On April 1, 2027, SharePoint Online and OneDrive will stop returning pre-authenticated URLs from Microsoft Graph, the REST API for Microsoft 365 data, for common file operations. Today those links carry a short-lived SharePoint credential in the tempauth query string, so a follow-up download or upload works without a token in an Authorization header. After the change, apps must send a Microsoft Entra ID access token in that header instead. Many flows then need two tokens: one for Graph and one for your SharePoint tenant host. A tenant setting can route some apps to Graph URLs so they stay on the Graph token only.

Source

Microsoft’s MAI-Image-2.7 Preview edits existing images from text prompts. It scored 1,193 on Artificial Analysis’s image-editing leaderboard, six points behind the top-ranked model, and placed third on Arena’s leaderboard. It’s available to try in MAI Playground, but text-to-image generation and Microsoft Foundry access have not yet been announced.

Source

Anthropic says an unreleased Claude-family model built proof-of-concept exploits across five platforms, including a Chrome attack that could escape the browser sandbox after a page loaded. The flaws have been patched, and the company reported no real-world attacks; how much human help the model needed remains unclear.

Source

CISA’s open-source ScubaGear and ScubaGoggles tools check Microsoft 365 and Google Workspace settings against security baselines. The latest releases move ScubaGear to direct REST API calls across supported Microsoft 365 services, which CISA says makes assessments faster and more accurate. They also add automated Power BI checks, application risk scoring, a Google Workspace baseline, and expanded Gemini controls.

Source

Microsoft’s SharePoint apps for iOS and Android will stop connecting to on-premises SharePoint Server on November 27, 2026. After that, the apps will support SharePoint Online only.

Source

Cloudflare has opened a limited-time PHP Capture the Flag challenge, inviting researchers to test protections it deployed against PHP2Shell vulnerabilities. The challenge builds on its two-sided WAF detection for PHP2Shell attacks with a deliberately vulnerable PHP sandbox and a flag to retrieve.

Source

Oracle AI Workspace will put ChatGPT in front of Oracle’s business applications and data, letting employees request information and approved actions in one place. The integrations cover Fusion Applications, NetSuite, Oracle AI Database, and Oracle Cloud Infrastructure (OCI), while retaining organizational permissions and approvals. The announcement expands Oracle and OpenAI’s partnership from cloud infrastructure into enterprise software.

Source

Excel’s October update makes table naming available to all Excel for Windows users, beyond its Insider preview. It also rolls out five Copilot capabilities for cleaning and importing data, creating reusable workflows, and building workbook-linked reports—features covered in 4sysops’ report on Excel’s five new Copilot features.

Source

Copilot, Microsoft’s AI assistant built into the Edge Sidebar, is temporarily unavailable to some users while Microsoft migrates them to a new experience. Edge says the process may take several days and require a browser restart; meanwhile, users must open Copilot on the web or use its app.

Source

PowerToys, Microsoft’s collection of utilities for Windows, has a hotfix for crashes in File Locksmith and Quick Accent. Version 0.102.3001.0 follows 0.102, which added features including Mouse Button Lock; the new release adds no features.

Source

Dell commercial PCs launched in 2026 add post-quantum cryptography (PQC)—algorithms designed to resist future quantum-computer attacks—to firmware signing and BIOS checks. The changes target the boot chain, helping verify that low-level code is genuine before the operating system starts.

Source

Red Hat is focusing its Nvidia OpenShell integration on securing OpenClaw deployments, building on the companies’ OpenShell security partnership. The runtime isolates AI agents in sandboxes; Red Hat says Kubernetes-native APIs can help organizations deploy them without learning new deployment APIs.

Source

NIST’s post-quantum cryptography roadmap sets a timetable for phasing out public-key algorithms vulnerable to future quantum computers: deprecation after 2030 and disallowance under NIST standards after 2035. NIST is the National Institute of Standards and Technology, a U.S. government agency that develops standards and guidance for areas such as cybersecurity, technology, and measurement.Federal high-value systems face earlier deadlines, while private organizations should use the roadmap to plan upgrades, especially where sensitive data must stay confidential for years.

Source

AbuseBox is a self-hosted, open-source tool for monitoring IP and domain reputation, DNS, SSL certificates, and email security. Deployed with Docker Compose, it brings these checks into one dashboard and can alert teams when findings change.

Source

Microsoft’s out-of-band Windows updates remove trust in seven certificates tied to compromised eMudhra certificate authorities, extending the offline-PC certificate update rollout to Windows 10. KB5134133 covers Windows 11 versions 24H2, 25H2, and 26H2; KB5134125 covers Windows 10 versions 21H2 and 22H2. Both were released October 26 for devices that cannot receive automatic certificate trust updates.

Source

Microsoft’s new Teams federation controls can help organizations restrict unwanted external chats, but they’re off by default. That matters as a threat report found IT-support impersonation attempts in about 30% of the organizations it monitored—a figure that does not show how common the attacks are across all Teams tenants.

Source

CISA has added Adobe Commerce’s PolyShell flaw and Google’s Brotli decoder vulnerability to its Known Exploited Vulnerabilities catalog. The Brotli issue, which affects software such as Node.js and Python packages, had already been traced across runtimes in prior vulnerability coverage; new telemetry now reports exploit attempts in the wild. Meanwhile, PolyShell attacks have compromised hundreds of online stores.

Source

Researchers have disclosed that the Oracle PeopleSoft zero-day exploited by ShinyHunters was a chain of three vulnerabilities, not a single flaw. Oracle patched the chain as CVE-2026-35273 on June 10, but the attack had already enabled unauthenticated remote code execution. The findings show how a request from outside the network could reach PeopleSoft’s internal management interface and lead to server takeover.

Source

Tailscale creates a secure private network connecting devices, and Tailscale SSH lets approved devices connect across it without passwords or keys. A researcher’s Tailworm report described how a foothold on an approved device could lead to root access on reachable servers; Tailscale has now released version 1.104.4 to fix flaws that could let a permitted session reach root-only services. The Tailscale SSH server runs on Linux and the open-source macOS build.

Source