SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
Microsoft threat report sees phishing triple as exploit windows shrink
Microsoft’s 2026 Digital Defense Report (covering July 2025 to June 2026) says AI has pushed the median time from vulnerability discovery to weaponization well below 24 hours, with a record of roughly 72,000 CVEs expected this year. Phishing rose from 7% to 23% of initial access vectors in Microsoft’s incident response cases, Teams vishing climbed 502%, and ransomware detonations against enterprises increased nearly 16%. Government agencies were the most affected sector, accounting for 27% of observed activity.
Kiteworks publishes over 100 security advisories in a single day
Kiteworks published over 100 security advisories on September 30, covering its Core platform, Email Protection Gateway, Secure Data Forms, and MFT Server. A dozen are rated critical, mostly Email Protection Gateway bugs that can lead to account takeover, code execution, or access to internal network resources. Dozens more are rated high severity. The most common issues are information disclosure and arbitrary code execution, followed by privilege escalation.
Smuggled headers turned iCloud into an email spoofing tool