Microsoft ends desktop detour for sensitivity labels in Office web apps

A collection of security news: Microsoft added user-defined sensitivity label permissions to Office for the web, aligning browser apps with desktop capabilities; OpenSSL 4.0.0 was released removing legacy protocol support and adding Encrypted Client Hello and post-quantum features (with breaking API changes); the UK AISI found Anthropic’s Claude Mythos has improved offensive capabilities but cannot reliably perform autonomous attacks on hardened networks; the FBI and Indonesian authorities dismantled the W3LL phishing kit sold for about $500; DavMail 6.6.0 fixes a regex-related security alert;