The Watch

Read the two items as one chain

Sequenced, the vulnerability and the research release form one intrusion path with no gap in the middle. Initial access needs no credentials: the SharePoint bypass, or the Zoom zero-click RCE that CSO First Look reports compromising meeting participants with no user interaction. Escalation is free. The public Nightmare Eclipse proof-of-concept turns any access into SYSTEM on a fully patched host.

One researcher built that zero-click RCE in under 24 hours, using fewer than 20 prompts against publicly available models, not frontier ones. Microsoft's own AI security lead priced flaw discovery plus targeted exploit generation at $3.61 and 21 minutes. A vendor arguing for a defensive rethink while three of its own products fail across these reports. Discount the messenger, keep the number as an emergency-patch SLA input.

Patching SharePoint stops tomorrow's attacker, not yesterday's

Prior SharePoint mass-exploitation ran one chain: bypass authentication, drop a webshell under the _layouts path, steal the server's cryptographic MachineKeys, forge authentication tokens that outlive the patch. Pattern-matched from prior incidents, not detail confirmed in the available reporting. Assume a foothold predates the patch window and hunt for it: anonymous HTTP 200 responses on endpoints requiring authentication, w3wp.exe spawning cmd.exe or powershell.exe, unexpected .aspx writes under _layouts, ViewState or MachineKey anomalies. Rotate MachineKeys where an indicator surfaces.

Where the reporting stops

Affected SharePoint build numbers are unpublished, and the Windows CVE identifier behind the patched escalation flaw is absent from both accounts. Severities and patch counts are as-reported, most without CVSS scores. Scope from Microsoft's August advisory and the CISA KEV catalog.

The sensor is the pivot

The Defender bypass hits the privilege model, not the patch queue. Least privilege stops being a boundary for contractor endpoints, service accounts and developer laptops once any access reaches SYSTEM with public code. The escalation runs through the endpoint agent, so the sensor is what gets abused. Defender as sole telemetry on Tier-0 hosts is a monoculture failure mode, and the researcher's documented feud with Microsoft points to more uncoordinated drops.

Across 338 million attack simulations cited by The Hacker News, controls blocked 69% of attacks and stopped an already-inside attacker 37% of the time. Phishing links were clicked a median 21 seconds after open. Both datasets are vendor-sponsored and methodologically unvalidated; reproduce them against internal telemetry first. The marginal dollar belongs in eviction and lateral-movement detection, not another preventive layer.

Patching SharePoint closes tomorrow's door. Only hunting removes yesterday's intruder. The escalation behind that door has no fix to deploy.

Why the retro-hunt outranks the block

Pushing 158.220.87[.]79 to WAF, CDN and egress enforcement takes minutes and buys days at most. Hosting infrastructure rotates. The durable work is backward-looking. Ninety days of proxy and CDN logs, Salesforce Event Monitoring and ServiceNow transaction logs will establish whether records already left. That is the first question a customer asks, and the one an auditor will ask in writing. A common finding at this stage is that Event Monitoring was never licensed or enabled on the relevant org. That is itself the thing to escalate.

The technique with no signature

Aura action-endpoint enumeration has been public tradecraft for years, and some SSPM and WAF vendors ship coverage for it. TLDR IT reports the second technique, an LWR UI-API path, as previously undocumented. Detection coverage across SSPM, CASB and WAF is therefore close to zero today, while every dashboard stays green. The ServiceNow half is not a coverage gap but a conceptual failure: portal search is an egress channel, and almost nobody baselines query velocity from unauthenticated sessions. Velocity and anomaly detections on record-fetch and search volume, per unauthenticated session and per source IP, are the gap-filler, and they need purple-teaming before anyone trusts them. A detection that has never fired is a hypothesis, not a control.

The reason this exposure persists

Object-level CRUD permissions, along with guest user sharing rules and org-wide defaults, belong to Salesforce and ServiceNow platform administrators, who usually report somewhere other than security. A vulnerability program has no object to scan here, and a patch SLA has nothing to measure. That is why guest portals launched years ago by a business unit survive unreviewed. The defaults worth collapsing: guest org-wide access set to private, no guest record ownership, and guest read explicitly removed on Contact, Case, Account and custom PII objects. The same pass applies to ServiceNow public page and widget ACLs.

