https://www.facebook.com/127357577138525/

InsightHeart Security

Name: InsightHeart Security
Address: 2 Bloor Street E, Suite 3500, Toronto, ON, M4W1A8, CA
Telephone: +14379000169

Home
Canada
Toronto, ON
InsightHeart Security

Professional security services: Cyber security, Home/Business Security, office surveillance

11/01/2026

ISHSTB – Weekly Tech Brief | Week of Nov 1–8, 2026

Main Topic: PHP2Shell, Critical Open-Source Vulnerabilities, and the Importance of Patch Management

This week reinforces an important cybersecurity lesson: organizations don't have to run vulnerable applications directly to be affected by vulnerabilities in the technologies they depend on.

Three developments deserve attention: actively exploited PHP vulnerabilities, a serious flaw in Google's Brotli compression library, and compromised certificate authority keys. The common theme? Visibility, patch management, and knowing what's running across your environment.

1. PHP2Shell: Critical PHP vulnerabilities actively exploited

Two critical remote code ex*****on vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed in PHP. Both were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 26.
- Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Organizations should identify exposed PHP installations, including older website platforms, hosting environments and custom applications.
- Patching alone isn't enough: investigate whether vulnerable systems were previously compromised.
MSSP Action: Help clients identify vulnerable assets, prioritize emergency patching, verify remediation and investigate suspicious activity.
Microsoft+1

2. Brotli vulnerability: Beyond PHP

A serious vulnerability in Google's Brotli compression library (CVE-2026-111497) affects multiple technologies, including Node.js, .NET, PowerShell 7, Visual Studio and PHP.

The vulnerability was also added to CISA's KEV catalog. Microsoft released out-of-band security updates, making this a reminder that dependencies can introduce risk across otherwise trusted environments.

MSSP Action: Review software inventories, update affected runtimes and applications, and verify that out-of-band updates and required restarts are completed.
Microsoft

3. Microsoft 365: MFA isn't the whole story

A token-replay campaign compromised 97 Microsoft 365 accounts across 79 organizations. Attackers used adversary-in-the-middle phishing to capture authentication sessions and replay stolen tokens.

The campaign also involved rogue Entra devices, unauthorized MFA registrations and hidden mailbox rules.

MSSP Action: Help clients strengthen Conditional Access, review Entra device registrations, monitor MFA changes, investigate suspicious inbox rules and revoke compromised sessions.
The Hacker News

Bottom Line

Security isn't simply about having MFA enabled or installing monthly patches. Organizations need continuous visibility into identities, applications, dependencies and infrastructure.

This week's developments are another reminder that attackers look for the gaps between security controls.

10/25/2026

ISHSTB – Weekly Tech Brief | Week of Oct 25 – Nov 1, 2026

Main Topic: PHP2Shell, Critical Web Vulnerabilities & Shrinking Patch Windows

This week’s major warning: PHP security. Two critical vulnerabilities, dubbed PHP2Shell, could let unauthenticated attackers execute code on vulnerable web servers. A further PHP vulnerability was disclosed on October 23. The lesson: internet-facing infrastructure needs rapid patching and continuous monitoring.

1. PHP2Shell: Emergency Patching Required

Key Developments: CVE-2026-109618 and CVE-2026-109619 affect multiple PHP versions. The Canadian Centre for Cyber Security recommends immediate updates. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

MSSP Action: Help clients inventory PHP-powered websites, WordPress environments, containers and third-party applications. Prioritize internet-facing systems, verify patches, and review logs for suspicious activity. Isolate systems temporarily if urgent remediation is impossible.

2. Another PHP Vulnerability Emerges

Key Developments: CVE-2026-115560 involves a specific combination of PHP session configuration and application behaviour. The PHP team recommends disabling session upload progress until a security update is available, where applicable.

MSSP Action: Coordinate with hosting providers and developers to check exposure and apply the vendor’s mitigation. Don’t assume patching the first two vulnerabilities resolves this separate issue.

3. AI Is Accelerating Vulnerability Discovery

Key Developments: Security reporting highlights how AI-assisted research can uncover weaknesses and shorten the time between discovery and potential exploitation. Defenders have less time to rely on routine patch cycles.

MSSP Action: Strengthen vulnerability prioritization, asset visibility, emergency patch procedures and monitoring. Focus on real exposure and available fixes—not just vulnerability scores.

4. Microsoft 365: Protect the Identity Layer

Key Takeaway: Web-server vulnerabilities and cloud identity attacks require different controls, but both demand visibility and fast response.

