11/02/2026
Forward Technologies Briefing | November 2, 2026
This week has 2 immediate checks: WordPress 7.1.4 and any Entra dynamic rules using memberOf.
Confirmed changes
WordPress 7.1.4 fixes an upgrade-process RCE weakness
WordPress released 7.1.4 on October 28 and recommends updating immediately. The release fixes a weakness that could permit remote code ex*****on during the WordPress upgrade window.
Why it matters: This is separate from last week’s PHP vulnerabilities. A server can have fully patched PHP and still remain exposed through the WordPress core upgrade process.
Action:
* Verify every managed site is actually running 7.1.4. Don’t assume background updates succeeded.
* Check staging, development, and low-traffic sites that may have automatic updates disabled.
* Review WordPress, IIS, and Wordfence logs around recent core-update times for unexpected requests, processes, or file changes.
* Continue taking a known-good backup before manual core updates, but don’t leave sites unpatched while waiting for a routine maintenance window.
Entra memberOf dynamic rules stop updating tomorrow
Microsoft’s preview memberOf operator for dynamic groups, dynamic administrative units, and entitlement-management policies ends November 3. Existing configurations won’t disappear, but they’ll stop processing and remain frozen in their last-known state.
Why it matters: Frozen membership can leave former users with Teams, SharePoint, Conditional Access, licensing, or access-package assignments they should no longer have. Because the group still exists, the failure may not be obvious.
Action:
* Search dynamic membership rules for memberOf.
* Replace affected rules with supported attribute-based logic or convert the group to assigned membership.
* Validate the resulting membership and any policies, licenses, SharePoint permissions, or Conditional Access rules targeting the group.
* Most small tenants probably never used this preview operator, so this should be a quick exception check rather than a tenant-wide project.
Microsoft softened the immediate EWS cutoff
On October 26, Microsoft clarified that tenants already configured with EWSEnabled = True won’t have Microsoft-initiated EWS changes until the final retirement in April 2027.
Why it matters: This reduces the immediate outage risk for tenants that deliberately enabled EWS. It doesn’t cancel the retirement or provide a long-term reprieve.
Action:
* Continue identifying EWS-dependent backup, scheduling, migration, and mailbox-integration products.
* Don’t interpret a currently working integration as proof that the vendor is ready for April.
* Avoid changing EWSEnabled or EWSAllowedAppIDs casually. Record the current tenant configuration before troubleshooting an EWS application.
* Obtain a vendor migration commitment and target date for anything still dependent on EWS.
Microsoft now says not to delay October Windows updates on Exchange servers
This is a material refinement to the Exchange warning from the last 2 briefings. Microsoft says administrators should install the October Windows Server updates because of their security content and use the documented Endpoint Mapper registry setting to prevent the Exchange instability. The registry value can be created before patch installation. Microsoft says no replacement Windows or Exchange update is imminent.
Action: Patch Exchange servers during a monitored window, preconfigure Microsoft’s recommended registry value, and then verify OWA, mail flow, databases, queues, and Event ID 1006. Waiting indefinitely for a replacement cumulative update is no longer Microsoft’s recommended path.
Emerging change
Microsoft plans to begin targeted rollout of context-aware phishing detection in Teams during November, with general availability expected in December. It focuses primarily on first-contact chats from external users and can flag suspicious behavior even without a malicious link or attachment. No administrative action is required to enable it.
This is useful additional protection, but it shouldn’t replace reviewing whether each client actually needs unrestricted external Teams chat. Microsoft’s default remains to allow communication with all external domains.
