Today’s briefing covers three active threats exploiting trusted infrastructure. CISA has added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming in-the-wild exploitation linked to North Korea’s Lazarus Group. The campaign targets government, financial, manufacturing, logistics, and transportation sectors through unauthenticated remote code execution. Arctic Wolf’s analysis of over four hundred incidents documents how Microsoft Teams’ default external chat settings enable sophisticated social engineering attacks, with attackers creating fake IT support tenants to deliver malware or steal credentials. The third story examines the LiteLLM supply chain compromise from 21 October 2026, where a malicious PyPI package distributed stolen-credential payloads through Python startup hooks. All three attacks exploit legitimate systems working as designed rather than traditional vulnerabilities. The episode provides specific configuration guidance for Microsoft 365 Teams external access settings, PHP patching requirements, and credential rotation procedures for organisations potentially affected by the LiteLLM compromise. The common thread is that defence requires active auditing of what is enabled by default, not simply avoiding mistakes.