A fix deployed server side never enters an operator's change process: no window to book, no rollback plan to write [2]. It also leaves the operator nothing to show an auditor. Nine bugs across eight Microsoft services went out that way [3], and the remediation labor stayed with the vendor [2].
The labor bill sat elsewhere. Exploit code is now public for CVE-2026-62911, a high-severity Exchange Server flaw patched in August, which the Netherlands National Cyber Security Centre is flagging [4]. Shadowserver's September 1 count put more than 21,000 servers still unpatched [5]. Each of those is hardware somebody owns, which means a change ticket and a reboot window per host, done by staff who have other work.
Winona County, Minnesota is the money case. It reportedly paid $128,539.57 to restore services and protect personal information after a January 2026 attack [6]. In April it was ransomed again, that time claimed by InterLock, and who ran the January intrusion has not been established [7]. Three months separate the payment from the second incident [8]. The reported payment bought recovery [6]. The county remained in the target pool afterward [7].
Three of the week's account compromises involved no software flaw at all [13]. Huntress reports an adversary-in-the-middle kit called Knight Office working against Microsoft 365 and Google Workspace and stealing tokens, which hands the attacker an authenticated session and sidesteps both the password and MFA [10]. Dropbox told roughly 5,000 users that attackers registered Lenovo IDs against the victims' email addresses and used that to reach their Dropbox accounts [11]. Coder's Cloudflare infrastructure was altered to point at attacker-controlled IPs, and its module registry served a credential stealer to a subset of users [12]. In the Dropbox case, the trust relationship abused was Lenovo's email verification, not anything the Dropbox account holder configured [11].
Project Watershed 250 puts Texas water and wastewater utilities in reach of free cyber defense resources, positioned by the White House and the state's governor against China, Iran and other foreign adversaries [9]. Free access, rather than budget, is the delivery vehicle, which is a statement about what those asset owners can pay. As reported, the program arrives without named private participants and without a count of utilities in scope [14].
