Four new KEV entries — and the theme is the front door. CISA added four actively exploited flaws to the KEV catalog Aug 18, and two are authentication failures outright: CVE-2026-65400 (CVSS 9.8) lets a network attacker reach macOS Screen Sharing without valid credentials, and CVE-2026-55040 (CVSS 9.1) is a weak-authentication bypass in SharePoint that came under attack after a public PoC dropped. The other two are no gentler: a vCenter path traversal (CVE-2026-59310) a suspected China-nexus actor is using for persistent access — with at least one case ending in Babuk-derived ransomware in public reporting — and a Microsoft IKE flaw (CVE-2026-33824). Federal agencies had until Aug 21 to patch. If your cycle missed that window, that’s the sign — and per last week’s rule: verify on the host, against the current advisory.

1.6 million reasons your help desk is a login. After RingCentral declined to pay, the ShinyHunters extortion crew dumped data reportedly covering ~1.6 million accounts — four fields per record: name, email, physical address, phone. The company says the core platform wasn’t touched; the intrusion started as social engineering, and that’s the lesson: those four fields are exactly what makes the next phone call to your help desk sound legitimate. A password reset flow is an internet-reachable login — it just answers to a human. If your verification procedure is “sounded like the user,” this dump is aimed at you.

Ransomware infrastructure you can’t take down. Microsoft published a breakdown of DeadLock, a Rust-based ransomware operation that resolves its victim-chat proxy from a Polygon smart contract, runs victim comms over the encrypted Session network, and parks stolen data on commodity cloud storage — roughly 80 victims listed by July, most of them European. Blocklists and domain takedowns don’t reach a blockchain. The defender takeaway is unglamorous: the parts you control — identity, egress, tested restores — matter more as criminal infrastructure gets harder to disrupt, not less.

THE LOGIN-SURFACE REVIEW — ONE AFTERNOON

1  ENUMERATE  every internet-reachable login
              (the worksheet has 12 categories)
2  TEST       what each door actually accepts:
              password alone? legacy protocol that
              skips MFA? vendor accounts still alive?
3  MATRIX     where is MFA enforced — ON the door,
              upstream at the IdP, or nowhere?
4  HUMANS     the reset flow is a door: what does
              your help desk require before handing
              over access?
5  LOG IT     doors counted · gaps found ·
              owner · date

⚠️ The kit is a review format and a starting point — not managed security services, and not legal, compliance, or audit advice. Authentication capabilities vary by product and license; verify against your vendor’s current documentation. If a review turns up evidence of compromise, follow your incident-response plan and engage counsel and your insurer per its terms.

“Every breach story this month has the same shape: nobody broke anything — they signed in. I want one afternoon to count every place on the internet that accepts a password for us, check what each one actually requires, and close the paths that skip our MFA. Best case, we write down proof that the doors are counted and locked. Worst case, we find a door nobody was watching — on our schedule instead of theirs.”

Pick the one that stings most. Answers shape the next round of playbooks — anonymous, aggregated, no list-building tricks.