CISA ran the same attack against two organizations. One of them never responded. On Aug 25 CISA published advisory AA26-237A, titled “A Tale of Two SOCs.” Two red team assessments, run simultaneously with similar tradecraft, against two critical-infrastructure targets. Both ended in domain-level compromise, and in both the team reached sensitive business systems and cloud. Everything after that diverged. Organization B — a water and wastewater entity — caught the phishing payload on each of three workstations, quarantined and reimaged them, and severed command-and-control. CISA’s own framing: because those defenders removed the foothold, the red team had to switch to an assume-breach model to continue. Organization A — government services — did not respond. And here is the part worth sitting with: its SOC did receive alerts. The advisory records medium- and low-severity EDR alerts tied to red team activity that the SOC “did not respond to.” Thousands of false positive alerts from normal business operations, many at higher severity, obscured them. That is not a detection failure. It is a response failure — a different problem, with a much cheaper fix.

One alert was real, and it was closed because nobody could name the server’s owner. Same advisory, and it is the detail I cannot stop thinking about. Red team members observed defenders’ chat about an alert on an SCCM box: they tried to identify who owned that system, what it did, and how it was normally used. They could not. The SOC eventually flagged it a false positive. The detection worked. The alert was true. The asset inventory is what failed. CISA also found Organization A running multiple SOCs and multiple EDR products whose staff neither communicated nor had visibility into each other’s detection tools — and SOC staff and system owners did not communicate either. The advisory’s closing line, verbatim: “Detection tools are only as effective as the people, processes, and procedures supporting them.”

Attackers minted admin tokens, then went shopping — four days after disclosure. On Sep 2 CISA added seven flaws to the Known Exploited Vulnerabilities catalog. Among them CVE-2026-82329, a JFrog Artifactory improper-authentication issue (CVSS 9.8) that under default configuration could allow an unauthenticated attacker with network access to obtain administrative privileges. watchTowr reported in-the-wild exploitation on Sep 1 — roughly four days after disclosure — with attackers minting admin tokens and enumerating users, groups, credential sets and federated access topologies. Two SonicWall SMA 1000 flaws landed in the same batch (CVE-2026-83548, CVSS 10.0, pre-auth SSRF). Patch, obviously. But the question this week asks is the other one: if someone minted a new admin token in your environment tonight, what fires?

THE ALERT COVERAGE REVIEW — ONE AFTERNOON

1  PICK      5 events that must NEVER happen quietly.
              New global admin. Log source goes dark.
              Impossible-travel login. Mass export.
              New mailbox forwarding rule.
2  ASK       three questions, per event:
              Is it LOGGED?  (usually yes)
              Does it ALERT? (now you’re guessing)
              Who RECEIVES it at 2am? (the real one)
3  GENERATE  stop guessing — make the event happen.
              With approval, in a window you control.
4  WATCH     did anything fire? how long? did it reach
              a human, or a channel nobody reads?
5  RECORD    what happened — AND what didn’t. A silent
              event is the most valuable line in the log.

⚠️ Step 3 creates real events in a real environment. Get approval, work inside a change window, and tell the people who would otherwise respond that it is you — then remove what you created and log the removal. The kit is a review format and a starting point, not managed security services, and not legal, compliance, or audit advice. If a test turns up evidence that the event already happened for real, follow your incident-response plan and engage counsel and your insurer per its terms.

“We spend real money on detection tooling and I can tell you it is deployed. What I can’t currently tell you is which specific events would actually reach a human at two in the morning — because we have never made one happen on purpose and watched. I want one afternoon to test five. Best case, I hand you a signed record that our five worst scenarios all alert, with times. Worst case, we find out on our own schedule instead of during an incident — and we fix it before it is the thing we are explaining to a client.”

Pick the honest one, not the aspirational one. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

CISA just added vulnerabilities from 2015. Read that again. In a single batch on Aug 26 the Known Exploited Vulnerabilities catalog picked up CVE-2015-3246 (Red Hat Libuser), CVE-2015-5287 (Red Hat ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE) and CVE-2021-23758 (Ajax.NET Professional deserialization) — alongside a Linux kernel out-of-bounds write and a Citrix NetScaler flaw. Entries land there on evidence of active exploitation, which means someone is still exploiting a bug that turned eleven years old. The catalog doesn’t say why. The likeliest reason isn’t that the bug is clever — it’s that it is still running somewhere, on a box nobody owns, that nobody has logged into on purpose since the person who built it left. That is what decay looks like once it finally lands in the KEV catalog. Federal remediation deadlines: Aug 29 for two of them, Sep 9 for the rest.

