The Watch

Triage by exploitability, not headline volume. This ledger leaves no other option. The SonicWall SMA1000 flaw is the sharpest: an unauthenticated, internet-facing SSRF scored CVSS 10, confirmed in multiple incidents, with no workaround but the hotfix. SonicWall published log-based IOCs. Watch for unexpected requests to /__api__/login and /wsproxy. That lets you tell whether you were breached before patching. Assume breach. Hunt first.

The two Microsoft zero-days matter for where they live. CVE-2026-56155 (AD FS) sits on the federated-identity layer. Treat active exploitation as a possible Golden SAML token-forgery event and review token-issuance logs for the prior two weeks after applying the KB. CVE-2026-56164 (SharePoint Server) is a network-reachable auth bypass. Hunt for webshells and anomalous file access. Both landed inside a record 622-CVE release. A working PoC, LegacyHive, for a User Profile Service EoP dropped within hours of the patch. The monthly-cadence assumption is dead.

ServiceNow rounds out the fires. CVE-2026-6875 abuses GlideRecord query filters to escape the Rhino sandbox and run unsandboxed code. Mitigated within 24 hours. That stops future exploitation and nothing else. Confirm your instance received the Guarded Script and retro-hunt for prior pre-auth GlideRecord activity, new admin accounts, and commands on connected proxy servers.

Patch SonicWall first and the two exploited Microsoft zero-days next — the other 620 CVEs can wait for your KEV feed.

The number that matters is not the CVE count. It's the clock. Cato Networks wrapped GPT-5.5 in a custom harness that ran a full attack chain to domain administrator in 40 minutes. Tenable, Proofpoint, and SpecterOps have built model-agnostic harnesses that swap the underlying LLM and hold results steady. The capability lives in the harness, in operational context and system integration, not the model. AI-speed attacks are now portable and commoditizing. An hourly SOC rhythm does not survive a 40-minute time-to-DA.

The same efficiency explains the 622-CVE flood. June's prior record was 206. Researchers attribute the 3x spike to AI bug-finding tooling, not a real surge in risk. That puts Microsoft on pace for 2,000–3,000 CVEs this year against 2020's record of 1,245. Hand-triaging by CVSS is finished. Automate against CISA KEV and EPSS so genuine zero-days surface above the noise.

Crypto is the leading indicator. Immunefi logged a record 207 DeFi incidents in H1 2026 while aggregate losses fell below $1B, down more than 50% year over year. This is a bifurcated economy. Well-resourced targets deploy AI-hardening. Attackers use GLM 5.2/GPT 5.6-class tooling to carpet-bomb the long tail. The pattern generalizes past crypto. LLM tooling collapses the cost of recon and exploit generation. That makes a forgotten subsidiary app, an orphaned integration, or an unmaintained service worth attacking at machine speed.

Defenders who monitor only crown jewels are defending the wrong perimeter. The economics inverted the risk model. The weakest, least-watched asset is now the most probable entry point. Detection tuned for human-paced recon will miss the campaign.

When an AI harness reaches domain admin in 40 minutes, exploitation evidence is the only triage key that still matters. Vulnerability volume is not.

The mechanism worth watching in Forg365 is persistence, not delivery. Device-code phishing abuses a legitimate OAuth flow. The victim authenticates on a genuine Microsoft page, so there's no lookalike domain for URL filters to catch. Once tokens are captured, attacker-side session refresh keeps the adversary authenticated indefinitely. A password reset evicts nobody. It's sold as-a-service over Telegram with AI-generated lures. That commoditizes full M365 tenant takeover, which puts it a step past a one-off exploit.

The containment runbook is the gap. On takeover you have to revoke refresh tokens, force global sign-out, invalidate all sessions, and rotate every credential the account touched. Then verify no new tokens mint. Highest-value prevention is an Entra Conditional Access policy blocking the device-code flow for populations that don't need it. Run report-only first to confirm no legitimate onboarding breaks.

Microsoft is pushing the same direction from the platform side, with dates attached. Entra ID makes passkeys the default on September 1, 2026, auto-prompts SMS/voice users to enroll at next MFA, and retires Microsoft-provided SMS/voice MFA entirely on February 1, 2027. Continued SMS then requires paid telecom partners via the Microsoft Security Store. SMS OTP is phishable and SIM-swappable, so the hygiene is net-positive. It will also silently break any workflow secretly dependent on SMS, including service accounts and break-glass paths.

Treat the two dates as one project. Inventory every SMS/voice dependency and decide the paid telecom fallback before the September default flip, not the February cliff. The migration surfaces exactly the undocumented automation and recovery paths an attacker would look for first.

A password reset no longer evicts a phished M365 attacker — without device-code auth disabled and session revocation forced, breached accounts stay breached.

Iranian retaliation follows US escalation on a predictable lag. After the 2020 Soleimani strike, CISA issued Shields-Up warnings. Iranian actors ran the Ababil DDoS campaign against US banks in 2012–13. CyberAv3ngers hit exposed water-utility PLCs in 2023. The current trigger is a seven-hour overnight strike on Iranian missile, drone, and coastal-defense sites, plus a reimposed naval blockade near the Strait of Hormuz. The prior ceasefire is broken. Brent is back above $85.

The expected pattern is the Iranian-nexus playbook, not novel zero-days. Opportunistic, high-volume tactics against exposure. The likely TTPs map cleanly to monitoring:

Financial services, energy, and internet-facing OT are the historical target set. Defenders in those sectors typically move pre-incident: loading Iran-nexus IOCs, deploying detections for password spraying and public-facing-app exploitation, validating DDoS scrubbing capacity, and hunting exposed HMIs/PLCs with default credentials. The market signal is noise. CrowdStrike (+12%) and Okta (+11%) rallied on CPI-driven risk-on sentiment. The escalation is the actual indicator.

US strikes on Iran are a reliable leading indicator of cyber retaliation against banks, energy, and exposed OT. The window to prepare closes when the first DDoS lands, not before.