The AhsayCBS intrusion Huntress documented on 8 October 2026 included a PowerShell script that stops the miner service when you open Task Manager, restarts it when you close it, and kills Task Manager itself at six in the evening. What the attacker modelled was not the antivirus: it was the working hours of whoever looks. Why interactive checking is not detection, and a ten-minute test to find out whether yours is.
We downloaded Microsoft's official vulnerable driver blocklist on 6 October 2026 and counted the rules: 1,713 blocks, of which 1,702 identify the file by hash and 11 by name. Inside: what Microsoft's own documentation admits its list does not cover, why only 50 of the 218 certificate blocks burn a whole publisher, how many samples in the public catalogue of abusable drivers load anyway with memory integrity on, and the two possible readings of the contrast between 45% and 18%.
On 6 July, two SensePost researchers published a code injection technique and tested it against four market-leading EDRs configured to detect, block and remediate: it worked on all four and no alerts were created. On 22 September, Flashpoint reproduced it. The technique does not write into another process's memory —the path every EDR has watched for a decade— but instead places the payload into the parameters a new process starts with. We read both publications in full, including the part the headlines skipped: in Flashpoint's lab the XDR component DID block, and only stopped once two further evasions were stacked on top; and the authors themselves warn the technique "has multiple opportunities for detection". Also: why this is post-exploitation and not a way in, why the same primitive had already been described publicly before (with no known date), the four checks you can ask your console for this week —and the catch that none of them is a button, but a query over telemetry someone has to have kept and someone has to write—.
CVE-2023-54391 is a 9.8: you get in as root@pam with no password. We queried its record through the NVD API and the GitHub Advisories API, and here is what comes back: NVD publishes no CPE configuration at all and flags the record as Deferred; GitHub returns an empty list of affected packages; and the only range that exists stops at "7.4" while your nodes call themselves 7.4-17. A scanner that decides by version matching has nothing to decide with. Meanwhile a provider published its post mortem: twelve hypervisors mining from 31 August to 17 September, logs wiped and the sentence "we cannot prove it".
On 3 September Microsoft added a sentence to the Defender for Endpoint documentation and by the next day it was gone: it warned that automatic isolation fires as FULL isolation and that, with a web proxy, the device might not recover. The two facts it joined are both still published, but in separate sections. What gets isolated on its own and what does not, what "containing" does and what "isolating" does, and the way back point by point.
On 9 September, Cisco Talos confirmed active exploitation of two flaws in Secure Firewall Management Center, and counted three separate attacker clusters inside the same box. One of them dropped two scripts to harvest the configurations of the managed firewalls. That is the part almost nobody is discussing: credentials rotate, a domain gets restored, and your perimeter configuration does not rotate. It is a description of your network, and it stays valid after the patch.
At DEF CON 34, Akamai showed how to turn a commercial EDR into the attacker's hiding place. The least-reported part is the ending: one line in the hosts file cuts off all telemetry while the agent still shows "SECURE". The signal you watch is controlled by the endpoint; the only one an attacker cannot fabricate is silence in your console. And almost nobody alerts on it.
Tomorrow, 1 September 2026, Microsoft Defender's automated investigation and response stops running as a separate experience and can no longer be triggered by hand. The official documentation says so in a two-paragraph box, and message MC1411577 went up on 2 July: sixty-one days of notice. We go through what actually breaks (the scripts calling startInvestigation), why "run a full scan" does not answer the same question, who this does not affect at all, and the seven-day clock in the Action center you should look at today.
On 4 August an Akira affiliate walked in through an MFA-less SSL VPN in roughly seven minutes and, rather than fight the EDR, rebooted the compromised host into <code>Safe Mode with Networking</code>: the agent and Defender real-time protection stopped starting. We counted the blind window against the timestamps in the Huntress report and it comes to 1 h 41 min, not the 10 minutes that circulated. The encryption did fail, but on virtual memory, not on defences.
In mid-August the Dutch cyber security centre warned that the macOS Screen Sharing flaw is being exploited on Macs with port 5900 open to the internet, and that in every reported case the attacker got root and left a Monero miner behind. Apple had already shipped the patch on 6 August. What exactly breaks in CVE-2026-65400, why classic hardening did not cover this hole, and the list almost no company has: what listens from outside.
Since CISA changed its deadlines on 10 June, 42 of the 48 vulnerabilities it has added come with three days to fix them. We counted the weekdays over the catalog file itself: not a single 2026 entry was published on a Saturday or Sunday, and thirteen of those three-day deadlines expire exactly there. In August, with half the staff away, the bottleneck is who signs off that a server can be isolated at three in the morning.
On 10 August Microsoft published its breakdown of the DeadLock encryptor. The interesting part is not the cryptography: it is the list of things it switches off before encrypting anything. Defender stopped like a service, shadow copies gone, domain controller services halted and — this is the one almost nobody looks at — event log channels not cleared but disabled in the registry.
On 6 August, Huntress published its analysis of a Go-based credential stealer for macOS that had been sitting inside a monitored Mac for three months. There is no CVE, no exploit and nothing to patch: the chain starts with a web page dictating a command and a user pasting it into Terminal. What that command does line by line, why Gatekeeper never gets involved, what it actually takes from a company (Keychain, session cookies, browser passwords) and why the warning Apple added in macOS 26.4 is a speed bump rather than a wall.
On 3 August, Unit 42 published three ways into passkey-protected accounts without breaking a single line of cryptography. The worst of them lifts a 32-byte secret out of Chrome's memory that decrypts every passkey synced to the account — and in Google's current implementation that secret cannot be rotated or revoked. All three start the same way: with malware already running on a Windows machine, with no administrator rights and no privilege escalation. We still recommend passkeys, and this post explains why that is not a contradiction.
On 3 August, CISA added CVE-2026-18577 to its exploited-vulnerabilities catalogue with a deadline of the 6th. It is a flaw in the console many IT providers use to manage their customers' machines, and it arrived as the incomplete patch for another flaw published two days earlier. The vendor found out through a rise in licensing issues, not a security alert. Access was not granted by malware: the attackers used the product's own remote-control feature and left a tunnel behind so they would still be inside after the console was cut off. We are a managed services provider, and this post is about what that means for the people who hire us.
On 27 July, CISA added a FortiOS flaw to its exploited-vulnerabilities catalogue with a deadline attached: 10 August. CVE-2025-68686 opens no new door: it reopens the one Fortinet believed it had closed in April 2025, and it does so with one extra slash in the path. The story of the symbolic link in the language-files folder, the patch that was a string comparison, the 7.2, 7.0 and 6.4 branches left with no fix at all, and why patching is an action while being clean is a conclusion you have to prove.
An organisation receives an average of 2,992 security alerts a day and 63% of them go unaddressed, according to Vectra AI's 2026 count. The interesting part is that the volume has been falling for three years and the unaddressed share has not moved. Filtering harder does not fix it, because the problem was never how many alerts arrive: it is how many arrived with an owner and an action written next to them. How we prune monitoring that shouts, what wakes us at three in the morning, and what waits for the morning report.
In an intrusion at Thailand's Ministry of Finance, the attacker left an open-source AI agent running unattended to automate the boring part of the attack: enumerate, escalate privileges, find the next step. It broke nothing new —it got in through default credentials and unpatched 2021 CVEs— but it did the dirty work faster and without rest. What actually changes is speed, and the only answer to speed is 24/7 detection and response.
To receive IT stories, everyWAN news and exclusive subscriber offers, sign up to our mailing list
Microsoft 365
ES 
CAT 
EN