Hi everyone!

I'm so exhausted being an M365 admin these days. Technology and AI are moving at crazy speeds and I just can't keep up!

Hearing about all the big tech layoffs makes the stress twice as bad. I honestly feel like I could easily be replaced by an AI agent.

Am I overthinking this or are you feeling this pressure too? Maybe burnout?

Had an employee leave on Friday and found out Monday morning their badge was still active. HR had processed everything on their side but nobody had told the person managing door access

Nothing happened but it made us realize how easy it is for something like that to get missed when different departments are handling different parts of offboarding. For anyone managing access control, does HR automatically trigger badge removal or does someone have to manually request it? Trying to figure out what people do to make sure these don't slip through

Over the weekend, we got charged over $48k across 2 bank payments by Autodesk (aa 3rd of another 40k got blocked), the issue is that we have never had an Autodesk account nor used their systems before, we already contacted the bank and their support directly and Autodesk says they don't see such payment, with the specific transaction number/code being received. Any suggestions?

https://imgur.com/a/9CBEok2

Started getting a few complaints about this one and it was news to me. I never saw anything in the M365 Admin Center about it, even went back through all the messages and my emails.. still absolutely nothing.

Disabling the tag involves a mail flow rule. Folder behavior is controlled by bulk move options in your anti-spam policies.

https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about#deliver-bulk-mail-below-the-bcl-threshold-to-the-promotions-folder

I'm seeing this trend more and more. WFH users opening tickets for very simple things that they claim is preventing them from working. I remote in and the issue magically vanishes. How many people do you think are just faking technology problems from home so that they don't have to connect or work? Seems pretty simple to just throw your tech under the bus. Thoughts?

DreamHost's status page logged the first problem at 2:20 PM PDT on October 23, with connectivity issues on the panel File Manager. By 5:20 PM it was resetting some email passwords as a precaution. At 10:13 PM the resets covered FTP and SFTP users too.

Four days on, DreamHost still hasn't named a cause. BleepingComputer asked how many accounts were hit and whether files or messages were exposed, and got no answer by publication. CyberInsider reports the count of affected customers hasn't been disclosed either.

The File Manager is the panel tool that edits and deletes website files and can fetch a file from any URL. BleepingComputer's story said it was still down. DreamHost's status page says a fix went out at 3:35 PM PDT on October 26 and it's monitoring.

The owner notice tells owners to review the forwarding settings on every mailbox and remove any forward they don't recognize. For SFTP users it says to set a new password. It also says SFTP user data stays on the server.

DreamHost lists 750k+ WordPress installations on its company page. A new SFTP password doesn't remove a PHP file written to wp-content while the old one still worked.

It has happened before. In January 2012 DreamHost reset FTP and shell passwords for all customers after someone got into one of its database servers.

When a host expires SFTP passwords "to ensure the continued integrity" of accounts, does it owe customers a word on whether anything was written to their sites, or is checking the files the owner's job?

Can we relax a little? lol asking for a friend.

What is everyone doing with this? Moving all PC's to the new Time Zones or staying with known time zones? Anyone brave enough to use the Microsoft Invoke-Calendar move commands that come out tomorrow?

Current Microsoft communications.

Update to MC1510951: Canada 2026 time zone changes — Microsoft 365 impact and required admin actions

 Summary

 On November 1, 2026, certain Canadian regions will not change clocks, affecting Microsoft 365 scheduling. Admins must update Windows, Outlook time zones, review meetings, update Teams Rooms, and keep apps current. Testing and support case submission with #Canada Time-Zone are advised.

 This post updates MC1510951 ((Updated) Windows updates are available for 2026 time zone changes in Canada, posted October 16, 2026).

 On November 1, 2026, affected locations in British Columbia, Alberta, and Manitoba will not move clocks back and will remain on UTC-07:00, UTC-06:00, and UTC-05:00 respectively. Affected locations in the Northwest Territories (including Yellowknife and Inuvik) align with the Alberta change, and Northwestern Ontario aligns with the Manitoba change.

 Windows and Microsoft 365 services depend on updated time zone definitions for correct scheduling and display behavior.

 How this affects your organization

 Confirmed impact

1. Outlook and Exchange Online (calendar): Users must move to the new time zone. Existing events do not migrate automatically. Recurring meetings require additional review.
2. Microsoft Teams Rooms on Windows: Some devices may display time one hour behind Windows until Edge/WebView2 is updated.

