Today’s digest is a reminder that “patched” and “safe” aren’t the same word: a SharePoint auth-bypass patched last month is still being probed because the follow-on RCE only closed this month, a CRM vendor’s breach traces back to a secret nobody meant to publish, and a provenance feature barely two weeks old already has a cottage industry built around defeating it. Here’s what changed since yesterday’s digest.
Vulnerability watch: A SharePoint JWT auth-bypass chain is under active attack, and 8,500+ exposed servers are the blast radius
CVE-2026-55040 (CVSS 9.1) lets an unauthenticated attacker forge a valid JWT and impersonate any SharePoint user — including an administrator — by sending a token with alg: none in the outer header, reusing SharePoint’s own STS certificate thumbprint to resolve a signing key without verifying it, and attaching a signature that’s never checked. Rapid7 published a working proof-of-concept on August 11, and exploitation followed within hours: tracking service KEVIntel logged 12 exploitation attempts since mid-July, 8 of them in the 48 hours after the PoC dropped, from eight distinct IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the US. Shadowserver counts more than 8,500 SharePoint servers currently reachable from the public internet. The bug was patched in July, so anyone still exploitable simply hasn’t applied that update. Separately, Rapid7 and Microsoft disclosed a second flaw, CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in SharePoint’s Business Connectivity Services — patched this month — that chains onto the JWT bypass to reach full remote code execution with no credentials at any point. The chain was originally built as an AI-assisted Pwn2Own Berlin entry (120 hours of agent runtime across 24 days) before responsible disclosure. The Hacker News · Rapid7 · Security Affairs
Rapid7 confirms that patching July’s JWT bypass alone is enough to break the whole chain, so if you run on-prem SharePoint and haven’t applied that update, it’s your priority today regardless of whether August’s RCE patch is installed yet — active scanning is already happening against exposed instances. If you’ve applied both, check SharePoint logs for anomalous STS-related JWTs and unexpected admin-level actions in the window since August 11.
Incident watch: Beacon CRM’s breach traces back to an AWS key leaked in public JavaScript, and the confirmed impact keeps growing
New reporting fills in the root cause behind the Beacon CRM breach first disclosed to affected charities on August 3: attackers got in using a compromised AWS access key that had been sitting exposed inside publicly available JavaScript build artifacts. Beacon serves donor and supporter management for UK charities, and the incident now spans all of its 1,000-plus customer organizations — database backups were copied, and while Beacon says the data was encrypted, it’s warning that attackers may have been able to decrypt it. Exposed fields vary by charity but can include names, addresses, emails, phone numbers, dates of birth, and donation or payment records. SecurityWeek
A secret checked into or embedded in a public front-end bundle is one of the most common ways a breach starts, and it’s also one of the cheapest to catch — scan your own build artifacts and public repos for embedded cloud credentials now rather than after a vendor tells you they found one. If any donor, membership, or CRM vendor you use ran on AWS infrastructure and you haven’t heard from them, it’s worth asking directly rather than waiting.
AI security watch: Claude watermark removers flooded GitHub within days of the feature shipping
Anthropic rolled out invisible watermarking on Claude-generated text starting August 2, embedding a traceable signal in word-choice patterns at the model level. Removal tools followed almost immediately: an open-source project called claude-watermark-cleaner runs one or two automated rewrite passes that disrupt roughly 70% of the underlying token sequences — enough to break the mark — and is picking up new GitHub stars at a fast clip. A second, similar tool extends the same paraphrase-based approach to watermarks from other AI vendors’ models. BleepingComputer’s review found that of the wave of “watermark remover” tools now online, almost none can actually prove their claims hold up. BleepingComputer
If your policies rely on AI-content watermarking to catch undisclosed AI use — in hiring, academic integrity, or contractual “no AI” clauses — treat that signal as bypassable within days of any new provenance mechanism shipping, not as a durable control. Provenance metadata is a useful signal, not proof, and a paraphrase pass will keep beating it faster than detection can keep up.
Also noted: The EU’s privacy watchdog pushes back on a proposal to expand Europol’s data-processing powers
The European Data Protection Supervisor published an opinion on August 12 raising serious concerns about the European Commission’s proposed reform of Europol’s legal mandate, which would let the agency process data on individuals with no established link to a criminal investigation, for an extended and unspecified retention period. EDPS Supervisor Wojciech Wiewiórowski said the proposal “creates serious risks” and that safeguards and independent oversight need to be strengthened before it moves forward, stating plainly: “We cannot sacrifice fundamental rights in pursuit of security.” SecurityWeek
Nothing changes for your compliance posture today — this is a proposal, not adopted law — but if you process EU personal data and share it with law-enforcement-adjacent partners under any current framework, it’s worth tracking this reform through the legislative process rather than being surprised by the final retention and access rules later.
Final thought
The common thread today is timing: a patch that’s only half-applied still leaves you exposed, a leaked credential sitting in public code for who-knows-how-long turns into a thousand-customer breach the moment someone finds it, and a two-week-old safety feature already has a defeat published for it. None of these are exotic attacks — they’re the ordinary gap between “we shipped a fix” and “the fix is actually in place everywhere it needs to be.” If you want help closing that gap faster with better visibility into patch state and credential exposure, see our how-to guides or book a discovery call.