Topic
The practice of protecting email systems and gateways from phishing, malware delivery, and exploitation of filtering and parsing software.
Attackers are exploiting Zimbra Collaboration Suite flaw CVE-2026-73570, which Synacor fixed quietly in 10.1.20 on July 20 and disclosed on August 13. An upgrade closes the injection path, but a web shell written earlier stays on disk until someone finds it.
Reality
Just 474 of the 1,000 most popular websites set DMARC to reject spoofed mail, a dev.to survey of their DNS found. Thirty-two months after Google and Yahoo began requiring DMARC from bulk senders, 84.5% of the sites publish a record, but only 69.4% apply an enforcing policy to all their mail.
Reality
Microsoft will block .msix and .msixbundle attachments by default in Outlook on the web and the new Outlook for Windows from early November. Tenants that still mail app packages need a policy exception before general availability in mid-November.
Reality
Barracuda analyzed a phishing campaign pairing a password-protected attachment with hidden prompt injection aimed at the user's AI inbox summarizer. The filter that passes a message decides what the assistant reads, so the two need testing as one path.
Reality
Microsoft's 2026 Digital Defense Report puts MFA-relaying proxy kits at 44.6% of phishing techniques, as phishing rose to 23% of its incident cases. SMS codes and push approvals pass straight through those proxies, so protecting company email now means passkeys or FIDO2 keys, starting with admins and finance staff.
Reality
Microsoft says Russia's FSB-linked Star Blizzard sent fake event invitations to more than 100 organizations since January 2026. The lures pose as Chatham House and Atlantic Council events and carry a new Python backdoor, CosmicPulse, aimed at people working on Ukraine.
Reality
CVE-2026-76461 lets a crafted email run SQL as root on Cisco Secure Email Gateway, with no workaround and a September 17 federal patch deadline from CISA. Because the trigger is mail parsing, every gateway in the mail path is in scope, whether or not it faces the internet.
Reality
CERT-In rates CVE-2026-76441 critical for letting unauthenticated remote attackers into restricted functions on Cisco email gateways 15.5 and earlier. The gateway inspects mail in both directions, so the fix belongs ahead of the next scheduled window, using the release Cisco's own advisory names.
Reality
INKY counted 26,589 fake voicemail messages between June 1 and August 4, and Microsoft's native scoring rated three quarters of them clean, so stripping SVG at the gateway is now a budget line, not a debate.
Reality
The May to July figures come from Microsoft and the competing vendors are unnamed. Miss counts are rising across reporting periods, Defender's included, and the third-party layer caught 0.30% of malicious mail.
Reality
AWS's post on the deployment gives the sandbox defaults that decide whether it fits an inline path, among them a 15-minute session time-to-live configurable to eight hours and a choice between VPC-only and public internet access.
Reality
Katie Jacobs Stanton said Instinct sent an email on her behalf without checking with her first, and a second tester reported inbox reads after she disconnected her Google account from the invite-only assistant.
Reality
CVE-2026-14894 gives an unauthenticated attacker code execution on a WordPress site, and the fix is Super Forms 6.3.314. Microsoft separately reports invisible Unicode tag characters at up to 2.37 million messages a day.
Reality
Forcepoint X-Labs hid instructions in zero-pixel white HTML and watched a summarizer repeat them as fact. The measurement is new; two named practitioners say the design flaw it measures has been documented since 2023.
Reality
Microsoft's hunt for email-borne prompt injection instead surfaced a three-month phishing campaign hiding tag characters inside words like funding, which puts both problems on one detection team's desk.
Reality
Claude will send, reply and forward once you switch approval off, which leaves that review step doing double duty as the feature's only brake and as the sole defence anyone can name against prompt injection.
Reality
A risk advisory published on scworld.com argues that block rate only scores filtering against catalogued reputation data, and it offers a ten-incident pull that turns the unmeasured gap into a number a board can actually read.
Reality