Potential impact (under validation)

1. Microsoft Teams (desktop, web, mobile) and other Teams devices
2. Outlook for iOS, Android, and Mac
3. Microsoft Bookings
4. Shifts
5. SharePoint Online
6. OneDrive

What you need to do

1. Ensure Windows devices in affected regions have the latest Windows updates (including October 2026 updates).
2. Ask users in affected regions to select the new time zone in Outlook and review meetings scheduled after November 1, especially recurring series.
3. Plan to run the Exchange Online PowerShell remediation cmdlet for non-recurring meetings once released (target: October 28, 2026).
4. Update Microsoft Edge and WebView2 on Teams Rooms on Windows and confirm room time display matches Windows.
5. Keep Teams, Outlook (including iOS/Android/Mac), and other Microsoft 365 apps current.
6. Test key scenarios before November 1: recurring meetings, free/busy, Bookings appointments, Shifts schedules, and SharePoint regional settings.
7. If issues occur, open a support case in the Microsoft 365 admin center and include #Canada Time-Zone in the title.

Additional information

• Outlook Time Zone Changes for British Columbia, Alberta, and Manitoba (Microsoft Support)
• Interim guidance for British Columbia time zone changes 2026 (DST Blog)
• Interim guidance for Alberta time zone changes 2026 (DST Blog)
• Manitoba 2026 time zone update available now (Daylight Saving Time and Time Zone Blog)

We will continue updating this post as product teams confirm impact, publish mitigations, and release additional guidance.

Microsoft shipped .NET updates out of band on Saturday (Oct 25) for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with .NET. The .NET advisory scores it 8.1 and MSRC rates it Critical for .NET, and Microsoft says exploitation is more likely, with no exploitation reported as of the 25th.

The patched runtimes are 8.0.33, 9.0.22 and 10.0.14. Anything below those is still exposed, and .NET Framework is not affected, so older Framework servers can sit this one out. The same release also fixes CVE-2026-114148, a file-ownership problem in .NET tarballs on Linux, and it re-does two October 13 fixes that had not fully landed (CVE-2026-70197 and CVE-2026-102870).

A few things that decide how urgent this is on a given box:

Exposure needs an app that decompresses Brotli data it does not control, through ASP.NET Core request decompression, HttpClient automatic decompression, or the System.IO.Compression Brotli APIs. Neither decompression path is on by default, so a patched-later queue is defensible for internal apps that never enable them, while internet-facing ASP.NET Core goes first.

Updating the shared runtime does nothing for self-contained apps because they carry their own copy of the runtime, and those need a rebuild and redeploy. Framework-dependent apps pick the fix up from the runtime update, though the processes still need a restart, and on IIS that means updating the ASP.NET Core Hosting Bundle rather than only the runtime.

PowerShell is in scope as well, with fixes in 7.4.22, 7.5.13 and 7.6.9, which matters on admin workstations that never run a .NET app. Anyone on Azure App Service with built-in .NET images on Linux gets the platform update from Microsoft; the rollout had finished for the Latest channel and was still going out to Standard as of Oct 26.

`dotnet --list-runtimes` gives a quick inventory per machine. Microsoft's announcement is here: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

Just noticed. Still looking.

Out of band, not a preview.

Secure boot certificates mentioned in this one. Edit: <-- Nope, NOT secure boot. Just certificate.

https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5134133-windows-11-24h2-25h2-26h2-update

We were sadly compromised. Twice. It's finally answered the question of investments, but the police want evidence.

The audit logs is clear on that, but I realise this will become police evidence. They have a secure upload. I filtered the audit logs as I downloaded them to show everything from the attackers to create the csv file. I then created a text file showing the filter, how it was created and the SHA hash of the file.

Is this enough? I think the attacker(s) made a mistake and may be traceable, so absolutely would be willing to see them prosecuted.

The question is, should I have included anything else in there or done anything else to show the file is not tampered with between myself creating and them opening?

Today, I got the news that a co-worker of mine passed away. She was one of the first people I on-boarded at this client when I previously worked for them as a tech with an MSP and not as their manager. She was always smiling and made me feel so accepted at a place that I was unfamiliar with. She was a mother, under 50 yrs old and had a young daughter she was co parenting. I would get to see her daughter often at the org and you could tell how much her mom loved her.

Now, she is gone and I have to retrieve her laptop. Maintenance has to clean up the office and we have to move on.

It is the second person this year that I have closely worked with that I will have to terminate and it is devastating.

I know this is a somewhat common post here, but I think it's a conversation that is very important for those of us that have had to deal with grief in the workplace.

She had a direct impact on my experience at work and me feeling like I was at the right place in my career.

I want her memory to live on so I will tell others of our interactions and how sweet she was.

If you have had to go through similar, please feel free to share your own experiences with this.
Sending love to anyone dealing with death.