MSSP Action: Review MFA and Conditional Access, privileged accounts, risky sign-ins, email protections and audit logging. Confirm that alerts are monitored and incident-response responsibilities are clear.

Bottom Line: Know what you operate, patch what is exposed, and investigate what looks unusual. Security is not just prevention—it’s the ability to detect and respond before an incident escalates.

10/18/2026

ISHSTB – Weekly Tech Brief | Week of Oct 18–25, 2026

Main Topic: Microsoft 365 Supply-Chain Risk, Exploited Vulnerabilities & Third-Party Access

This week is a reminder that securing Microsoft 365 means looking beyond user accounts. Trusted third-party integrations can become a pathway into multiple organizations, making vendor access, application permissions, and incident response critical security priorities.

1. Microsoft 365: ConnectWise Cloud Backup Incident

Key Developments: On October 17–18, ConnectWise reported unauthorized access involving application identities associated with its cloud services. Security researchers reported unauthorized sign-ins across 173 partner/customer tenants using a compromised vendor credential. ConnectWise disabled seven application identities as its investigation continued.

What to do: Review third-party applications with access to Microsoft 365, audit Entra ID sign-in and audit logs, investigate unfamiliar activity, and validate backup integrity and recovery readiness. Revoke affected permissions when appropriate and follow official vendor guidance. [Source: The Hacker News](https://thehackernews.com/)

2. October Security Updates: Prioritize Exploited Vulnerabilities

Key Developments: Canada's Cyber Centre highlighted Microsoft's October security updates and noted that CVE-2026-96951 had been exploited and added to CISA's Known Exploited Vulnerabilities catalog.

What to do: Prioritize applicable security updates, verify deployment across Windows, Office, servers, and other affected systems, and investigate suspicious activity where exposure exists. [Source: Canadian Centre for Cyber Security](https://www.cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-october-2026-monthly-rollup-av26-1038)

3. MSSP Action: Make Third-Party Access Part of Routine Security

An MSSP can help readers by reviewing application consent and service principals, enforcing least privilege, monitoring suspicious sign-ins, validating alert coverage, and testing incident-response and backup-recovery procedures. Organizations should know which vendors can access their data—and how that access can be removed quickly.

Bottom Line: Microsoft 365 security is not just MFA and strong passwords. It requires continuous oversight of identities, integrations, permissions, patching, and recovery capabilities.

10/11/2026

ISHSTB – Weekly Tech Brief | Week of Oct 11 – 18, 2026

Main Topic: AI-Driven Threats, Vulnerability Management & Microsoft 365 Resilience

Welcome to Insight Heart Security – Weekly Tech Brief.

This week’s developments reinforce a critical message: attackers are becoming more efficient, and organizations must strengthen identity security, patch management, and detection capabilities.

1. AI Is Raising the Cybersecurity Stakes

Key Developments: Microsoft’s October 7 research highlighted lessons from using advanced AI to discover software vulnerabilities. Meanwhile, recent reporting describes AI-assisted attacks against organizations in South Korea and Japan.

What You Can Do: Prioritize vulnerability remediation, monitor unusual account activity, and review security controls around applications and AI tools. AI can improve defence—but it also increases the importance of disciplined security fundamentals.

2. Exchange Server: Don’t Delay Security Updates

Key Developments: A reported high-severity Microsoft Exchange Server vulnerability, CVE-2026-96940, could allow authenticated attackers to access other users’ mailboxes. Microsoft indicates Exchange Online is protected by a server-side fix; affected on-premises deployments need attention.

What You Can Do: Verify your Exchange Server version and patch status, review access permissions, and investigate suspicious mailbox activity. Don’t assume cloud and on-premises environments have identical patching requirements.

3. Microsoft 365: Strengthen Identity and Collaboration Security

Key Developments: Microsoft continues expanding security capabilities across its ecosystem. October updates include broader user reporting for suspicious Teams meetings and participants in eligible Defender for Office 365 environments.

What You Can Do: Enforce phishing-resistant MFA where possible, review Conditional Access policies, limit administrator privileges, and make it easy for staff to report suspicious emails, Teams meetings, and unexpected authentication requests.

MSSP Action: Ask your managed security provider to validate patch compliance, monitor Entra ID sign-ins and Microsoft 365 audit logs, tune Defender alerts, and test incident-response procedures. Request a prioritized remediation report—not just a list of alerts.

Bottom Line: Security resilience comes from combining timely patching, strong identity controls, employee awareness, and continuous monitoring. AI changes the threat landscape, but the fundamentals still matter.

