Week in review: PHP2Shell, Firewalls and the MemberOf Deadline

Fri, 30 Oct 2026 · 5:30

TRANS_ID: weekly-2026-10-30

Week in review, 26–30 October: the five biggest M365 governance and security stories, ranked.

PHP2Shell on CISA KEV, chained with Fragnesia (CVE-2026-46300) to root 25 firewall servers and attack Active Directory; Palo Alto confirms attacks.
Edge devices: Cisco ASA/FTD and GitLab KEV due 1 Nov; Fortinet fixes ahead of 10 Nov; FortiBleed 2.0 exposes LDAP bind records.
Brotli HTTP2Shell (CVE-2026-111497): out-of-band .NET, Visual Studio and PowerShell fixes; KEV due 10 Nov.
Identity attacks: token replay at 79 organisations, fake Teams IT support, SkyW4lker device code phishing, Authenticator for Android flaw.
MemberOf retires 3 Nov (MC1529463); SMS first-factor sign-in winding down ahead of 1 Feb 2027.

This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

SPECTRUM ANALYSISBITRATE: 320KBPS

0:00—

STANDBY

SEC_LVL_3