Hi everyone,

Earlier today we were the target of an automated Layer 7 DDoS attack against our production Cloud Run service. The attack was carried out using a Python script (Python/3.13 aiohttp/3.14.5) which was making around 50 requests per second to POST /api/login, attempting to consume container concurrency.

The traffic came through Google's own proxy infrastructure, potentially Apps Script or Colab, rotating across 200+ IPs resolving to google-proxy-*.google.com (e.g., 66.102.8.132, 66.102.8.161, 74.125.210.103).

The problem is that Google's official abuse reporting form (https://support.google.com/code/contact/cloud_platform_report) immediately closes the report with:

We're unable to do anything with this report as the IP address referenced in it isn't hosted on Google Cloud.

It appears the automated system only recognizes customer Compute Engine IP ranges, not Google's own proxy egress IPs (AS15169). As a result, the report gets rejected before anyone can review the Cloud Logging evidence, including timestamps and Cloud Trace IDs.

We've already hardened the backend with distributed Firestore rate limits, concurrency controls and request timeouts so the attack traffic is now being dropped. We've also responded to the closed ticket with the trace IDs, asking for escalation to the relevant Trust & Safety team.

I have three questions:

1. Is there a specific abuse reporting email or intake point for traffic coming in via Google's own proxy infrastructure which would effectively bypass the automated IP validation?
2. Has anyone with Basic Support actually escalated a similar proxy based DDoS to a human at Google?
3. Would Google Bug Hunters be the right place to report this as a potential proxy abuse/SSRF vector or is there a more appropriate channel to get to the relevant security engineers?

Any suggestions on how to get this routed to the appropriate team would be great. Thanks!

Just like the title says, I needed to record a simple step-by-step for a client today and found that the old tool I used to use (PSR.exe) has been deprecated. Another casualty of modern Microsoft. Does anyone know of a free and simple alternative that works decently enough?

Hey Folks,

Scenario:

• User running MuseAI (not M365 integrated)
• User works on a sharepoint document OR shares a link to a sharepoint document with the bot
• ITDR screams on token theft
• Logs show user logging into sharepoint on chrome/linux, accessing the same file with the same session token they have on their workstation
• none of the other typical evidence of BEC is present (no phishing messages, nothing weird in browser history, etc)

To me, this looks like Muse is taking extreme liberties with end users active cookies and login tokens, replaying them on other machines in other geo-locations. Terrifying if true.

Wondering if anyone else has seen similar.

And yes, I know, block non-approved apps, filter DNS, etc. Not looking for solutions, just confirmation that others are seeing similar behaviour.

We acquired a company that uses QNAP NAS'es but we have no experience with these whatsoever. Defender is telling me to update our TS-431XeU because of the recent PHP2Shell vulnerabilities, but looking at the details, it's still running QTS 4.3.4.0675 , so we're about eight fucking years behind.

However, checking for updates through QTS says the system is up-to-date while the QNAP support page lists newer firmware for this model. I assume we'll have to update it manually, but I'm not sure whether we can jump straight to QTS 5.x or if we need to install intermediate versions first.

My question: is it safe to update across such a large version gap and what does the process look like? Any indications of update duration, possibilities of failure, compatibility issues with existing RAID configurations or volumes, etc.? Also, what are the recovery options if the firmware update fails or the NAS doesn't boot afterwards? Fuck me but also fuck that guy for leaving no documentation.

We will of course back up the data but I'd rather not risk anything since this is a production NAS and we don't know much about its history.

Anyone who's done a similar upgrade on this model or another older QNAP?

Edit: fuck it, I created a ticket at QNAP but since they're not reachable from outside, I'll just put a wall around it as someone said here. Thanks for the info, my dudes

Walmart opened its store to AI shopping agents last week while Amazon is blocking Meta's, and it landed right as we're finishing our Black Friday WAF rules.

Every year our checkout rules get stricter going into peak, anything that looks automated gets challenged or blocked, and that's done a good job against card testing and credential stuffing.

An agent buying for a customer looks a lot like those bots from our side, headless browser or straight API calls, fast and with no mouse movement, and from next month some of that traffic will be real orders.

Our shop is headless (Scayle), so search, cart and checkout are already APIs an agent can call, which means the whole decision lands on the WAF.

The business side hasn't decided whether we copy Walmart, copy Amazon or let a few known agents through, and the rules freeze on Nov 1.

So before I pick a default myself, how are you treating agent traffic going into Black Friday ?

As if Microsoft and their software/cloud isn't bad enough in it's current state, it's likely going to get worse with a reduction of about 1/4 of their workforce.

Microsoft makes new 'voluntary exit' offer to about a quarter of its workforce, including some execs – GeekWire

I'm eager to see how many more shit updates get through MS "QA" into production environments and cause unnecessary havoc and stress globally.

