IT & AI brief, 9 November 2026: GitHub pull_request_target brownout starts today, KEV deadlines this week
The first pull_request_target brownout runs today, three CISA KEV deadlines fall this week, and Microsoft folds more Microsoft 365 previews into Frontier while GitHub Copilot reaches Xcode.
GitHub's first pull_request_target brownout runs today between 16:00 and 18:00 UTC, and workflows that use the trigger in public repositories will fail during that window. Microsoft's November Patch Tuesday is tomorrow, and three CISA deadlines also land this week.
GitHub Actions: first pull_request_target brownout today
What changed: Following the GitHub changelog, full enforcement is applied for two hours today and again on 16 November, both 16:00 to 18:00 UTC. Blocked runs fail with an error annotation and do not execute. Between brownouts the rule only evaluates and warns. Permanent default blocking begins on 2 December 2026. We covered the original change on 4 November; the new detail is that testing time has now started.
Who is affected: Public repositories on GitHub Free, Team and Enterprise Cloud. Private and internal repositories and Enterprise Server are not affected.
What to do: Check Actions insights for runs the rule would block. Either accept the block, or explicitly allow the trigger through an Actions event policy limited to specific workflow files. Our guide to scheduled GitHub Actions workflows is a useful refresher on workflow triggers.
CISA KEV deadlines this week: Brotli, VMware ESX and Ivanti
What changed: Nothing new has been added since the SonicWall entry of 6 November, but the KEV catalog shows three due dates close together. Google Brotli CVE-2026-111497 is due on 10 November, Broadcom VMware ESX CVE-2026-41709 on 11 November, and the second Ivanti Connect Secure flaw, CVE-2026-118527, on 13 November. The SonicWall SSLVPN SAML bypass follows on 20 November.
Who is affected: Anyone running ESX hosts, Ivanti Connect Secure gateways, or products that embed Brotli. The deadlines formally bind US federal agencies, but they are a sensible benchmark for everyone.
What to do: Confirm each item is patched or mitigated, starting with internet-facing Ivanti appliances. Check vendor advisories for fixed versions and record any exceptions.
Patch Tuesday is tomorrow
What changed: The second Tuesday of November 2026 is 10 November, so Microsoft's monthly security updates are due tomorrow. The October release was unusually large, so expect a long list to triage. Release details will appear in the Microsoft Security Update Guide.
Who is affected: Everyone who manages Windows, Office, Exchange or SharePoint servers, and Intune or Windows Update for Business rings.
What to do: Keep a pilot ring ready. After release, check for zero-days marked as exploited and patch those first. Our guide to Intune update rings and hotpatch covers ring planning.
Microsoft 365 Frontier now covers more previews
What changed: RM578225 says Frontier, Microsoft's preview programme, brings eligible public previews for the new Outlook for Windows, OneDrive, SharePoint, Teams and Copilot into one programme. It is marked as launched, with general availability in November 2026. Existing Frontier users do not need to re-enrol.
Who is affected: Tenants in the worldwide multi-tenant cloud whose users or admins opt into Frontier.
What to do: Enrolment is optional and admin-controlled through a single experience, separate from Standard and Deferred release preferences. Decide who, if anyone, should be in Frontier, and keep production users out so they do not receive preview behaviour.
GitHub Copilot arrives in Xcode's coding assistant
What changed: GitHub says Copilot is now available inside Xcode's built-in coding assistant as a public preview. It needs the Xcode 27.3 beta and macOS Tahoe 26.6 or later, and is configured under Xcode Settings, Intelligence. All Copilot plans are supported, and the separate Copilot for Xcode extension remains available.
Who is affected: Teams building iOS and macOS apps with Copilot licences.
What to do: The changelog describes no admin policy controls, so check your organisation's Copilot policies before developers adopt it. Treat it as a preview, and try it on a non-critical project first.
GitHub app for Slack and Teams reaches general availability
What changed: On 6 November GitHub announced that @GitHub in Slack and Teams is generally available. Users can investigate bugs, create issues, make changes and open pull requests from a chat. Teams gets a canvas for reviewing plans and code changes. Issues and pull requests it creates note that they came from a Slack or Teams conversation.
Who is affected: Organisations whose engineers work in Slack or Teams alongside GitHub.
What to do: The announcement does not list plan requirements or admin settings. Before approving the app for your tenant, review the permissions it requests and decide which repositories it may reach.
Also worth knowing
Was this helpful?
Get the next guide
Free checklists and new guides: a short weekly digest on Sundays, or an email each day with new articles. Unsubscribe in one click.
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.