IT & AI brief, 1 November 2026: KEV deadlines hit, Power Apps Copilot retirements, AWS TLS updates

Federal deadlines for the exploited Cisco ASA and GitLab flaws arrive today, 1 November, and the first Ivanti Connect Secure deadline is tomorrow. Microsoft also announced two Power Apps Copilot retirements, and AWS shipped several encryption and backup improvements.

KEV deadlines: Cisco ASA and GitLab today, Ivanti tomorrow

What changed: Nothing new was added since yesterday's brief, but the clock is running out. The CISA KEV catalog lists CVE-2026-76418 (Cisco Secure Firewall ASA and Secure FTD software) and CVE-2026-97229 (GitLab Community and Enterprise Edition) with a due date of 1 November 2026. CVE-2026-111357 in Ivanti Connect Secure is due 2 November, and CVE-2026-118527 in the same product is due 13 November.

Who is affected: Anyone running these products, especially internet-facing firewalls, VPN gateways and self-managed GitLab servers.

What to do: If any of these are still unpatched, treat them as an incident-level task: apply the vendor fix, then review logs for unexpected admin activity. Our guide to Azure update management for Arc servers covers patch tracking for mixed estates.

Power Apps: two Copilot canvas features retire on 11 December

What changed: Microsoft posted two retirement notices on 31 October. MC1532421 retires formula assistance in canvas apps, meaning Copilot help for creating and editing Power Fx formulas and Power Apps Ideas. MC1532426 retires Proactive control rename, which suggests names for similar controls. Both end on 11 December 2026.

Who is affected: Makers who build canvas apps. Existing formulas, control names and published apps are not changed, and tenants cannot opt out.

What to do: No admin action is required. Tell your makers now so nobody relies on these features for work planned after mid-December.

Aurora PostgreSQL gains post-quantum TLS key exchange

What changed: On 29 October AWS said Amazon Aurora PostgreSQL-Compatible Edition supports post-quantum TLS key exchange on PostgreSQL 18 and later. You choose the key exchange groups from an Aurora allow list through the ssl_groups parameter.

Who is affected: Teams running Aurora PostgreSQL 18 or later with strict data-in-transit requirements. The announcement does not state regional availability or pricing.

What to do: No action is needed otherwise. If post-quantum readiness is on your compliance roadmap, test the parameter in a non-production cluster first and confirm your clients and drivers can negotiate the groups you pick.

Amazon MSK adds TLS 1.3 through security policies

What changed: On 30 October AWS announced that Amazon MSK Provisioned clusters can use TLS 1.3 via named security policies. Mixed policies let capable clients connect on 1.3 while others stay on 1.2, and stricter policies allow only 1.3. Existing clusters do not change until you apply a policy. There is no extra charge.

Who is affected: Anyone running MSK Provisioned clusters, in all Regions where it is offered.

What to do: Inventory your Kafka client libraries, apply a mixed policy first, and move to a TLS 1.3-only policy once every client connects successfully.

Redshift automates cross-region snapshot copies

What changed: On 29 October AWS launched automated cross-region backups for Amazon Redshift. Provisioned clusters and serverless workgroups copy the latest snapshot continuously and incrementally to the destination Regions you choose, independent of the local snapshot schedule. It is available in all commercial and GovCloud (US) Regions.

Who is affected: Redshift users who need a disaster recovery copy in another Region.

What to do: Enable it per cluster or workgroup, choose destinations and retention for the copies, and review the Redshift pricing page for storage and transfer costs. Then test a restore in the destination Region, as with any backup. See also /blog/azure-backup-vm-recovery-services-vault for general backup-testing habits.

Also worth knowing

• Amazon CloudFront can now pass viewer ISP and TLS cryptography details, including whether post-quantum TLS was used, to your origin as headers.
• AWS WAF can have CloudFront inject its JavaScript SDK automatically for Bot Control and Fraud Control.
• Amazon Managed Grafana workspaces can upgrade in place from 12.4 to 13.2.