Security

Sources to explore
- Microsoft: Lessons from frontier AI vulnerability research
- Exchange Server vulnerability and patching guidance
- Microsoft Defender for Office 365: What's new

10/04/2026

ISHSTB – Weekly Tech Brief | Week of Oct 4–11, 2026

Main Topic: Cloud Resilience, SharePoint Exploitation & Identity Security

This week reinforces a critical lesson: cloud services are not a substitute for resilient security and independent backups. From nonprofit Microsoft 365 data loss to ransomware exploiting SharePoint, organizations must protect both access and recovery.

1. Microsoft 365: Nonprofit Data Loss Raises Backup Concerns

Key Developments: Reports published October 1 describe Microsoft 365 data belonging to some nonprofits being accidentally deleted during the retirement of Business Premium Grant licenses. The affected data was reportedly unrecoverable. This highlights the importance of managing license transitions carefully and maintaining independent backups. [Source: TechRadar](https://www.techradar.com/pro/microsoft-deletes-nonprofit-customers-m365-data-and-says-it-cant-get-it-back)

MSSP Action:

• Audit nonprofit clients' licensing and migration status.
• Verify independent backups of Exchange, OneDrive, and SharePoint, including restoration testing.
• Document retention requirements, recovery objectives, and license-change procedures.

2. SharePoint Exploitation Fuels Ransomware

Key Developments: Reporting on October 2 linked Warlock ransomware attacks against a water utility, telecom provider, regional government, and university to exploitation of SharePoint vulnerabilities. Attackers also used techniques to disable endpoint protection before deploying ransomware. [Source: BleepingComputer](https://www.bleepingcomputer.com/news/security/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks/)

MSSP Action:

• Prioritize supported SharePoint Server security updates and mitigations.
• Review internet-facing services and investigate suspicious access or web-shell activity.
• Validate endpoint detection coverage and immutable or offline backup recovery.

3. Internet-Facing Infrastructure Under Pressure

Key Developments: A threat-intelligence roundup published October 4 highlighted active exploitation affecting Citrix NetScaler ADC/Gateway and FortiMail, alongside vulnerabilities affecting other enterprise platforms. Edge devices remain a critical entry point for attackers. [Source: RedSheep Security](https://www.redsheepsec.com/trends/weekly-report-2026-w40)

MSSP Action:

• Inventory exposed appliances and prioritize vendor-recommended fixes for actively exploited vulnerabilities.
• Review logs for suspicious administrative access and unexpected configuration changes.
• Escalate suspected compromise for investigation rather than relying on patching alone.

Bottom Line

Microsoft 365 security requires more than MFA and strong passwords. Combine identity protection, least-privilege access, email security, endpoint monitoring, tested backups, and documented recovery plans. For MSPs and security teams, resilience means proving that critical data can be restored—not simply assuming it can.

09/27/2026

ISHSTB – Weekly Tech Brief | Week of Sep 27 – Oct 4, 2026

Main Topic: AI-Driven Cybercrime Moves From Experiment to Operational Threat

The cybersecurity story this week is increasingly clear: attackers are not just using AI to write phishing emails or automate tasks. AI is becoming part of the attack infrastructure itself—while identity remains one of the easiest paths into cloud environments.

1. AI-powered cybercrime at scale

Microsoft disrupted the infrastructure behind “EvilTokens,” a cybercrime service that used device-code phishing to compromise Microsoft accounts. Microsoft estimates the operation affected more than 12,000 email inboxes across 10,000 organizations. The service reportedly lowered the technical barrier for attackers by packaging account-compromise capabilities as a subscription service.

MSSP Action: Review Entra ID sign-in activity, monitor suspicious device-code authentication, strengthen Conditional Access policies, and make sure compromised-session response procedures are tested.

2. AI is becoming part of malware

Researchers reported new malware incorporating LLMs into its decision-making and command-and-control processes. One example, dubbed CLOSEDQUORUM, reportedly uses multiple AI models to determine actions without requiring continuous human direction.

This points toward a future where some attacks can adapt faster than traditional human-driven workflows.

3. Microsoft 365 security is entering the AI-agent era

Microsoft’s September security updates emphasize discovering and controlling AI agents across employee devices, cloud platforms and development workflows. Microsoft is also expanding controls that apply Zero Trust and data-security policies to agent traffic and “shadow AI.”

MSSP Action: Start treating AI agents like identities and applications—not simply productivity tools. Inventory them, define what data they can access, apply least privilege, and monitor their activity.

Bottom Line

For SMBs and nonprofits, the takeaway isn't “ban AI.” It is to understand which identities, applications, agents and data are connected—and what happens if one is compromised.

