview updates and Copilot spending-policy settings.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Monday's M365 briefing leads with the Citrix NetScaler SAML zero-day.

• Citrix CVE-2026-88779 has a CISA KEV deadline of 7 Oct.
• Warlock/ToolShell SharePoint ransomware.
• Identity threats: TA419 AiTM cookie theft and the DTU Denmark breach.
• Purview/Copilot retention and AU-scoped Copilot DLP changes.
• Defender App Governance role shifts and near-term deadlines for Nordic consultants.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.