We're trying to get M365 setup. However whenever I try to login to the application with a test licensed user account, I get a 404 Network error. I know the creds are good, I can log into web portal no problem.

I've isolated the issue to a specific GPO that when applied causes this, but this is a like a legacy GPO that may be 20 years old and no matter what I've done I can't seem to isolate what specific policy item is causing this.

I've recreated the policy by hand, trying to match it item for item, no problems, the new test policy doesn't prevent M365 from working.

I do a backup and restore policy item, new restored policy does cause the problem.

I modified the files in Sysvol and renamed the ADM folder in the relevant GPO to adm.old, this prevented new computers from experiencing this behavior. But since I need to get M365 working, I need to find the actual policy so that I can either delete the registry key or set the inverse as simply removing the policy leaves the behavior in tact for anything that got the policy previously

I've used Regshot for a before and after, unforunately this creates a 5,000ish line txt file and there is simply too much noise to figure out what's actually happening here.

If anyone has any ideas or thought about where to look or ideas on how to isolate this further, that'd would be greatly appreciated.

This is M365 installed on Windows 11 24H2 Ent.

Anyone else experiencing this issue? We've got multiple reports of errors when clicking "Open with Word" or Excel or similar in New Outlook.

Edit: Usually it just spins, but sometimes you get this error message https://imgur.com/a/EIOrTdq

Is anyone else's team still recovering from the recent PHP2Shell fire drill (CVE-2026-109618 / 109619)?

How we got here is what scares me the most. The developers knew about a memory issue back in 2024. They ignored it to keep older systems working, thinking no one could actually use it to hack into systems.

But then, someone used a new AI model on the old C codebase. The AI quickly found a complex bug that humans had missed for years. To make things worse, a software company accidentally released the fix 12 hours too early. Because of this mistake, hackers could see exactly what was changed. They started attacking the internet before the official warning even came out.

For 20 years, old open-source code stayed safe mainly because finding memory bugs by hand is incredibly hard, boring work. Now, AI models can easily find hidden flaws in 15-year-old code. Volunteer developers simply can't keep up with this speed.

How are you all handling this at work? If we now have to fix servers in four hours or unplug them completely, I might just move to the woods and raise goats.

I built SSHyar as a day-to-day SSH desktop app: connect, browse files, and poke Docker/Nginx/systemd without juggling three tools or dropping an agent on the host.

Local encrypted vault + portable backup

Optional plugins per profile

In-app installer download when a new release ships

Screenshots and comparison notes are in the README: https://github.com/mh314k/sshyar

Feedback and issues welcome.

I'm trying to transition into IT and would appreciate some advice from people who have made a similar move.

I have an upcoming interview for a Customer/Hardware Specialist position at a dental imaging company. It's a six-month contract-to-hire role paying $17/hr, onsite, Monday through Friday.

The job involves Level I support calls and emails, troubleshooting hardware and software issues, working with medical imaging equipment, installing equipment, training customers, documenting issues, and escalating problems when needed. My background is in education technology, where I've supported devices, printers, software, and end users, but I haven't worked in a dedicated IT support role.

I'm planning to work toward CompTIA certification and stack others.

My situation is that I have about 2.5 months of unemployment benefits remaining at $584 a week, and I'm currently living with family without paying rent. At $17/hr for 40 hours, the job would pay $680/week before taxes, so the financial difference isn't huge.

I'm trying to decide whether to take an opportunity like this to get actual IT experience while studying for certifications, or use the remaining time to study and look for a remote job paying around the same amount or more.

I think the hands-on experience could help me qualify for better IT jobs down the road. Another concern is that a six-month contract could limit my flexibility if a better opportunity comes along, and working onsite might make it harder to study.

Thanks in advance for any insights you guys have!

EDIT: Hi everyone! Thank you for sharing all your insights. It’s been really helpful!

I just wanted to add a little more context about my situation. I’m 37 and have been working in education for a while, but I’m now looking to transition into IT and build a new career path. My interview is Thursday afternoon, and the commute is pretty short since I’m in the NJ/NYC area.

I asked the recruiter if there was any wiggle room on the pay, but he pretty much said no. He also described it as primarily a customer service role with some technical work mixed in. I’m still going to take the interview and ask what the day-to-day responsibilities might look like over the next few months, especially when it comes to getting hands-on technical experience.

On paper, the job description sounds more technical, so I’m hoping there’s more to it than the recruiter’s description suggests. For now, I’m going into it with an open mind and doing as much preparation as I can. I’m excited about the possibility of getting my foot in the door and building experience, but I also want to make sure the role will help me develop practical IT skills that I can build on in future positions.

Thanks again for all the advice!