Identity security + Conditional Access + endpoint visibility + data governance + continuous monitoring should remain the foundation.

09/20/2026

ISHSTB – Weekly Tech Brief | Sep 20–27, 2026

Main Topic: Identity Is Becoming the New Attack Surface

This week’s security news reinforces a trend we’ve been watching closely: attackers don’t always need malware or an unpatched server when they can convince a legitimate user to hand over access.

1. Microsoft 365: Passkey Phishing Gets More Sophisticated

Microsoft has detailed campaigns where attackers impersonate IT/help-desk staff, contact employees by phone or SMS, and direct them to fake Microsoft sign-in pages. Adversary-in-the-middle techniques can capture authentication sessions, allowing attackers to access SharePoint, OneDrive and Exchange data.

MSSP Action: Review Conditional Access, phishing-resistant MFA, risky sign-ins and unusual token/session activity. Train users that a “help desk” request to change MFA or passkeys should be independently verified.

2. Zero-Days Still Demand Fast Response

Microsoft’s September Patch Tuesday addressed a record number of vulnerabilities, including actively exploited Windows flaws. Researchers also reported continued exploitation of browser/Windows vulnerabilities in targeted campaigns.

MSSP Action: Don’t treat patching as a monthly checkbox. Prioritize exploited vulnerabilities, internet-facing systems and high-value identities first.

3. AI Is Accelerating the Threat Cycle

Anthropic reported disrupting malicious operations where threat actors attempted to use Claude to support cyber activity, while researchers continue seeing AI-assisted phishing and malware development.

The takeaway isn't simply “AI is dangerous.” It’s that attackers can increasingly automate research, personalization and parts of their workflow.

4. Supply Chain & Developer Targeting

North Korean-linked WaterPlum activity reportedly compromised at least 30,000 devices across more than 100 countries, with attacks involving malicious developer packages and fake job/interview workflows.

MSSP Action: Treat developers, contractors and remote workers as part of the security perimeter. Restrict ex*****on of untrusted code and apply least privilege to development environments.

Bottom Line

For SMBs and nonprofits, the practical lesson is straightforward: protect identities, not just endpoints.

MFA remains important—but phishing-resistant authentication, Conditional Access, least privilege, monitoring and user verification need to work together.

09/13/2026

ISHSTB – Weekly Tech Brief | Sep 13–20, 2026

Main Topic: Microsoft’s Massive Patch Tuesday + The Next Phase of Identity Attacks

This week brought a major reminder that cybersecurity is increasingly about identity, cloud sessions, and rapid patching—not just passwords and endpoints.

1. Microsoft’s Record-Breaking Patch Tuesday

Microsoft’s September security release addressed roughly 970 vulnerabilities, including two actively exploited zero-days. The scale alone is significant, but the bigger takeaway is prioritization: vulnerabilities being exploited in the wild should move immediately to the top of the remediation queue.

MSSP Action: Don’t treat Patch Tuesday as a monthly checklist. Prioritize actively exploited CVEs, validate deployment, and confirm that critical endpoints and servers actually received the updates.

2. Passkeys Are Being Targeted—But Differently

Microsoft researchers reported active campaigns using passkey-themed social engineering to trick users into actions that ultimately enable identity and cloud compromise. The lesson: even stronger authentication technology doesn't eliminate the human attack surface.

MSSP Action: Pair phishing-resistant authentication with Conditional Access, device compliance, risk-based detection, and user education. Authentication strength and identity monitoring need to work together.

3. Microsoft 365 Sessions Are Becoming the Prize

Recent campaigns are targeting authenticated Microsoft 365 sessions through adversary-in-the-middle phishing infrastructure. Stolen session information can allow attackers to operate after a user has successfully completed MFA.

MSSP Action: Monitor unusual sign-ins, impossible travel, unfamiliar devices, risky OAuth activity and abnormal mailbox/cloud behavior. MFA remains essential, but organizations should also assume that a session can become compromised.

4. AI Is Accelerating Both Sides

New threat-intelligence reporting continues to show threat actors experimenting with AI for reconnaissance, social engineering, malware development and operational scaling.

For SMBs and nonprofits, the answer isn't simply “ban AI.” Establish practical AI governance, protect sensitive data, control access to AI tools, and make sure security monitoring can identify unusual activity.

Bottom Line

The modern attack chain is increasingly identity → session → cloud → data.
For Microsoft 365 environments, the priority should be clear: patch aggressively, strengthen phishing-resistant authentication, monitor identities and sessions, and assume that attackers will continue looking for ways around the controls users already trust.

