The Perimeter Is Now A Conversation And The Contract Is Silent
Arctic Wolf Labs has reviewed more than 400 incidents in which attackers used Microsoft Teams' default external chat settings to walk into a corporate network. Teams lets users from other Microsoft 365 tenants message your staff by default unless someone restricts it. Attackers provision temporary tenants, which takes minutes and needs no verified custom domain, and 30 to 40 percent of the reviewed cases used plain .onmicrosoft.com addresses. They then present themselves as "IT Support" or "IT Service Desk", occasionally appending "(Internal)" to the display name. In many cases the approach follows a mail bomb, hundreds of subscription confirmations landing in a victim's inbox within minutes, which buries the real alerts and makes the helpful call from IT feel like a rescue. A Teams call follows. Then Quick Assist, AnyDesk or TeamViewer. In one case the employee ran a PowerShell command that pulled down a malicious MSI. That is a full intrusion chain built from three products you already pay for and a feature nobody in the change record remembers enabling.
I have been writing about edge devices and unmanaged credentials for twenty years, and this is the same story in a place that never appears on an asset register because it is not an asset. It is a setting. Huntress makes the companion point in its Tragic Quadrant release: 45 percent of endpoint incidents it investigated in Q1 2026 involved abuse of remote monitoring and management tools. The attacker does not need a zero-day if your helpdesk workflow is convincing enough to borrow.
Where the data actually lives
Set the Teams campaign beside the report His Majesty's Inspectorate of Constabulary and Fire and Rescue Services published on Tuesday. It is a dry document and it is the most important thing in this week's file. The inspectorate found that third-party ICT suppliers holding police data have been breached repeatedly since 2021. The Police Digital Service recorded 252 cybersecurity incidents affecting policing in England and Wales in the first three months of this year, against 796 near misses.
The detail that matters is not the incident count, which is deliberately imprecise. It is the contractual finding. Most police supplier contracts contained no ongoing cybersecurity assurance. In some organisations, staff could not say whether suppliers were obliged to report incidents promptly. In several, the logs held by the suppliers were not routinely visible to in-house teams. And the Police Digital Service told the watchdog that data held on supplier systems is among the biggest risks the sector faces, specifically because it sits outside its own monitoring. That is a sector with a national security operations centre saying, in writing, that most of its data sits where it cannot see it.
The same lesson is visible in this week's breach reports. ENGIE, a €71.9bn French energy group operating in 30 countries, disclosed that attackers stole customer data after breaching a marketing platform used by business partners. The data included names, addresses, email, phone numbers, meter references (PDL or PCE), customer IDs and contract numbers. No banking data, according to the company, and French customers only. ENGIE's internal systems were not compromised. Note the shape of that sentence, because you will write it yourself at some point: the platform that held the data was not ours. It was a prospecting tool run by partners. The University of Copenhagen, meanwhile, confirmed that hackers reached personal data belonging to 525,000 people through one of its test environments, and added 20,000 more staff and students whose PIN codes were exposed in a subsequent update. It has restricted physical access to parts of campus while it redistributes codes.
Three breach stories, three suppliers, one feature. The data sits in a system the security team does not administer, under a contract that does not require the administrator to tell them anything.
The vulnerabilities that are actually urgent
The PHP2Shell sequence resolved this week, and resolved in the direction the sceptics said it would not. CVE-2026-109618 and CVE-2026-109619 were patched by the PHP team on Wednesday 21 October. Through that week, Sophos and Palo Alto Networks posted and then retracted claims of successful exploitation, and multiple firms, including Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack, detected widespread attempts and tagged them unsuccessful. Amazon's own researchers placed the start of targeting four days before patches existed. On Monday evening CISA added both to the Known Exploited Vulnerabilities catalog and ordered civilian federal agencies to patch by Thursday. CISA's definition of active exploitation includes attempts, which is worth reading twice, because it means the catalog entry is not evidence of a successful compromise. Researchers found workable exploit paths by Sunday. The window between "nobody has a working exploit" and "everybody does" was six days.
Then the runtime. Microsoft shipped an out-of-band batch on 25 October for .NET 8, 9, 10 and 11 RC3. CVE-2026-111497 is a buffer overflow in how .NET handles Brotli compressed data, reachable without authentication where ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs are in use. Automatic decompression is off by default and .NET Framework is unaffected. The same decoder flaw affects Node.js, and Tenable reported on 26 October that proof-of-concept code was public and remote code execution had been demonstrated there. CVE-2026-114148 is the second one, unsafe file ownership in Linux .NET tarballs, which allows local privilege escalation on .NET 10 and .NET 11 source builds. The 25 October release also revisits two vulnerabilities the 13 October updates did not fully fix. Microsoft called October's Patch Tuesday a record 1,413 vulnerabilities. Three emergency releases in a month is not a cadence, it is a queue.
