M365 Cyber Governance Daily

Two KEV deadlines land today while AI agents move from helpers to intruders.

• CISA KEV deadline today for Collabora Online in Nextcloud (CVE-2026-110447) and Arista VeloCloud Orchestrator (CVE-2026-114625).
• ConnectWise Cloud Backup restores expected early this week.
• ScubaGear v2.0 blocks high-risk Entra AI agents; Zero Trust Assessment 3.1 adds an AI-agent owner/sponsor view and DLP; Maester 3.0 release candidates.
• AI agents run intrusions: the Phantom ransomware kill chain and Unit 42's partly retracted PHP2Shell agentic attacker.
• k0t edge-device broker exposes 70,000 credentials; LiteLLM root cause is an unrevoked leaked master key.
• MC1523084, MC1456780, MC1454973 (review by 30 Oct), MC1523076 and MC1523085.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.