“Missing Authentication for Critical Function” — on a print server. CISA added two PaperCut NG/MF flaws on Aug 31: CVE-2026-81578, whose catalog entry is literally Missing Authentication for Critical Function, and CVE-2026-82078, an unsafe reflection bug. Federal remediation due Sep 14. Print management is the archetypal thing an MSP installs once, in year one, and never revisits — it sits inside the network, it is wired into directory and print infrastructure, and it is nobody’s Monday-morning problem. That Sep 14 date binds federal agencies, not you — but if you manage PaperCut for clients it is a reasonable date to hold yourself to, and the question after patching is the one this week is about: who still has an account on it?

A 2023 authentication bug, catalogued in 2026, already past its federal due date.CVE-2023-49105 — ownCloud Improper Authentication — was added Aug 27 with a federal remediation deadline of Aug 30. Three days. The identifier is a 2023 one. The same batch carried a JFrog Artifactory path-traversal flaw (CVE-2026-66384, federal due date Sep 10) and a Linux kernel issue. The pattern across all three items this week is not “patch faster.” The common thread, as I read it, is that these are systems that fell out of somebody’s attention — and access falls out of attention the same way, just more quietly, because an orphaned account never throws an alert.

THE OFFBOARDING REVIEW — ONE AFTERNOON

1  PICK      the last 5 people who left — or 5
              contractors whose engagement ended.
              NOT recent ones. Six months back.
2  HUNT      every identity, not every person: SSO,
              local accounts, shared vault entries,
              API tokens, MFA enrolments, vendor
              portals, client tenants, repos, rules.
3  VERIFY    don’t trust the checklist that says it
              was done. Look at the system.
4  REVOKE    and write down what, from where, on
              what date, checked by whom.
5  FIX FWD   what you found is a gap in the process,
              not in one person’s file. Fix the runbook.

⚠️ The kit is a review format and a starting point — not managed security services, and not legal, compliance, or audit advice. Account and token lifecycle behaviour varies by product and license; verify against your vendor’s current documentation before relying on it. If a review turns up evidence of unauthorised access, follow your incident-response plan and engage counsel and your insurer per its terms.

“We’re good at closing accounts the week someone leaves. What I don’t have is proof of what is still open six months later — the shared logins, the API tokens, the vendor portals nobody thinks of as accounts. I want one afternoon to pull the last five departures and check every system against them. Best case, I hand you a signed record that access is clean. Worst case, we find a door somebody left open in March and close it on our schedule — before it becomes the thing we explain to a client.”

Pick the honest one, not the aspirational one. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

Four new KEV entries — and the theme is the front door. CISA added four actively exploited flaws to the KEV catalog Aug 18, and two are authentication failures outright: CVE-2026-65400 (CVSS 9.8) lets a network attacker reach macOS Screen Sharing without valid credentials, and CVE-2026-55040 (CVSS 9.1) is a weak-authentication bypass in SharePoint that came under attack after a public PoC dropped. The other two are no gentler: a vCenter path traversal (CVE-2026-59310) a suspected China-nexus actor is using for persistent access — with at least one case ending in Babuk-derived ransomware in public reporting — and a Microsoft IKE flaw (CVE-2026-33824). Federal agencies had until Aug 21 to patch. If your cycle missed that window, that’s the sign — and per last week’s rule: verify on the host, against the current advisory.

1.6 million reasons your help desk is a login. After RingCentral declined to pay, the ShinyHunters extortion crew dumped data reportedly covering ~1.6 million accounts — four fields per record: name, email, physical address, phone. The company says the core platform wasn’t touched; the intrusion started as social engineering, and that’s the lesson: those four fields are exactly what makes the next phone call to your help desk sound legitimate. A password reset flow is an internet-reachable login — it just answers to a human. If your verification procedure is “sounded like the user,” this dump is aimed at you.

Ransomware infrastructure you can’t take down. Microsoft published a breakdown of DeadLock, a Rust-based ransomware operation that resolves its victim-chat proxy from a Polygon smart contract, runs victim comms over the encrypted Session network, and parks stolen data on commodity cloud storage — roughly 80 victims listed by July, most of them European. Blocklists and domain takedowns don’t reach a blockchain. The defender takeaway is unglamorous: the parts you control — identity, egress, tested restores — matter more as criminal infrastructure gets harder to disrupt, not less.