Tailscale and Apple complete the set. Cyberdione Labs found 11 flaws in Tailscale 1.104.2 and headscale v0.29.5, collectively Tailworm, all verified by reproduction on released software, and released the details before patches existed. The most serious allows an already authorised user to escalate through Unix socket forwarding in the Tailscale SSH server. Tailscale called them serious, confirmed exploitability depends on configuration, and did not recommend disabling SSH. Apple backported CVE-2026-86950, an out-of-bounds write in CoreGraphics, to older iPhones and iPads after Meta Product Security reported it and Apple acknowledged exploitation in targeted attacks on iOS before 27. Note the phrasing: sophisticated attack against specific targeted individuals. That is a phrase that usually hides a commercial surveillance customer, and it should be read as a statement about your executives, not about your fleet.
The devices nobody patched
Forescout's Vedere Labs found 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries, using Shodan, across 10 product groups. The figure counts service observations, not systems, because one address can expose several interfaces or front several downstream units. Eighty percent of observed Danfoss StoreView services were running firmware potentially affected by known vulnerabilities. Danfoss's August 2025 advisories describe two flaws in AK-SM 8xxA before version 4.3.1: CVE-2025-41451 allows remote code execution through command injection, CVE-2025-41452 a denial of service through web interface configuration changes.
This is not hypothetical. Attacks in October 2026 against more than 700 supermarkets in France involved manipulated refrigeration temperatures and defrost settings, causing food losses, with CERT-FR confirming compromises involving Danfoss AK-SM and AK-SC, Copeland and Dixell XWEB equipment. Forescout tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivists Z-Pentest Alliance and NoName057(16) among the most active, and Z-Pentest claimed 10 in one day on 26 April. Earlier waves hit 16 Russian supermarkets and 40 Israeli stores in 2022.
If you run pharmaceutical storage, hospital catering, cold chain logistics or any food retail, that equipment is in your estate whether or not it is in your asset database. It is almost certainly on a supplier's maintenance contract, on a flat network segment, and running the firmware it shipped with. CISA's ICS advisories this week cover Mitsubishi Electric's GENESIS, GENESIS64 and MC Works64 line and EPICS Base, which is the same problem wearing industrial clothing. Physical consequences from unpatched embedded systems are now the normal case rather than the exotic one.
The breach is not the incident, the investigation is
Warp, an agentic development environment used by at least 800,000 developers, disclosed that agent decision logs and telemetry were exposed through an attack on a third-party vendor in its infrastructure. Its CEO estimates roughly 1 percent of users were affected, and the company did not clarify whether source code, prompts or credentials were in scope. Analysis suggested the attack was powered by an agent swarm using a sophisticated penetration technique. CrowdStrike is assisting. That disclosure arrives days after OpenCode notified users that stored API keys for external providers were exposed, affecting about 1.4 percent of its users, with unauthorised charges reaching $1,700 for some.
The uncomfortable reading is not about the vendors. It is that the evidence base for how your agents behaved is held by a third party, in a log store you do not control, and when that party is compromised the record of your agents' actions becomes the thing that was stolen. Add Dark Reading's report of an in-the-wild technique that abuses AI agents' trust in Markdown, and the direction of travel is clear: agents take instruction from documents, and documents are a writeable surface.
There is a commercial current underneath this. OpenAI's GPT-6.1 Terra launched on 26 October at $1 per million input tokens, half the price of its predecessor and of GPT-6.1 Sol, which means more agents for the same budget. The Seoul Metropolitan Police case shows the criminal equivalent: a former penetration tester at a security company, self-taught and 32, breached more than 90 South Korean organisations using the ARTEX framework, stealing 8.2 million records and demanding 270,000 dollars in 38 of the incidents. He moved from conventional tools to AI utilities in August 2026.
What a CISO should do this week
Close Teams external access to a named allowlist before you work out who owns the setting. Then check whether your mail gateway throttles subscription mail, because the mail bomb is what makes the impersonation land, and it is detectable in aggregate. Both are configuration changes, not projects.
Read your top twenty supplier contracts for the three clauses HMICFRS found missing: an ongoing cybersecurity obligation, a breach notification deadline with a consequence attached, and a right to see logs. Where they are absent, you have a finding for the board, not a conversation with procurement. The police sector spent five years discovering that "the supplier holds the data" means "the supplier holds the risk" only in the contract, never in practice.
Patch PHP where it exists, not where you think it exists. Query your hosting providers, the agencies running marketing sites, and the business units that bought a CMS. The KEV entry sets the deadline. Do the same for .NET Brotli on any service doing request decompression, and for Node.js, which has the same decoder flaw and a public proof of concept.
Assume your Tailscale deployment has authorised users who can escalate. Audit what each tailnet member is actually permitted to reach, rather than what the ACL was intended to say.
Sweep Shodan for your own address ranges against the refrigeration and energy management protocols in the Forescout data. If you find your own equipment, that is the finding, and the mitigation is network segmentation and a supplier conversation about firmware, not a patch you can deploy yourself.
Finally, ask your AI vendors one question in writing: can you produce, on request, the decision logs and tool invocations for our agents, and where is that record stored. If the answer begins with a third-party vendor's name, treat it as an outsourced evidence chain and plan accordingly.
None of that is complicated. All of it requires someone to have checked rather than assumed, and the checking is the part that keeps not happening.