Cybersecurity Archives - Chicago IT Support & Cyber Security

PHP2Shell: 2 Critical PHP Vulnerabilities Put Millions of Websites on Alert

October 21, 2026 by Edward Silha

THIS IS NOT A DRILL! – If you manage a website running PHP, today would be a very good day to pay attention.

The PHP development team has taken the unusual step of announcing 2 emergency security patches before they’re even available. Both vulnerabilities carry a severity rating of 9.2 out of 10. Security researchers warn that attackers may begin exploiting them almost immediately after the fixes arrive.

The patches are scheduled for Wednesday, October 21, at 9:00 AM Central. However, PHP maintainers could release them earlier if additional technical details leak or they detect active exploitation. [Read more…]

We Finally Got Everyone Using MFA. Now It’s Changing

October 2, 2026 by Edward Silha

For years, the security advice was simple: turn on multifactor authentication.

IT people repeated it endlessly. Microsoft pushed it. Insurance companies started requiring it. Cybersecurity audits looked for it. Eventually, most businesses got the message.

Users learned the routine. Enter the password. Wait for the text message. Type in the 6-digit code. Get back to work.

Now Microsoft is changing all of that. [Read more…]

HalluSquatting Shows Why AI Agents Still Can’t Be Trusted on Their Own

July 8, 2026 by Edward Silha

I’ve said from the beginning that the biggest risk with AI isn’t that it writes bad code. It’s that people are starting to trust it to make decisions it has no business making.

New research drives that point home.

Researchers have uncovered a new attack called HalluSquatting, and it exploits one of AI’s most well-known weaknesses: it would rather make something up than admit it doesn’t know the answer.

That behavior, which we’ve all come to know as hallucination, is no longer just an annoyance. It can now be turned into a weapon.

Here’s how it works. [Read more…]

Hackers Are Now Using Microsoft Teams to Break Into Corporate Networks

May 14, 2026 by Edward Silha

For years, companies drilled one thing into employees’ heads: don’t trust weird emails. Problem is, attackers adapted. Instead of fighting against people’s skepticism around email, they moved to platforms employees already trust without thinking twice about it. One of the biggest targets right now is Microsoft Teams

A threat group called KongTuke has been using Teams chats to get inside corporate networks, and honestly, it’s working disturbingly well. Instead of blasting out phishing emails, they pose as internal IT staff and message employees directly through Teams. Sometimes they’re operating from already-compromised Microsoft 365 accounts. Other times they create fake accounts designed to look close enough to pass a quick glance. Either way, the attack can go from first contact to compromised system in just a few minutes. [Read more…]

Microsoft Eliminates SharePoint Email Passcodes, Forcing Move to Entra Guest Accounts

March 13, 2026 by Edward Silha

Microsoft is retiring the email passcode system long used to grant temporary access to shared files in SharePoint Online and OneDrive for Business. The company plans to replace it with Microsoft Entra B2B guest accounts, shifting external collaboration toward a fully identity-based model across Microsoft 365.

The change affects both commercial and government cloud environments. Beginning in May 2026, new external sharing invitations will start using Entra B2B instead of the existing one-time passcode system. The transition will accelerate through the summer, with the older authentication method beginning its shutdown in July and disappearing completely by the end of August 2026. [Read more…]

Social Media