EpiFive
Daily IT & AI brief

IT & AI brief, 25 October 2026: PHP php2shell fixes and two new KEV entries

PHP fixes two critical php2shell remote code execution flaws, CISA adds Collabora Online and Arista VeloCloud bugs to KEV, and GitHub enforces a Copilot default policy.

By EpiFive Editorial TeamHow the brief is made

The most urgent job this weekend is patching PHP: two critical remote code execution flaws affect almost every PHP setup that serves web traffic, and a follow-up advisory on 23 October added one more setting to check. This first brief covers Friday 23 to Sunday 25 October.

PHP php2shell: patch and restart every worker

What changed: On 21 October the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 (memory corruption when PHP runs out of memory mid-request) and CVE-2026-109619 (state left over from a freed request reused by the next one). Both are rated CVSS 9.2 and allow unauthenticated code execution. A 23 October follow-up flagged a related issue, CVE-2026-115560, and CISA revised its alert the same day with a SIGMA detection rule.

Who is affected: Any PHP that answers web requests, including PHP-FPM, php-cgi, FrankenPHP, LiteSpeed and especially Apache mod_php. PHP 8.1 and older get no official release.

What to do: Inventory PHP (it hides inside appliances and bundled apps), install the fixed build or your distribution's package, then restart all workers. Until then, keep session.upload_progress.enabled = 0 set in php.ini or the pool config. Details: PHP security advisory, PHP follow-up, CISA alert.

CISA KEV adds Collabora Online and Arista VeloCloud

What changed: On 23 October CISA added two actively exploited bugs to its Known Exploited Vulnerabilities catalog: CVE-2026-110447, an OS command injection in the built-in CODE server of Collabora Online, and CVE-2026-114625, a SQL injection in on-premises Arista VeloCloud Orchestrator.

Who is affected: Teams running Nextcloud with the built-in Collabora CODE server, and organisations that host their own VeloCloud SD-WAN orchestrator.

What to do: Apply the vendor fixes now and, for anything internet-facing, check logs for signs of compromise from before the patch. Sources: CISA alert for CVE-2026-110447, CISA alert for CVE-2026-114625.

GitHub Copilot global default policy is being enforced

What changed: GitHub began enforcing the Copilot global default policy on 22 October, rolling out until 26 October. Any generally available Copilot feature or MCP setting still marked Unconfigured is set once to the chosen default: Enabled, Disabled or Let organizations decide.

Who is affected: Copilot Business and Copilot Enterprise customers. Settings an admin already set explicitly are kept, and preview features stay opt-in.

What to do: Before the rollout reaches your enterprise, open AI Controls, then Copilot, and confirm the default for new features matches your policy. Set sensitive features such as MCP servers explicitly. Source: GitHub changelog.

OpenAI API: older models shut down on 23 October

What changed: OpenAI retired a batch of API models announced for deprecation in April, including gpt-3.5-turbo, gpt-4, gpt-4-turbo, gpt-4o-2024-05-13, gpt-4.1-nano, o1, o1-pro, o3-mini, o4-mini, gpt-image-1 and fine-tunes built on several of them. These model names are no longer served.

Who is affected: Scripts, integrations and fine-tuned models that call the OpenAI API directly. Azure OpenAI deployments follow their own retirement schedule.

What to do: Search code and config for the retired names and move to the replacements on the OpenAI deprecations page, such as the gpt-5.6 family. Test output quality before switching production traffic. The same habits apply on Azure; see /blog/azure-openai-model-retirement-upgrade-runbook.

Defender for Office 365 gets a Move to quarantine action

What changed: MC1523084 (23 October) adds an admin remediation that pulls delivered email from Inbox, Junk, Deleted Items or recoverable folders into Defender quarantine. It shows in Threat Explorer, Advanced Hunting, custom detections and the Action Center, and items are labelled Admin triggered. Rollout runs early November to mid-December 2026.

Who is affected: Tenants with Defender for Office 365 Plan 2. Approving the action needs the Search and Purge role.

What to do: Check which quarantine policy you will pick for these actions and who holds Search and Purge, then add the option to incident playbooks. See /blog/quarantine-policies-defender-office-365.

Viva Insights will show GitHub Copilot metrics by default

What changed: MC1523085 (23 October) removes the preview opt-in toggle for GitHub Copilot data in Viva Insights. From mid-November to mid-December 2026, those metrics appear in the Consumption dashboard for eligible tenants automatically, with no opt-out described.

Who is affected: Tenants that never opted in. Anyone who can already see consumption insights, including managers with that access, may start to see GitHub Copilot usage.

What to do: Review who can open consumption insights before mid-November, tell managers and HR what the new numbers mean, and update internal privacy notes if needed.

Outlook Copilot Prioritize is being retired

What changed: MC1519861, updated on 22 October, confirms Copilot Prioritize is being removed from every Outlook client. The removal starts on 26 October 2026 and should finish by the end of March 2027.

Who is affected: Microsoft 365 Copilot users who have Prioritize in Outlook.

What to do: No admin action is needed. Warn the help desk and remove Prioritize from training material and user guides.

Google Vault can export Gemini conversations

What changed: Since 22 October, Vault can export Gemini in Workspace conversations from Gmail, Drive, Docs, Sheets, Slides and Meet as JSON, filtered by user or OU (up to 5,000 users) and date range. Retention rules and holds are not supported yet, and API support is due within 14 days.

Who is affected: Business Plus, Enterprise Essentials Plus, Enterprise Standard and Plus, Frontline Standard and Plus, and Education editions, plus the Vault add-on. Only conversations saved while history was on are captured.

What to do: Add Gemini to eDiscovery runbooks and review conversation history settings per OU. Source: Workspace Updates.

Also worth knowing

  • Microsoft Graph beta now has APIs for Copilot credit balances and spending policies: MC1521616.
  • Anthropic handed the Agent Skills standard to the Linux Foundation's Agentic AI Foundation: Anthropic.
  • Azure Backup can now restore single files from VMs on Premium SSD v2 and Ultra disks: Azure update.
  • CISA and Canada's Cyber Centre published guidance on budgeting and monitoring AI token use: CISA.