M365 Cyber Governance Daily

PHP2Shell moves from scanning to confirmed exploitation, with a CISA KEV deadline on Thursday.

• PHP2Shell (CVE-2026-109618/109619) confirmed exploited and added to CISA KEV, due 29 Oct; Windows PHP needs the rebuilt -1 packages.
• Brotli HTTP2Shell (CVE-2026-111497): out-of-band fixes for .NET, Visual Studio and PowerShell; re-download the Scan Cab (MC1525374).
• Huntress: M365 token-replay campaign hits 97 accounts at 79 organisations.
• Poisoned AGENTS.md files hijack AI coding agents.
• Teams fake 'IT Support' scams lead from mail bombing to Quick Assist and ransomware.
• MC1450133 passkey-first MFA in Entra; MC1220762 Defender Advanced Hunting API retires 1 Feb 2027.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.