THE LOGIN-SURFACE REVIEW — ONE AFTERNOON

1  ENUMERATE  every internet-reachable login
              (the worksheet has 12 categories)
2  TEST       what each door actually accepts:
              password alone? legacy protocol that
              skips MFA? vendor accounts still alive?
3  MATRIX     where is MFA enforced — ON the door,
              upstream at the IdP, or nowhere?
4  HUMANS     the reset flow is a door: what does
              your help desk require before handing
              over access?
5  LOG IT     doors counted · gaps found ·
              owner · date

⚠️ The kit is a review format and a starting point — not managed security services, and not legal, compliance, or audit advice. Authentication capabilities vary by product and license; verify against your vendor’s current documentation. If a review turns up evidence of compromise, follow your incident-response plan and engage counsel and your insurer per its terms.

“Every breach story this month has the same shape: nobody broke anything — they signed in. I want one afternoon to count every place on the internet that accepts a password for us, check what each one actually requires, and close the paths that skip our MFA. Best case, we write down proof that the doors are counted and locked. Worst case, we find a door nobody was watching — on our schedule instead of theirs.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

The RMM auth bypass is a rerun — and that’s the lesson. CISA added CVE-2026-18577 (CVSS 8.2) — an authentication bypass in N-able N-central — to the KEV catalog Aug 3. It exists because the patch for CVE-2026-18556 was incomplete; attackers moved to the reopened path. Huntress observed one partner account abused to reach nine downstream organizations via the built-in Take Control feature, with tunnels left behind for persistence. N-able has since shipped follow-on hotfixes — so “we patched” needs a version check on the host, against the current advisory, not the one you read two weeks ago.

A worm ate the npm registry’s caching aisle. The self-propagating “ChainDrop” campaign compromised the maintainer account behind keyv/cacheable and poisoned 444 packages (2,212 versions) in under four hours — packages with roughly 2 billion combined monthly downloads. The payload steals npm tokens, cloud credentials and CI/CD secrets via a preinstall hook, then republishes itself; C2 resolves from an Ethereum smart contract, which walks straight past domain blocklists. If your team ran npm installs in the affected window: rotate everything, then check what else those credentials could reach.

Patch Tuesday, plus the one already being used. Microsoft’s August drop fixed 421 CVEs, including CVE-2026-68820 — a use-after-free in the WinSock ancillary function driver exploited as a zero-day for privilege escalation. Priority order writes itself: the exploited one first, then internet-facing, then everything else. And per this week’s theme: verify the fix landed on the host, not just that the deployment job reported green.

FIVE QUESTIONS THAT OUTRANK ANY RMM FEATURE COMPARISON

1  Does the console share an identity system with your
   domain — so one takeover becomes two?
2  Is MFA enforced ON THE CONSOLE — not just on the
   technician's email account?
3  Can any tech open remote control on any endpoint at
   any hour — or is it scoped and scheduled?
4  Does the management server have unrestricted outbound
   access? (Could it quietly tunnel to anywhere?)
5  Is there ONE session record an admin of that same
   server cannot edit?

⚠️ The kit is a review format and a starting point — not managed security services, and not legal, compliance, or audit advice. Vendor advisories change; verify version guidance against the current advisory before acting. If you find evidence of compromise, follow your incident-response plan and engage counsel and your insurer per its terms.

“One tool in our stack can reach every machine we manage — that’s what it’s for. This week a widely used tool in that category was exploited, and the attacker didn’t need malware; they used the product’s own remote-control feature. I want two hours to answer five architecture questions about ours, verify our patch level on the server itself, and pull ninety days of remote-session history. Best case, we write down proof that we’re clean. Worst case, we find out on our schedule instead of theirs.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

Your RMM has two KEV entries this week. CISA added CVE-2026-18556 — an authentication bypass in N-able N-central (CVSS 8.2) — to the Known Exploited Vulnerabilities catalog, days after its sibling CVE-2026-18577 landed there too. The pair exists because the first fix was incomplete, and both are being exploited in the wild. N-central is the console that touches every endpoint an MSP manages, which makes “patch, then check who’s been in the console” the whole assignment. Federal agencies got until Aug 7; treat your own deadline as similar.

