Microsoft says attackers are exploiting SharePoint flaw CVE-2026-65660, roughly six weeks after it shipped a fix in August. Any server still missing that update should be treated as possibly compromised, checked for webshells and patched.
Perspective Coverage
4 publishers
- Builder
- Builder 21%
- Operator
- Operator 79%
- Investor
- Investor 0%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence70
CISA listed WSO2's maximum-severity JWT bypass, CVE-2026-5430, as exploited, with a September 27 federal fix deadline. The public evidence so far is forged-token attempts from one IP against the wrong WSO2 product, a thinner record than Sansec's sighting of live Magento attacks.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 65%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption25
- Hype gap+35
- Incentives40
- Confidence55
Warlock, the group Microsoft tracks as Storm-2603, hit four organizations in Spanish- or Portuguese-speaking countries in two months, Symantec says. It works like the Chinese state groups it first appeared beside and extorts like a ransomware crew.
Perspective Coverage
6 publishers
- Builder
- Builder 32%
- Operator
- Operator 59%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence68
Warlock ransomware operators keep breaking in through unpatched SharePoint, Symantec reports
China-linked Warlock operators hit at least four organisations through SharePoint flaws in two months, Symantec says. Its report lists six 2026 SharePoint CVEs only as possible additions, and the entry it documents is still older flaws on servers never patched or mitigated.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence55
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
- Evidence72
- Adoption40
- Hype gap+5
- Incentives45
- Confidence70
Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.
Perspective Coverage
3 publishers
- Builder
- Builder 17%
- Operator
- Operator 75%
- Investor
- Investor 8%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher ZoomEye's fingerprint for Cisco's exploited FMC bypass returned zero hosts
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
- Evidence45
- Adoption55
- Hype gap+10
- Incentives70
- Confidence50
N0va captures refresh tokens from sign-ins the identity provider itself approved
ANY.RUN says the kit lures staff with Teams, DocuSign and Dropbox pages, walks them through a genuine device code sign-in, and then takes the access and refresh tokens to register a device of its own.
Reality
- Evidence25
- Adoption20
- Hype gap+45
- Incentives85
- Confidence60
Fake helpdesk calls use the passkey rollout as the pretext for Microsoft 365 intrusions
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
- Evidence55
- Adoption35
- Hype gap−5
- Incentives60
- Confidence58
buildOne report1 publisher A passkey 'upgrade' call ends with the attacker's phone number registered as an MFA method
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives55
- Confidence55
Syskit's 327-respondent survey puts Copilot rollouts 33 points ahead of permissions reviews
Syskit's September 10 governance report has 76% of UK and US organizations running or piloting Copilot on Microsoft 365 data and 43% reviewing permissions and oversharing before switching it on. The findings are self-reported.
Reality
- Evidence34
- Adoption50
- Hype gap+25
- Incentives78
- Confidence48
August's 398-CVE Patch Tuesday moves the bottleneck to the test bench
Only one of the 398 CVEs Microsoft fixed in August was confirmed exploited, and the SharePoint chain now hitting servers turns on a July patch, which puts exposure on cycle lag rather than on ranking.
Reality
- Evidence33
- Adoption44
- Hype gap+16
- Incentives56
- Confidence38
Parallels ships OpenGL 4.3 on Apple silicon, and the fleet question moves to which chip you own
Parallels Desktop 27 puts a Metal-based driver behind Windows VMs, but the numbers it quotes are scoped to M3 and M4 Macs. The compatibility win is real; the throughput win is conditional.
Reality
- Evidence30
- Adoption22
- Hype gap+38
- Incentives72
- Confidence34
Microsoft puts AI agents in Entra, which makes agent sprawl an identity team problem
Agent 365 pushes agents into the same registry, access policies and e-discovery used for staff. That moves the governance work onto teams you already fund.
Reality
- Evidence26
- Adoption
- Not scored
- Hype gap+46
- Incentives92
- Confidence38
One console, two businesses: Broadcom says Jewelbug runs espionage and crypto fraud together
Broadcom's Threat Hunter Team says the same small team, the same infrastructure and one control panel serve both Chinese state espionage and a crypto-fraud sideline. Actor-type triage does not survive that.
Reality
- Evidence58
- Adoption68
- Hype gap+12
- Incentives62
- Confidence55
SharePoint flaw went from PoC to honeypot hits in a day, and Microsoft's advisory is still silent
CVE-2026-55040 was patched in July. Rapid7 published the technical details and a script on August 11, and Defused says its honeypots logged exploitation on August 12.
Reality
- Evidence58
- Adoption34
- Hype gap+12
- Incentives62
- Confidence57