Microsoft Entra ID will let organizations choose a third-party provider for SMS and voice authentication starting October 30, ahead of Microsoft’s February 1, 2027 retirement of its own telephony service. Users who rely only on SMS or voice will otherwise face a blocking prompt to register a passkey. Global Administrators and external users have until July 1, 2027.

Source

Microsoft Edge Canary is testing an “On-device AI” toggle that lets users control whether the browser can use AI models running locally. The setting is under Settings > Copilot and AI, or at edge://settings/ai. Microsoft hasn’t specified which features depend on it.

Source

A scheduled Azure Automation runbook can preserve mail flow rule report data beyond Exchange Online’s 10-day limit, building a weekly history of suppressed messages by spam domain. It stores the accumulated counts in a CSV file in SharePoint Online, where admins can analyze them with Power BI or other tools. The approach uses managed identities and Microsoft Graph API requests to work around Graph SDK file cmdlets that fail in Azure Automation.

Source

OpenAI expects AI-found vulnerabilities to rise sharply and has proposed a five-stage response for critical flaws in widely used software. The plan follows a two-month effort to address PHP vulnerabilities, including flaws found with AI assistance. OpenAI’s proposal coordinates patch development, early warning for affected organizations, and public guidance after fixes ship.

Source

Cloudflare’s web application firewall (WAF) filters traffic to websites before it reaches their servers. It began blocking php2shell exploits for WAF customers on October 21, using a new detection method that checks both incoming requests and server responses. Cloudflare says attackers were already changing their payloads to evade protections.

Source

The guests are Arvind Krishna, chairman, president and CEO of IBM, and Nikesh Arora, chairman and CEO of cybersecurity company Palo Alto Networks. On the All-In Podcast, they discuss the approaching quantum threat to encryption, the trade-offs between frontier and open-weight AI models, and AI’s impact on cybersecurity. Krishna urges organizations to begin moving toward post-quantum cryptography before quantum computers can break widely used encryption. Arora and Krishna also consider how AI could reshape software businesses, security practices, and competition.

Source

Claude Security, Anthropic’s repository vulnerability scanner, now rescans connected code as it changes, tracks fixes, and reopens findings if a vulnerability returns. The public beta is available to Claude Enterprise customers, with team knowledge and editable threat models helping prioritize risks. Anthropic is also offering $25,000 in monthly usage credits for two months, for usage through December 31, 2026.

Source

Cloudflare’s early-access Vulnerability Discovery and Remediation service uses OpenAI models through Daybreak to examine customer-authorized code for potential flaws. By adding live traffic and security signals, it can prioritize findings and prepare proposed patches and web application firewall (WAF) rules for customers to review.

Source

OpenAI’s updated Usage Policies will require model routers and AI gateways to get company approval before offering direct access to its models, starting November 20, 2026. An AI gateway is an intermediary service that routes requests from apps to AI models. Partners and resellers must maintain safeguards aligned with OpenAI’s own and coordinate on enforcement. OpenAI is also developing SafetyIDs to help investigate misuse without learning individual users’ identities.

Source

Self-managed GitLab servers face a critical unauthenticated code-execution flaw, CVE-2026-110264, affecting releases dating back to version 7.0. Administrators who installed GitLab’s October 12 update still need to upgrade: it did not fix this newly disclosed vulnerability. GitLab reports no known exploitation, but has not disclosed the conditions required to trigger the flaw.

Source

AWS found an attempt to exploit the critical PHP2Shell vulnerabilities on October 17—four days before public disclosure and the release of fixes. The request hit an AWS honeypot from an IP address tied to an anonymization network, but researchers do not know how the actor obtained exploit details or whether the attempt would have worked on a real system. Cloudflare also reported early attacks as vulnerability reports surfaced before patches were available.

Source

Matthew Berman interviews OpenAI CEO Sam Altman about AI’s growing role in scientific discovery, work, and daily life. They discuss personal AI assistants, compute demand, new hardware, model consciousness, and recursive self-improvement (RSI). Altman argues that AI should expand people’s choices and capabilities rather than displace human agency.

Source

Peter Steinberger, OpenClaw’s creator and an OpenAI member of technical staff, estimated he spent about $10 million on AI tokens in September—and said investors are covering the bill. He made the estimate at Cloudflare Connect 2026 in San Francisco, where he also discussed agent costs, permissions, and trust.

Source

Despite Microsoft’s push toward the Microsoft Customer Agreement (MCA), Enterprise Agreement (EA) renewals remain a major sales focus. Customers may face less experienced account teams incentivized to sell Microsoft 365 E5, E7, and Copilot, making renewals harder to negotiate. Starting early, documenting past concessions, and escalating beyond the account team can help protect your organization’s position.

Source

Microsoft’s usage-based Copilot billing may apply at two stages: when developers build AI apps and agents, and when those apps are hosted and run by users. That could add development and operating costs on top of per-user subscriptions.

Source

Chrome now prompts users to approve an insecure HTTP connection before it begins, and the protection is enabled by default for everyone. The change aims to stop exposure that “Not Secure” labels can only flag after a connection is made. Google says most users will rarely see the new prompt.

Source

Chainguard’s early release of PHP2Shell fixes has sparked a dispute over whether it exposed users or helped head off attacks. Chainguard is a software supply-chain security company that hardens open-source software. The two flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution; PHP had released emergency patches for the critical flaws. Chainguard says it acted after reports of exploitation, but the scale of attacks remains unknown.

Source

IBM CEO Arvind Krishna says open-weight models can deliver about 90% of frontier AI performance for 10% to 25% of the token cost, making on-premises AI a more practical option for enterprises. He estimates a large company could start with two or three hardware racks. Running models on private infrastructure also gives companies more control over their data and logs.

Source

Microsoft says China-aligned Storm-0940 used the ARTEX AI penetration-testing framework in the ConnectWise Cloud Backup supply-chain compromise. ARTEX, a Go-based framework for automating penetration-testing tasks, helped the group scan targets, gather information, spray passwords, and abuse OAuth applications. Microsoft observed ARTEX-driven sign-in attempts against more than 2,250 tenants, using stolen application credentials to access customer environments. In several attacks, the group gained privileged cloud access in under three hours.

Source