Security News Update: What is the CISA PHP2Shell patch deadline, and is my website vulnerable? and more

OpenAI’s Terra Puts Office Drudgery on Sale Apparently, even AI has to justify its hourly rate. OpenAI launched GPT-6.1 Terra on Monday, targeting the mindless invoices, forms, and app-hopping that consume the workday. Standard API pricing is $1 per million input tokens and $5 per million output tokens, which OpenAI describes as a 50% cut …

Higher Azure Storage account resource quotas are now generally available, supporting up to 1,000 storage accounts with standard endpoints per region, per subscription, up from the default of 250. Manage more accounts in a single subscription, reducing the need to distribute resources across multiple subscriptions. Azure update ID: 578358 Published: Oct 27, 2026 Status: Launched …

Summary Microsoft is retiring the operational technology (OT) security component of Microsoft Defender for IoT. This change applies only to OT Security; Enterprise IoT in Microsoft Defender for Endpoint is not affected, and device discovery plus vulnerability assessment remain available. Organizations using OT Security should evaluate and migrate to an alternative OT security solution that …

Summary Microsoft will perform mandatory planned maintenance on Dynamics 365 Business Central environments running version 28.x to add support for .NET 10. During the maintenance window, affected environments will be unavailable and users cannot access them. The update runs outside the normal scheduled update process and cannot be set to an exact date/time by administrators, …

Summary Windows Server 2022 devices enrolled in hotpatching will need a restart to complete installation of the November and December 2026 security updates. Those updates will be delivered as standard updates for Server 2022 rather than hotpatch updates because they include security changes that cannot be applied without a reboot. Hotpatch enrollment is not changed; …

Summary Microsoft Entra ID is retiring Microsoft-provided SMS and voice authentication. Organizations using these methods must migrate affected users to passkeys or another supported sign-in method, or configure a customer-managed telecom provider (CYOT) if they want to keep SMS/voice. Users with another registered sign-in method should continue signing in without needing to register a passkey. …

Summary Microsoft Excel on iPhone will gain “Edit with Copilot,” allowing users to edit and transform workbooks using natural language. Copilot can continue processing tasks in the background, and chat mode remains available for questions and insights without making workbook changes. The feature applies to Excel mobile users in Microsoft 365 and respects existing authentication, …

Summary Microsoft Authenticator for Android is gaining an improved backup and restore setup experience with guidance tailored to whether users still have their old device. Users will also see guidance for using Authenticator passkeys for cross-device sign-in. Backup and restore remains limited to personal Android profile installs; Authenticator installs in an Android work profile are …

Summary Outlook’s Join button will only appear for meetings that use HTTPS join URLs. Meetings that contain only HTTP join URLs will no longer show the Join button. Most organizations are not expected to be affected, but third-party meeting providers, add-ins, and custom integrations that generate HTTP-only join links may be impacted. Admins should verify …

Summary Microsoft is retiring selected Search Analytics capabilities in the Microsoft 365 admin center for several search experiences. The affected reports are Summary, User/Query, and Answer Analytics within Search & intelligence > Insights. Affected search experiences include Microsoft/Bing Search (including Work Search), Teams Search, Outlook/WXP Search (including Word, Excel, and PowerPoint), Windows Search Work results, …