IT Advisory: October 2026 - PHP Exploit
Currently, there are serious PHP security vulnerabilities affecting technology systems.
If affected systems are not updated, a cybercriminal may gain unauthorized access to websites, network equipment, security systems, or other internet-connected devices.
Cybercriminals target organizations that delay software and firmware updates. Parishes and schools rely on technology to support ministry, communications, education, administration, and stewardship. Keeping technology systems updated is one of the most effective ways to protect parishioner information and maintain reliable operations.
- Staff Advisory: Cyberseturity Alert 202610 - Staff
- Technical Staff Advisory: Technical Staff Advisory Cyberseturity Alert 202610 - Staff Technical
- Network Equipment Inventory: Cyberseturity Alert - Network Equipment Inventory Advisory for Parishes and Schools
- Network Equipment Inventory Spreadsheet: Technical Inventory Template
- Lock Down devices: Cybersecurity Alert - Lock Down Access
IT Advisory: Important Microsoft 365 Multi-Factor Authentication (MFA) Changes Coming in 2027
Audience: Parish and School Leadership, Business Managers, ParishStaq Administrators, Microsoft 365 Users
Action Required: Review and prepare for authentication changes before February 1, 2027
- MFA Changes Coming in 2027: Cyberseturity Alert - (MFA) Changes Coming in 2027
Microsoft Is Retiring SMS(Text Message) and Voice MFA
Microsoft has announced that it will retire its built-in SMS (text message) and voice-call multi-factor authentication (MFA) service for Microsoft 365 and Microsoft Entra ID users. Beginning February 1, 2027, users who rely on receiving authentication codes by text message or automated phone calls will no longer be able to use those methods unless an alternate telephony solution has been implemented. [learn.microsoft.com], [learn.microsoft.com]
As part of this transition, Microsoft is moving organizations toward phishing-resistant authentication methods, including passkeys, Microsoft Authenticator, Windows Hello for Business, and FIDO2 security keys. [learn.microsoft.com], [learn.microsoft.com]
IT Advisory: Changes to External Sharing in OneDrive and SharePoint
Audience: Parish and School Staff
Applies to: Parish and school SharePoint sites outside the Chancery environment, and legacy OneDrive accounts
What Is Changing
Microsoft has changed how people outside your organization sign in to view files shared from SharePoint and OneDrive. The old SharePoint sign-in has been replaced by Microsoft Entra B2B, which is Microsoft's standard guest account system. Microsoft applies this change automatically, and it cannot be turned off.
The Chancery environment already uses Entra B2B, so Chancery-hosted sites are not affected. This advisory covers parish and school SharePoint sites outside the Chancery environment and legacy OneDrive accounts.
External users still sign in with a one-time passcode sent to their email address. Their sign-in experience stays mostly the same.
Who Is Affected
This affects external contacts, such as vendors, volunteers, contractors, and other organizations, who received files from a parish or school site or a legacy OneDrive account under the old method. Since July 2026, these contacts may see an "Access Denied" message when they open a file that was shared with them before the change.
The change does not affect:
- Staff accessing their own organization's files
- External contacts who already have a guest account
- "Anyone with the link" sharing links
- Sites hosted in the Chancery environment
What You Need to Do
If an outside contact tells you they can no longer open a file you shared:
- Share the file or folder with them again from SharePoint or OneDrive, using their email address.
- This creates their guest account automatically. After that, they regain access to everything previously shared with them from that site or account, not just that one file.
You do not need to reshare files with contacts who can still open them.