Attribution discipline

The reporting characterizes the operator as advanced and names no group. The TTP profile is API-layer record enumeration and bulk egress through legitimate endpoints, reached by unauthenticated portal access. That matches the SaaS data-theft-and-extortion pattern that has repeatedly targeted Salesforce tenants, so a second-stage extortion demand is a reasonable planning assumption. Do not brief a named actor that nobody named. This is single-source reporting, and that cuts the opposite way from how it is usually read. With no corroborating vendor advisory, native platform logging is the only telemetry under defender control, and waiting for a signature means waiting out the exposure window.

What to have written down

The teams that fare best already have the one-page exposure statement drafted: portals inventoried, guest posture before and after, hunt scope and results, remediation timeline, and the vendor's answer on detection coverage. Handing that document over on request beats assembling it under pressure while a customer's legal team waits on the call.

There is no patch for this one. The fix is a permissions review that can start today, and the evidence of whether it should have started sooner is sitting in ninety days of logs.

The migration path that never reaches procurement

The mechanism is the security problem. DeepSeek's API is OpenAI-compatible, so relocating a workload is a base_url override. One line, and it still reads like a sanctioned OpenAI SDK call to a reviewer skimming a pull request. Most GenAI policy governs which vendor holds the contract and which SDK is approved. Almost none governs which endpoint the traffic resolves to. The sweep list is concrete: api.deepseek.com, api.moonshot, Tencent AI endpoints, OPENAI_BASE_URL, and DEEPSEEK_API_KEY or MOONSHOT_API_KEY patterns across repositories, CI configuration, container images and secrets stores. It returns a binary answer in hours. Highest-yield control in this briefing.

The sources disagree, and both readings point the same way

The Information frames PRC-hosted inference as an order-of-magnitude cost advantage over the frontier Western option. The Information separately reports an industry analysis concluding that premium OpenAI and Anthropic models win on effective cost once token efficiency, retries and task success rates are counted. Sponsor and methodology undisclosed, which makes it procurement marketing, not security evidence. Both readings damage the paperwork. If the cheap endpoint is genuinely cheaper, there is a live data-egress path signed off by an internal cost-benefit exception. If it is not, the same exception carries uncompensated residual risk: jurisdictional data access, no enforceable DPA, unclear GDPR transfer basis, federal-procurement exposure, nothing in the benefit column. Auditors reach that question eventually.

Timing sharpens it. DeepSeek has pre-announced a significant API price increase. Anything migrating now faces a forced re-migration under schedule pressure later. Schedule pressure is the condition under which security review gets skipped.

Cheap inference reprices two things

First, lure production. At $0.87 per million output tokens, 10,000 individually tailored spear-phishing emails at roughly 500 tokens each costs about $4.35. Self-hosting the open weights removes provider-side rate limits and abuse guardrails entirely. Volume and grammar heuristics stop discriminating against unique, native-fluency lures. Reweight detection toward newly registered sending domains, first-contact-plus-financial-intent, reply-to mismatch and anomalous OAuth consent grants. Refresh simulation content; zero-typo personalized lures are the baseline users now face.

Second, the model supply chain. The price floor pushes teams toward self-hosting open weights, converting a managed third-party risk into a first-party attack surface most detection programs do not cover. Pickle-format checkpoints deserialize arbitrary code on load. Conversion jobs run with broad cloud credentials and no network isolation. Inference listeners on Ollama's 11434 or vLLM and Triton's 8000 frequently sit unauthenticated inside the estate. The standard: safetensors only, hash-pinned artifacts, ModelScan or picklescan in the pipeline, conversion in a segmented sandbox, every deployed model recorded in an AIBOM.

The budget threat behind all of it

Compute scarcity is producing cost mandates. The Information reports AWS instructing its own engineers to cut CPU waste. When efficiency pressure reaches platform teams, the line items challenged first are the ones with visible cost and invisible value: agent-based EDR, verbose authentication logging, encryption on "internal-only" paths. Every incident retro that opens with "we had no logs for that window" traces back to a cost-optimization ticket approved months earlier.

The cheapest frontier-adjacent model on earth now sits one line of code from your source tree, and it does not sign a DPA.