Intelligence Hub | Category Market Intelligence

Decision at a glance

Top move

CISA added two FortiSandbox command-injection flaws to its Known Exploited Vulnerabilities list, creating a real, immediate patch-and-mitigation priority for any traffic‑inspection or sandbox deployments

Key takeaways

CISA added two FortiSandbox command-injection flaws to its Known Exploited Vulnerabilities list, creating a real, immediate patch-and-mitigation priority for any traffic‑inspection or sandbox deployments.[5]
Email attackers are using 'text salting' to bypass some LLM/ML-based filters; buyers should treat vendor detection claims as unverified until tested with adversarial samples.[3]
AWS reported a billing‑console pricing-computation error that produced wildly inflated estimated charges; don’t base procurement or stop‑gap spend decisions on unverified estimate telemetry.[2]

Why this matters for the category manager

CISA added two FortiSandbox command-injection flaws to its Known Exploited Vulnerabilities list, creating a real, immediate patch-and-mitigation priority for any traffic‑inspection or sandbox deployments. Email attackers are using 'text salting' to bypass some LLM/ML-based filters; buyers should treat vendor detection claims as unverified until tested with adversarial samples. AWS reported a billing‑console pricing-computation error that produced wildly inflated estimated charges; don’t base procurement or stop‑gap spend decisions on unverified estimate telemetry. Microsoft postponed removal of the Exchange Online PowerShell -Credential parameter, giving more time for controlled script migrations but not removing the need to inventory and remediate automation

What changed

CISA added FortiSandbox CVE-2026-39808 and CVE-2026-25089 to its Known Exploited Vulnerabilities list (new federal-level exploit evidence vs prior run).
AWS acknowledged a billing-estimate computation bug that caused inflated Cost Explorer estimates and paused estimated-bill updates (new telemetry integrity event).
Barracuda reported large-volume use of text-salting in phishing campaigns observed since April (new attacker technique affecting email detection models).

Category impact

Cost / money

Emergency remediation for FortiSandbox instances will generate unplanned security spend for patch deployment, network mitigations, or vendor-assisted services.[5]
False billing estimates from AWS can trigger unnecessary procurement escalations or hurried cloud commitments if organizations act on unverified telemetry.[2]

Supplier / commercial

Buyers should expect negotiations with Fortinet or managed‑service providers to focus on rapid patch SLAs, proof‑of‑deployment evidence, and runbook transparency for inspection appliances.[5]
Email‑security vendors will face requests for demonstrable detection against presentation-layer phishing (text salting) and for contractual acceptance tests tied to managed‑service SLAs.[3]

Safety / operations

A compromised sandbox that permits command execution threatens inspection infrastructure and can undermine detection, increasing operational continuity risk for monitored networks.[5]
Email bypasses increase the likelihood of credential theft or initial-access vectors that can cascade into OT or telco control-plane disruptions if not contained.[3]

What to watch

CISA KEV inclusion often precedes binding guidance for federal buyers; watch for agency deadlines or vendor advisories that could extend to enterprise expectations.[5]
AWS's backfill process may lag visible dashboards; confirm invoice-level reconciliation before making budget or contractual decisions tied to reported spend anomalies.[2]
Text-salting relies on rendering tricks (hidden text, CSS cropping, zero-font) that look different to machines and humans—validate defenses with crafted samples rather than vendor assertions alone.[3]

Category manager actions

Action detail for this brief

Today's priorities

Inventory all FortiSandbox appliances and cloud sandbox instances and apply vendor mitigations or temporary network isolation where immediate patching isn't possible.

because CISA added FortiSandbox command-injection CVEs to its KEV list and unpatched appliances in inspection paths can allow remote command execution.

Due 3d

high

Hold automated procurement triggers that respond to estimated cloud spend and require invoice-level verification before any reactive buying or contract changes.

because AWS reported inaccurate estimated-billing figures and paused estimate updates, so estimate telemetry may be unreliable until backfill completes.

Due 3d

high

Ask email-security vendors for proof-of-detection tests against salted-phishing samples and include those test requirements in upcoming renewal or proof-of-capability discussions.

because Barracuda observed high-volume text-salting campaigns that can bypass some ML/LLM filters and vendor claims must be verifiable in contract acceptance criteria.

Due 21d

high

Supplier radar

theregister

high

Observed supplier signal

Buyers should expect negotiations with Fortinet or managed‑service providers to focus on rapid patch SLAs, proof‑of‑deployment evidence, and runbook transparency for inspection appliances.