The backup server as another room on the sinking ship. Veeam’s advisory for CVE-2026-44963 covers a critical RCE on domain-joined Backup & Replication servers — any authenticated domain user, CVSS v4 9.4 — and it’s back in the analysis cycle this week for the architectural lesson: if a stolen domain account can execute code on the vault, the backup system isn’t a lifeboat, it’s another room on the sinking ship. Ransomware crews have told reporters for years that backup servers are their first stop. Patch it — then ask the better question: why is the vault a domain member at all? (That question is this week’s whole issue.)

The AI agent picked its own targets. Unit 42 documented a campaign where a threat actor let DeepSeek — driving the same Hermes agent framework from Issue #5 — select and narrow targets autonomously across 460+ exploitation attempts, and when one path failed, the agent researched alternatives on its own. Machine-speed attacks were why Issue #5 rehearsed the response; they’re also why recovery can’t be a theory. The attacker’s playbook is automated. Your restore had better be rehearsed.

THE 45-MINUTE RESTORE TEST
(roles: an operator + a scribe. That's the team.)

0:00  Pick the target BEFORE you feel ready: one production
      system that would hurt Monday morning — file server,
      finance share, the PSA/RMM database.
0:05  Restore last night's copy to an ISOLATED target: spare
      VM, empty VLAN, cloud sandbox. NEVER over production.
      No egress needed.
0:35  Verify like a USER, not an admin: open three files,
      run one report, log in with a real (non-admin) account.
      "It boots" is not "it works."
0:40  Write four numbers: minutes to restore · GB restored
      · items verified · today's date. Scribe signs the
      page. That page is the deliverable.

⚠️ The restore test is an exercise format, not professional disaster-recovery services — and not legal, compliance, or audit advice. Restore to an ISOLATED target only — never over production. In a REAL incident, follow your plan and engage counsel and your insurer per its terms.

“I want forty-five minutes and a spare machine. We restore one system from last night’s backup and time it with a stopwatch. If it works, we walk out with our real recovery number — the one the insurance form keeps asking for. If it doesn’t work, we just found that out on a Tuesday afternoon instead of during an incident. Either way we stop hoping and start knowing.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

Clop is working through PTC Windchill + FlexPLM. A new data-theft campaign hits internet-exposed instances of the product-lifecycle platforms used across aerospace, automotive, manufacturing, and retail — chaining a pre-auth RCE (CVE-2026-12569, CVSS 9.3, patched since mid-June) to drop JSP webshells under /Windchill/login/. CISA put it on the KEV list and gave federal agencies three days — that tells you the urgency read. Run either product? Patch, then hunt for hex-named .jsp files (per Ransom-ISAC) — patching doesn’t evict a shell that’s already planted.

Another AI agent ran an intrusion. Hunt.io researchers found exposed operator logs showing the open-source Hermes agent in unattended “YOLO mode” — automating reconnaissance, credential theft, privilege escalation, and lateral movement in an alleged compromise of Thailand’s Ministry of Finance. Issue #1’s AI-run ransomware wasn’t a one-off; the tooling is now off-the-shelf. Machine-speed attacks are exactly why this issue is a rehearsal: your response can’t be slower than their playbook.

KEV alert: your firewall MANAGER has a built-in password. CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog Jul 29 — a hard-coded credential in Cisco Secure Firewall Management Center lets an unauthenticated attacker simply log in (CVSS 8.9, actively exploited). FMC sees your firewall rules, VPN configs, and device inventory — recon heaven. Patch, then audit local accounts and recent logins on the management plane while you’re in there.

THE 60-MINUTE TABLETOP
(roles: facilitator, note-taker, everyone else plays themselves)

0:00  Ground rules: no blame, no heroics,
      answers must name a PERSON and a PLACE
0:05  Inject 1 — "EDR alerts on 3 machines. Encryption in
      progress. It's 2 AM Saturday." → Who gets the alert?
      Who wakes whom? Where's the call tree?
0:20  Inject 2 — "It spread. Backups console unreachable.
      Biggest client calls." → Isolate how? Who talks to
      the client? Who CAN'T we reach (PTO test)?
0:35  Inject 3 — "Vendor says 72h to restore. Insurer wants
      the timeline. A reporter emails." → Who invokes
      insurance? Who's authorized to speak?
0:50  Debrief: 3 gaps → 3 owners → 3 dates.
      That's the whole output.

⚠️ The tabletop is an exercise format, not professional incident response services — and not legal, compliance, or audit advice. In a REAL incident, follow your IR plan and engage counsel and your insurer per its terms.

