M365 Cyber Governance Daily

Emergency PHP Patches and Rogue AI

PHP ships an emergency release today for two critical RCE flaws (CVE-2026-109618 and CVE-2026-109619), and browsers now block all eight eMudhra intermediate CAs after their private keys proved trivially recoverable. The briefing also covers ConnectWise Cloud Backup's slow phased restore, App Governance permissions moving to Defender XDR Unified RBAC from mid-Nov, and the NIST, NSA and CISA incident-response practices for AI agents that act beyond their authority.