M365 Cyber Governance Daily

Week in review, 19–23 October: the five biggest M365 governance and security stories, ranked.

• Microsoft attributes the ConnectWise Cloud Backup attack to China state-aligned Storm-0940, which used the ARTEX agentic AI framework against more than 2,250 tenants.
• PHP2Shell: two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) patched Wednesday and already exploited.
• Agent sprawl gets new doors: MC1519871 and MC1521616, with Entra agent blueprint and CreateAsManager defaults enforced on 4 November.
• Microsoft-provided SMS and voice MFA retires on 1 February 2027 (MC1519855).
• October Windows Server updates knocked over on-premises Exchange; Microsoft's workaround is the EpmapSavedContextCap registry value.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.