09/06/2026

ISHSTB – Weekly Tech Brief | Sep 6– Sep 13, 2026

Powered by Insight Heart Security

This Week’s Focus: Microsoft 365 Identity + The Next Evolution of Phishing

Cybersecurity continues to shift from “protect the endpoint” toward protecting identity, sessions, and trusted workflows.

Here are four developments worth watching this week:

1. Passkeys officially move to the forefront

Starting September 1, passkeys became the default authentication experience for Microsoft Entra ID. Microsoft is also moving toward eliminating its own SMS and voice authentication options by February 2027. Passkeys provide phishing-resistant authentication by using cryptographic credentials rather than reusable passwords.

MSSP takeaway: If your nonprofit or SMB still relies heavily on passwords and SMS-based MFA, now is a good time to begin planning the transition toward phishing-resistant authentication.

2. Phishing is getting harder for email filters to recognize

Microsoft reported an active campaign using invisible Unicode characters—sometimes called ASCII smuggling—to disguise malicious content from security controls. The technique demonstrates how attackers are adapting techniques originally associated with AI prompt manipulation for traditional phishing.

3. Teams can become an attack path

Microsoft Threat Intelligence documented attacks abusing external Microsoft Teams collaboration to impersonate IT support, establish trust with victims, gain remote access and deploy malware.

For organizations using Microsoft 365, Teams security deserves the same attention as email security.

4. Fake software downloads remain dangerous

Microsoft researchers also reported campaigns using counterfeit download sites impersonating legitimate software vendors. Trojanized installers can establish persistence and weaken security protections after installation.

Bottom Line

Microsoft 365 security in 2026 isn't simply about turning on MFA.

Organizations should be thinking about:

• Phishing-resistant authentication

• Conditional Access

• Teams external collaboration controls

• Email and identity monitoring

• Endpoint protection

• Software download controls

• User awareness around “IT support” requests

• AI-assisted and AI-targeted phishing techniques

For resource-constrained nonprofits and SMBs, identity is increasingly the security perimeter.

08/30/2026

ISHSTB – Weekly Tech Brief | Aug 30 – Sep 6, 2026

This Week’s Focus: AI Is Compressing the Attack Timeline

Cybersecurity is increasingly becoming a race against time. This week’s developments show attackers gaining speed through AI, while defenders face a growing backlog of vulnerabilities, identity risks, and third-party exposure.

Top Headlines

• AI-powered attacks are moving from theory to reality. New reporting highlights AI agents being used to automate reconnaissance, vulnerability discovery and portions of attack chains. Security teams should assume AI will increasingly reduce the time between initial access and impact.

• Critical ServiceNow vulnerabilities patched. Four flaws affecting ServiceNow’s Now Platform and AI Platform included three rated CVSS 10.0, with potential for unauthenticated code ex*****on and data access. SaaS platforms remain part of the attack surface—not outside it.

• Citrix NetScaler exploitation observed. CVE-2026-8452 has reportedly been exploited in the wild, reinforcing the importance of prioritizing internet-facing appliances when active exploitation emerges.

• PaperCut under active exploitation. Huntress reported reproducing a pre-authentication RCE chain affecting PaperCut NG/MF. Organizations using self-hosted infrastructure should verify exposure and patch status.

• IoT remains an easy foothold. Researchers reported more than 14,500 Dahua devices compromised through credential attacks, authentication bypasses and related techniques. Internet-exposed devices continue to be attractive targets.

What This Means for SMBs & Nonprofits

The lesson isn't “buy more security tools.” It is reduce attacker time and opportunity.

MSSPs and IT teams should prioritize:

1. Patch actively exploited and internet-facing vulnerabilities first.

2. Review Entra ID/Microsoft 365 identities, privileged accounts and legacy authentication.

3. Require phishing-resistant MFA wherever practical.

4. Monitor SaaS, remote-access and edge appliances as part of the attack

surface.

5. Establish clear governance for AI tools, agents and sensitive organizational data.

6. Validate offline/immutable backups and recovery procedures—not just backup completion.

Bottom Line

AI is becoming a force multiplier for both attackers and defenders. Organizations that combine strong identity controls, rapid vulnerability prioritization, continuous monitoring and tested recovery will be better positioned for the next wave.

Address

2 Bloor Street E, Suite 3500
Toronto, ON
M4W1A8

Telephone

+14379000169

Website

facebook.com

Alerts

Be the first to know and let us send you an email when InsightHeart Security posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.