State Department offers $10 million for information on the whereabouts of Zhang Yu, a Shanghai company director charged in the Hafnium hacking campaign. The bounty keeps the US case against two named men moving years after June 2021, when the indictment says the charged intrusions ended.
Perspective Coverage
6 publishers
- Builder
- Builder 14%
- Operator
- Operator 81%
- Investor
- Investor 5%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence70
Microsoft issued an out-of-band Exchange Server fix for CVE-2026-96940, a bug letting signed-in attackers read colleagues' mail and attachments. The company expects the flaw to be consistently exploitable, so on-premises admins have good reason to install it ahead of the next maintenance window.
Perspective Coverage
3 publishers
- Builder
- Builder 15%
- Operator
- Operator 80%
- Investor
- Investor 5%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence70
Kaspersky's incident response team says the group, previously seen working against targets in Asia, logged into VPNs from Cloudflare WARP and European hosting addresses, then ran the GhostContainer backdoor in memory on Exchange.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 70%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence58
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
Reality
- Evidence74
- Adoption58
- Hype gap+14
- Incentives60
- Confidence71
Microsoft's record 964-CVE Patch Tuesday includes two exploited zero-days
Tenable's tally for September 2026 is the largest Patch Tuesday on record. It shipped with two bugs already exploited in the wild. The other 962 sit on the calendar as a scheduling problem, and the severity ratings do not sort them by urgency.
Reality
- Evidence55
- Adoption25
- Hype gap+20
- Incentives60
- Confidence50
buildOne report1 publisher IMDSv1 turns an SSRF finding into unauthenticated credential theft in one hop
F5 Labs logged 69,433 probes at 169.254.169.254 in March 2025 using six ordinary parameter names. Whether any of them mattered was settled at instance launch, before any input validation ever ran.
Reality
- Evidence58
- Adoption32
- Hype gap+22
- Incentives42
- Confidence47
Microsoft shipped nine cloud fixes that cost its customers nothing to deploy
The nine flaws Microsoft fixed in Entra ID, Cosmos DB and six other services never reached a patch queue. The week's real remediation cost sat instead with 21,000 exposed Exchange servers and one Minnesota county.
Reality
- Evidence45
- Adoption55
- Hype gap−10
- Incentives60
- Confidence50
August's 398-CVE Patch Tuesday moves the bottleneck to the test bench
Only one of the 398 CVEs Microsoft fixed in August was confirmed exploited, and the SharePoint chain now hitting servers turns on a July patch, which puts exposure on cycle lag rather than on ranking.
Reality
- Evidence33
- Adoption44
- Hype gap+16
- Incentives56
- Confidence38
Microsoft patched the Exchange authentication bypass on August 11. Shadowserver's September 1 scan still counts 21,899 internet-facing servers unpatched, and NCSC-NL says working exploit code for full mailbox takeover is circulating.
Perspective Coverage
3 publishers
- Builder
- Builder 20%
- Operator
- Operator 68%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption30
- Hype gap+18
- Incentives70
- Confidence68