The week brought emergency patches, a fresh look at exposed energy infrastructure, and two interviews that illustrate how different the security job looks depending on where you sit. Here's what matters if you run systems or advise those who do.
Microsoft Rushes Out Exchange Fix
Microsoft pushed an out-of-band update for Exchange Server, closing CVE-2026-96940. An authenticated attacker could exploit it to read emails and attachments belonging to other users in the same organization. Cross-tenant access is not possible, so cloud-hosted environments face less direct exposure. If you run on-premises Exchange, treat this as a priority patch.
CISA Flags Active NetScaler Exploitation
CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog—a memory overflow bug affecting Citrix NetScaler ADC and Gateway appliances. Such flaws can crash devices or potentially allow code execution. The addition signals active exploitation, not just theoretical risk.
Russia-Aligned Group's Long Game
ESET researchers traced nearly two years of development on MATCHBOIL, a downloader the UAC-0099 group uses to install spying tools on Windows machines in Ukraine. Continuous refinement over that timeframe suggests a well-resourced operation with clear objectives—not a project likely to disappear soon.
Energy Infrastructure Under the Streetlight
Research from Modat and NCSC-NL found 8,547 internet-facing systems at wind farms and solar parks across 35 European countries. These were not hidden backdoors—login screens, control interfaces, even a turbine Stop button reachable by anyone with a browser. The exposure is visible and, in many cases, easily fixed.
Who Runs This Stuff?
Ann Barron-DiCamillo, CISO at U.S. Bank, described how the role has expanded to cover fraud, resilience, third-party risk, and AI governance. Her conclusion: no single leader can own all of it. Partnerships across technology, risk, legal, and business teams are not optional—they are the job.
At the other end of the scale, Drew McCombs, CTO and CISO at healthcare fintech Cylerity, explained why turning on MFA for email is still the cheapest fix for small practices. Security work slots into every development sprint, with anything touching patient data or funds taking priority.
Our analysis
The CISA additions this week follow a familiar pattern: out-of-band patches and evidence of exploitation arriving together. Waiting for the next scheduled maintenance window when emergency fixes exist is a choice, not a constraint. Organizations that run on-premises Exchange should have already patched CVE-2026-96940.
The Modat finding deserves more attention than it usually gets. Energy infrastructure supply chains face enough pressure without preventable internet exposure. Login screens on operational technology are not minor oversights—they are potential entry points that require immediate remediation.
The ArmorCode survey adds context to why so many teams feel stuck: just over half of 200 senior leaders polled said their organizations would struggle to simplify security programs without changing how they work. More tools have not solved the problem. In many cases, they have added to it.
What to watch next
Patch Exchange servers now. Monitor CISA for follow-on guidance on the NetScaler flaw. Watch whether MATCHBOIL activity spreads beyond its current targets in Ukraine.
Who should care
| Audience | Priority Action | Why |
|---|---|---|
| Security leaders | Audit third-party partnerships and AI governance | CISO role now spans fraud, resilience, and AI—not just technical controls |
| IT teams | Apply Exchange patch immediately | Active exploitation likely; out-of-band release signals severity |
| Energy sector | Scan for exposed OT interfaces | 8,547 systems found; likely more exist |
| Small practices | Enable MFA on email | Cheapest fix with highest return on patient data exposure |
| Developers | Schedule security work into every sprint | Reduces debt and avoids reactive patching |
Frequently asked questions
What is CVE-2026-96940?
A high-severity vulnerability in Microsoft Exchange Server that allows authenticated attackers to read emails and attachments belonging to other users in the same organization. Microsoft released an out-of-band patch.
Why did CISA add CVE-2026-88779 to its Known Exploited Vulnerabilities catalog?
CISA adds vulnerabilities when evidence shows active exploitation. The Citrix NetScaler flaw is a memory overflow bug affecting ADC and Gateway appliances.
What is MATCHBOIL?
A downloader malware used by the Russia-aligned threat group UAC-0099 to install spying tools on Windows systems in Ukraine. ESET researchers tracked nearly two years of development on the malware.
How many energy systems were found exposed on the internet?
Research from Modat and NCSC-NL identified 8,547 internet-facing systems at wind farms and solar parks across 35 European countries.
What did the ArmorCode survey find?
Just over half of 200 senior security and technology leaders polled said their organizations would struggle to simplify software security programs if they continue working as they do today.