SonicWall SMA1000 CVSS 10 Zero-Day Under Active Exploitation

The number that matters is not the CVE count. It's the clock. Cato Networks wrapped GPT-5.5 in a custom harness that ran a full attack chain to domain administrator in 40 minutes. Tenable, Proofpoint, and SpecterOps have built model-agnostic harnesses that swap the underlying LLM and hold results steady. The capability lives in the harness, in operational context and system integration, not the model. AI-speed attacks are now portable and commoditizing. An hourly SOC rhythm does not survive a 40-minute time-to-DA.

The same efficiency explains the 622-CVE flood. June's prior record was 206. Researchers attribute the 3x spike to AI bug-finding tooling, not a real surge in risk. That puts Microsoft on pace for 2,000–3,000 CVEs this year against 2020's record of 1,245. Hand-triaging by CVSS is finished. Automate against CISA KEV and EPSS so genuine zero-days surface above the noise.

Crypto is the leading indicator. Immunefi logged a record 207 DeFi incidents in H1 2026 while aggregate losses fell below $1B, down more than 50% year over year. This is a bifurcated economy. Well-resourced targets deploy AI-hardening. Attackers use GLM 5.2/GPT 5.6-class tooling to carpet-bomb the long tail. The pattern generalizes past crypto. LLM tooling collapses the cost of recon and exploit generation. That makes a forgotten subsidiary app, an orphaned integration, or an unmaintained service worth attacking at machine speed.

Defenders who monitor only crown jewels are defending the wrong perimeter. The economics inverted the risk model. The weakest, least-watched asset is now the most probable entry point. Detection tuned for human-paced recon will miss the campaign.

When an AI harness reaches domain admin in 40 minutes, exploitation evidence is the only triage key that still matters. Vulnerability volume is not.

The mechanism worth watching in Forg365 is persistence, not delivery. Device-code phishing abuses a legitimate OAuth flow. The victim authenticates on a genuine Microsoft page, so there's no lookalike domain for URL filters to catch. Once tokens are captured, attacker-side session refresh keeps the adversary authenticated indefinitely. A password reset evicts nobody. It's sold as-a-service over Telegram with AI-generated lures. That commoditizes full M365 tenant takeover, which puts it a step past a one-off exploit.

The containment runbook is the gap. On takeover you have to revoke refresh tokens, force global sign-out, invalidate all sessions, and rotate every credential the account touched. Then verify no new tokens mint. Highest-value prevention is an Entra Conditional Access policy blocking the device-code flow for populations that don't need it. Run report-only first to confirm no legitimate onboarding breaks.

Microsoft is pushing the same direction from the platform side, with dates attached. Entra ID makes passkeys the default on September 1, 2026, auto-prompts SMS/voice users to enroll at next MFA, and retires Microsoft-provided SMS/voice MFA entirely on February 1, 2027. Continued SMS then requires paid telecom partners via the Microsoft Security Store. SMS OTP is phishable and SIM-swappable, so the hygiene is net-positive. It will also silently break any workflow secretly dependent on SMS, including service accounts and break-glass paths.

Treat the two dates as one project. Inventory every SMS/voice dependency and decide the paid telecom fallback before the September default flip, not the February cliff. The migration surfaces exactly the undocumented automation and recovery paths an attacker would look for first.

A password reset no longer evicts a phished M365 attacker — without device-code auth disabled and session revocation forced, breached accounts stay breached.

Iranian retaliation follows US escalation on a predictable lag. After the 2020 Soleimani strike, CISA issued Shields-Up warnings. Iranian actors ran the Ababil DDoS campaign against US banks in 2012–13. CyberAv3ngers hit exposed water-utility PLCs in 2023. The current trigger is a seven-hour overnight strike on Iranian missile, drone, and coastal-defense sites, plus a reimposed naval blockade near the Strait of Hormuz. The prior ceasefire is broken. Brent is back above $85.

The expected pattern is the Iranian-nexus playbook, not novel zero-days. Opportunistic, high-volume tactics against exposure. The likely TTPs map cleanly to monitoring:

Financial services, energy, and internet-facing OT are the historical target set. Defenders in those sectors typically move pre-incident: loading Iran-nexus IOCs, deploying detections for password spraying and public-facing-app exploitation, validating DDoS scrubbing capacity, and hunting exposed HMIs/PLCs with default credentials. The market signal is noise. CrowdStrike (+12%) and Okta (+11%) rallied on CPI-driven risk-on sentiment. The escalation is the actual indicator.

US strikes on Iran are a reliable leading indicator of cyber retaliation against banks, energy, and exposed OT. The window to prepare closes when the first DDoS lands, not before.