“I want to run a one-hour exercise: we pretend it’s a bad Saturday and walk through who does what. No consultants, no downtime — one conference room. Last time an org like ours skipped this, they discovered mid-incident that the person with the backup passwords was on a cruise. The exercise costs an hour and finds those surprises while they’re funny instead of expensive. I’ll bring back three gaps, three owners, three dates.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

The KEV list grew again yesterday. CISA added two actively exploited bugs Monday: an information-exposure flaw in Fortinet FortiOS (CVE-2025-68686) and an OS command injection in Arista’s VeloCloud Orchestrator (CVE-2026-16812). Both sit at the network edge you — or your MSP — manage. A KEV listing means exploitation is confirmed in the wild: treat the patch as scheduled, not optional.

One vendor, ~58% of the year’s breach notices. ITRC’s H1 2026 report counts 471 million breach notices from 1,029 compromises — and roughly 275 million of them trace to a single supply-chain breach: Instructure’s Canvas. Supply-chain attacks overall: 38 incidents touching 206 organizations in six months. The math is the message — your riskiest system may be somebody else’s.

The Canvas cleanup lands this week. Instructure is running incident webcasts for institutional customers July 29–31 and still updating its incident pages. If Canvas sits anywhere in your stack — or a client’s — that calendar slot is your evidence-gathering window. Show up holding the three questions below.

Last week’s poll — do you bill compliance separately? — is still open; votes keep steering the playbooks.

For EVERY vendor that touches client data:
1 — WHAT DO THEY HOLD?     data classes: PII / PHI / PCI / creds / backups
2 — WHAT DID WE AGREE?     security terms in the contract: breach notice
                            window, MFA/encryption commitments, sub-processors
3 — HOW WOULD WE KNOW?     their status page? our log visibility? or…
                            we’d find out from the news?

Scoring is brutal on purpose:
🟢 = answered from a document, in under a minute
🟡 = answered from memory (“pretty sure it’s in the MSA…”)
🔴 = can’t answer / the answer is “the news”

“When a vendor holding our data gets breached, our customers don’t experience it as the vendor’s breach — they experience it as ours. Same phone calls, same trust damage, same regulator questions. So I track three things for every vendor that touches our data: what they hold, what they’ve committed to in writing, and how we’d find out if they failed. Right now we can fully answer that for [X] of [Y] vendors. Closing the gap costs contract-review time, not new software. I’d rather buy that time now than explain the gap during an incident.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.

🔴 On-prem SharePoint is back on fire. CISA added CVE-2026-45659 (RCE, CVSS 8.8) to the Known Exploited Vulnerabilities catalog after confirmed active exploitation — a bug Microsoft patched back in May. The farms getting hit are the ones that never applied it. A year after the ToolShell/Warlock ransomware mess, “prove your patch posture” stopped being a nag and became a billable sentence.

🟠 The KEV catalog filled all week. Between Jul 14–15 CISA added actively-exploited flaws in Oracle E-Business Suite (CVE-2026-46817), SonicWall SMA1000, and Microsoft AD FS. If you can’t tell a client “here’s whether any of these touch you” inside ten minutes, that ten-minute gap is the quarterly review’s whole value.

📋 New federal marching orders — a preview of your clients’ next questionnaire. CISA’s BOD 26-04, “Prioritizing Security Updates Based on Risk,” is binding on federal agencies only, but it’s the template insurers and enterprise buyers copy: risk-ranked, time-bound patching with dated evidence. Packaging exactly that is this week’s entire point.

THE QUARTERLY COMPLIANCE REVIEW
(per client, ~half a day once systemized)

[ ] Patch posture  - criticals within SLA?  Evidence: dated trail (you have this)
[ ] Access review  - admins verified, leavers gone.  Evidence: signed export
[ ] Backup         - ONE restore test, dated + logged
[ ] MFA coverage   - export red rows; delta vs last quarter
[ ] Vendor delta   - new tools/vendors since last quarter (incl. AI, see GB004)
[ ] Risk convo     - top 3 risks in CEO language, 30 minutes
[ ] Deliverable    - 2-page report: checked / changed / next

“Three times this year you’ve been asked to prove your security posture — the insurance renewal, a big customer’s questionnaire, and the audit. Each one turned into a two-week scramble. What I’m proposing is simple: once a quarter, we run the checks, fix what drifted, and hand you a two-page report. When the next questionnaire lands, the answers already exist. Fixed monthly fee, no surprise hours. You stop buying fire drills and start owning receipts.”

One tap — anonymous, aggregated, and it shapes the next round of playbooks.