Cyber Digest

Executive Summary

Friday's digest is led by an actively exploited SharePoint authentication-bypass, a landmark US reorientation of offensive cyber to the private sector, and Germany's largest postwar spy-law overhaul. First, CVE-2026-55040 (CVSS 9.1) — a Microsoft SharePoint security-feature bypass allowing impersonation that lets an attacker disclose and modify files — is being exploited in the wild by threat actors following Rapid7's release of a proof-of-concept this week. Microsoft patched the flaw in July; it is now the fifth SharePoint bug exploited this year, and Defused Cyber reports live exploitation. Separately, CISA has added CVE-2026-72898, an unauthenticated SQL-injection flaw in Metabase with administrator-access reach, to its Known Exploited Vulnerabilities catalogue. Second, President Trump has signed a national security memorandum authorising vetted private-sector companies to conduct offensive cyber operations against foreign criminal syndicates — a significant reorientation of US cyber-crime policy that delegates government offensive action to commercial firms and carries wide Five Eyes and civil-liberties implications. Third, Germany's cabinet approved legislation giving its intelligence agencies powers to hack foreign systems, sabotage adversaries' supply chains and feed disinformation to extremists inside Germany — the biggest overhaul of the country's spy laws of the postwar era. The week's AI-threat thread continues in parallel, with CyberScoop reporting that "mid-tier" AI models have become dramatically more capable at offensive hacking.

Two structural themes tighten as the week ends. Offensive cyber capability is being re-nationalised and commercialised at the state level. Germany's cabinet-approved spy-law overhaul — moving beyond surveillance into active hacking, supply-chain sabotage and domestic disinformation — follows the US memo authorising vetted private firms to run offensive operations against foreign criminals, both sharpening the same geopolitical arc the week began with: the Taiwan near-autonomous AI attack and Frontier AI threat warnings. The pattern is a coordinated expansion of the offensive envelope across Western and allied states in the face of an increasingly assertive APT threat, with cyber diplomacy shifting from defence and deterrence toward active, sometimes delegated, engagement. Patch-to-exploitation conveyance remains the dominant operator risk. The SharePoint impersonation bug went from July Patch Tuesday disclosure to exploited-in-the-wild within weeks of a public PoC, the Metabase SQLi flaw joined the same rapid KEV conveyor this cycle, and the week's earlier `afd.sys` and VMware vCenter exploitation show internet-exposed Microsoft, web and management surfaces as the primary attack surface rather than novel TTPs — the same pattern that drove CISA's KEV and two-week BOD 26-04 remediation directives all week. AI-offensive capability continues to feature: the CyberScoop finding that mid-tier models have "dramatically better" hacking ability sustains the AI-weaponisation thread from Tuesday's near-autonomous-attack disclosure, pointing to a coming week where AI-accelerated vulnerability discovery and automation remain front and centre. Expect patching urgency, offensive-posture diplomacy and AI-enabled threat to dominate the week ahead.