Governed Today

Ted Johansson

A daily briefing on Microsoft 365 security, compliance and cyber governance. AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  1. 16h ago

    Agents Can Read Your Copilot Memory by Default

    The memory path is read-only, but the policy that opens it is on by default. MC1539004: Work IQ MCP /memory/me/coreMemories lets agents read a user's Copilot memory profile from December, policy on by defaultAPT29 'Poisoned Source' mobile watering-hole campaign stealing cookies and device dataPrompt adware in a Codex jailbreak bundle (haiou-codex) rewriting agent instructionsSonicWall won't patch EOL GMS 9.5.2 and earlier while a related flaw is actively exploitedAlso: Copilot connectors for Work IQ APIs, Copilot Studio agent metrics GA, Android and APT package flawsThis episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  2. 1d ago

    Defender RBAC Turns Itself On, and Someone Set the Fridges to 50°C

    An automatic import copies your old over-broad grants along with everything else. Unified Defender RBAC auto-enables from early December, with about 30 days between import and go-live (MC1537494)Refrigeration controllers attacked at supermarkets in eight countries, including ICA and Coop stores in SwedenLLMjacking: stolen cloud and GitHub tokens used to run up AI bills of over $100,000 a dayARTEX AI-agent intrusions at Chainstack, WorkOS and ChainalysisPurview retention for Copilot Memory is GA, and the Teams MeetingAI policies slip to DecemberThis episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  3. 2d ago

    Fake IT Support on Teams, Then a Certificate for the Domain Controller

    A password reset doesn't end access when the attacker holds a certificate. Teams fake IT support led to ESC1 and ESC8 abuse of AD CS, and one account excluded from automatic attack disruptionSMS and voice stop counting for self-service password reset (MC1536049), and passkeys don't fill the gapTeams Facilitator gets a Protection skill that warns about social engineering in external meetings (MC1536056)Power Platform prompts move off Anthropic and Grok models on 2 Dec (MC1536101)MadApe device code phishing, critical Langflow flaws, the VOLTA infostealer and CERT-SE's freezer attacksThis episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  4. 3d ago

    Ivanti's Key Hunt: BitLocker, MemberOf and AI-Run Attacks

    An Ivanti VPN chain is being used to hunt admin passwords and BitLocker recovery keys, and one KEV deadline is today. Ivanti Connect Secure: CVE-2026-111357 due in KEV today, CVE-2026-118527 on 13 NovConditional Access for individual Teams meetings (MC1532256) and MemberOf retiring 3 NovTeams Copilot meeting policy splits in two (MC1532253); Copilot Studio warns on unevaluated agentsNew CallActivityEvents table in Defender XDR; Purview DLP for non-Microsoft apps slips to late DecemberAI-run attacks, the Binance TraderTraitor attribution, Polymarket, TeamViewer and NIST IR 8547This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  5. 6d ago

    Week in review: PHP2Shell, Firewalls and the MemberOf Deadline

    Week in review, 26–30 October: the five biggest M365 governance and security stories, ranked. PHP2Shell on CISA KEV, chained with Fragnesia (CVE-2026-46300) to root 25 firewall servers and attack Active Directory; Palo Alto confirms attacks.Edge devices: Cisco ASA/FTD and GitLab KEV due 1 Nov; Fortinet fixes ahead of 10 Nov; FortiBleed 2.0 exposes LDAP bind records.Brotli HTTP2Shell (CVE-2026-111497): out-of-band .NET, Visual Studio and PowerShell fixes; KEV due 10 Nov.Identity attacks: token replay at 79 organisations, fake Teams IT support, SkyW4lker device code phishing, Authenticator for Android flaw.MemberOf retires 3 Nov (MC1529463); SMS first-factor sign-in winding down ahead of 1 Feb 2027.This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  6. 6d ago

    Firewalls Under Fire: Cisco, Palo Alto and GitLab

    Firewalls are the front door this week, with two new KEV deadlines on Sunday. Cisco ASA/FTD CVE-2026-76418 exploited; CISA KEV due 1 Nov.Palo Alto confirms PHP2Shell attacks on internet-exposed management interfaces.GitLab CVE-2026-97229 (CVSS 10) in KEV, due 1 Nov; self-built installs also need a Ruby update.Fortinet critical fixes ahead of 10 Nov disclosure; FortiBleed 2.0 exposes AD LDAP bind records.MC1530948: Purview auto-labels legacy Office files; MC1530959 and MC1530368 for Copilot memory and cost controls.This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  7. Oct 29

    PHP2Shell Plus Fragnesia: Firewalls to AD

    PHP2Shell and a Linux kernel flaw took attackers from 25 firewalls into Active Directory. PHP2Shell plus Fragnesia (CVE-2026-46300) rooted 25 firewall servers, then hit Active Directory; PHP2Shell KEV due today, Fragnesia due 31 Oct.MC1465763: SMS first-factor sign-in disabled in low-use tenants; MC1529463: MemberOf retires 3 Nov.Entra Agent ID inactivity policy disables idle agents at 90 days.MC1529472: Frontier previews expand to Teams, new Outlook, OneDrive and SharePoint.Orange Tsai's Edge logic-bug chain, Skyw4lker device code phishing and Volt Typhoon's Silent Train.This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

  8. Oct 28

    Authenticator Token Theft and AI Agent Swarms

    A fake Teams app could take work tokens from Microsoft Authenticator for Android. Microsoft Authenticator for Android (CVE-2026-80097): a fake Teams app could get work-account Graph tokens; fixed in 6.2606.4246.MC1450134: Windows Hello for Business and macOS Platform SSO count as standalone MFA from early November; MC1528000 SMS/voice MFA retires 1 Feb 2027.CISA KEV: Brotli CVE-2026-111497 and Adobe Commerce/Magento due 10 Nov; PHP2Shell due 29 Oct.MC1481315: Purview DSPM classic and DSPM for AI classic retire late January 2027.Warp breach exposes AI agent logs; CyberStrikeAI runs attacks with 44 AI agents.This episode is AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

See All (24)

About

A daily briefing on Microsoft 365 security, compliance and cyber governance. AI-voiced (NotebookLM) from Ted Johansson's curated daily M365 and cyber governance digest.

Information

  • Creator
    Ted Johansson
  • Years Active
    2026
  • Episodes
    24
  • Rating
    Clean
  • Show Website
    Governed Today