IT Daily Roundup – October 1, 2026
1. Microsoft Retires Exchange Web Services Today: What May Stop Working in Your Business
Exchange Web Services (EWS) is the API that thousands of business applications have used for over a decade to access Microsoft Exchange mailboxes — calendars, contacts, emails. From October 1, 2026, Microsoft begins blocking EWS requests from third-party applications for Exchange Online. Microsoft's own products (Outlook, Teams) are unaffected — the issue arises with external tool integrations: M365 backup solutions, CRM integrations, email management apps, automations built on the EWS SDK, and other software written before the modern Graph API era. Microsoft announced this change well in advance and recommends migrating to Microsoft Graph API, which provides the same capabilities with a more modern and secure architecture. Security patches for EWS will continue, but no new features will be added.
Why this matters: For most SME businesses using standard M365 with Outlook and Teams, nothing changes today. The risk lies with businesses where an IT partner or software vendor set up an integration between their M365 mailbox and another system (CRM, backup, automated reports) using the older EWS interface. Such integrations may stop working today without warning. Recommended action: check with your IT partner or M365 administrator whether any of your integrations use EWS. If so, migration to the Microsoft Graph API is required — and if a software vendor is still on EWS, now is the time to ask why.
2. Windows Server 2022 Loses Mainstream Support in 12 Days: What This Means for Your Server
On October 13, 2026, Microsoft will end mainstream support for Windows Server 2022. For most administrators, this is a subtle but important change: the server continues to receive security patches (extended support runs until October 2031), but Microsoft is ending development of new features and free access to technical support. For Azure-hosted servers, Hotpatching remains available for one additional year until October 2027. Microsoft recommends transitioning to Windows Server 2025, which has mainstream support through November 2029 and extended support through 2034 — a free 180-day trial is available through Microsoft's Evaluation Center for testing.
Why this matters: For businesses still running on-premises servers with Windows Server 2022, this is a clear reminder that the planning window for upgrading to a new version is open now — not in five years. While extended support (security patches) continues for a long time, the end of mainstream support is the standard signal to start an upgrade project. In practice, this means: if your IT partner or internal administrator doesn't yet have a concrete server upgrade plan, now is a good time for that conversation. A server upgrade is a months-long project, not a days-long one — the earlier it's planned, the less stress and lower risk of downtime during the actual migration.
3. October 2026: Cybersecurity Awareness Month Focuses on AI Threats and Resilience
October is traditionally Cybersecurity Awareness Month — a global initiative coordinated by the US Cybersecurity and Infrastructure Security Agency (CISA) to raise digital security awareness. This year, the initiative carries a new emphasis: according to the Verizon 2026 Data Breach Investigations Report, ransomware appeared in 48% of all breaches, and software vulnerability exploitation caused 31% of incidents. AI tools are compressing the time from vulnerability discovery to exploitation from weeks to hours. Supply chain attack risks through third-party vendors are also rising, as is the "harvest now, decrypt later" threat for organizations handling sensitive data. Experts are calling for a shift from passive awareness to active, continuous cyber resilience.
← All postsWhy this matters: For an SME business in 2026, a "change your password once a year" campaign is no longer enough. Real resilience means combining basic hygiene (MFA everywhere, regular patching, tested backups) with active detection (log monitoring, EDR with anomaly detection). Every October is a good opportunity for a quick security audit: is MFA enabled on all M365 accounts? Are backups regularly tested? Is someone responsible for monitoring security alerts? If you don't know the answer to any of these questions, that's exactly the type of work your IT partner can help set up — and the type that can save thousands of euros in the event of an incident.