Commercial implication

Buyers should expect negotiations with Fortinet or managed‑service providers to focus on rapid patch SLAs, proof‑of‑deployment evidence, and runbook transparency for inspection appliances.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

theregister

high

Observed supplier signal

Email‑security vendors will face requests for demonstrable detection against presentation-layer phishing (text salting) and for contractual acceptance tests tied to managed‑service SLAs.

Commercial implication

Email‑security vendors will face requests for demonstrable detection against presentation-layer phishing (text salting) and for contractual acceptance tests tied to managed‑service SLAs.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

Negotiation levers

Lever

Inventory all FortiSandbox appliances and cloud sandbox instances and apply vendor mitigations or temporary network isolation where immediate patching isn't possible.

Use when

because CISA added FortiSandbox command-injection CVEs to its KEV list and unpatched appliances in inspection paths can allow remote command execution.

Expected outcome

Validated inventory of FortiSandbox instances with mitigation status (patched, mitigated, isolated) for operational handoff.

high confidence

Lever

Hold automated procurement triggers that respond to estimated cloud spend and require invoice-level verification before any reactive buying or contract changes.

Use when

because AWS reported inaccurate estimated-billing figures and paused estimate updates, so estimate telemetry may be unreliable until backfill completes.

Expected outcome

Adjusted procurement alert rules and a documented checklist requiring invoice reconciliation before spend escalations.

high confidence

Lever

Ask email-security vendors for proof-of-detection tests against salted-phishing samples and include those test requirements in upcoming renewal or proof-of-capability discussions.

Use when

because Barracuda observed high-volume text-salting campaigns that can bypass some ML/LLM filters and vendor claims must be verifiable in contract acceptance criteria.

Expected outcome

Vendor-provided test reports and contractual acceptance criteria (test suite) for presentation-layer phishing detection.

high confidence

Talking points

CISA added two FortiSandbox command-injection flaws to its Known Exploited Vulnerabilities list, creating a real, immediate patch-and-mitigation priority for any traffic‑inspection or sandbox deployments.

Email attackers are using 'text salting' to bypass some LLM/ML-based filters; buyers should treat vendor detection claims as unverified until tested with adversarial samples.

AWS reported a billing‑console pricing-computation error that produced wildly inflated estimated charges; don’t base procurement or stop‑gap spend decisions on unverified estimate telemetry.

Recommended actions

Do now

Inventory all FortiSandbox appliances and cloud sandbox instances and apply vendor mitigations or temporary network isolation where immediate patching isn't possible.
Why: because CISA added FortiSandbox command-injection CVEs to its KEV list and unpatched appliances in inspection paths can allow remote command execution.
Owner: Ops
Expected outcome: Validated inventory of FortiSandbox instances with mitigation status (patched, mitigated, isolated) for operational handoff.
[5]
Hold automated procurement triggers that respond to estimated cloud spend and require invoice-level verification before any reactive buying or contract changes.
Why: because AWS reported inaccurate estimated-billing figures and paused estimate updates, so estimate telemetry may be unreliable until backfill completes.
Owner: Category
Expected outcome: Adjusted procurement alert rules and a documented checklist requiring invoice reconciliation before spend escalations.
[2]

Next few weeks

Ask email-security vendors for proof-of-detection tests against salted-phishing samples and include those test requirements in upcoming renewal or proof-of-capability discussions.
Why: because Barracuda observed high-volume text-salting campaigns that can bypass some ML/LLM filters and vendor claims must be verifiable in contract acceptance criteria.
Owner: Contracts
Expected outcome: Vendor-provided test reports and contractual acceptance criteria (test suite) for presentation-layer phishing detection.
[3]
Create an inventory of automation scripts using Exchange Online -Credential and prioritize remediation or test plans to migrate them to modern authentication.
Why: because Microsoft has confirmed the planned removal of the -Credential parameter and scripts still using it will fail when retirement proceeds.
Owner: Contracts
Expected outcome: Script inventory with owners, remediation priority, and scheduled validation tests against modern auth.
[4]

Watch

Negotiate contract amendments with security-appliance and managed-sandbox suppliers to add accelerated patch SLAs, deployment attestations, and escalation pathways for critical...
Why: because FortiSandbox CVEs on CISA's KEV list raise operational exposure and buyers need contractual leverage to ensure timely fixes and evidence of remediation in production.
Owner: Contracts
Expected outcome: Amended supplier contracts including measurable patch SLAs and obligations to provide deployment evidence and runbook access.
[5]
Decide endpoint strategy for OneDrive sync: plan OS upgrades or procure alternative sync solutions and include migration support in desktop/imaging contracts.
Why: because Microsoft will end OneDrive sync support on older Windows 10 builds and client-side sync workflows will degrade without an alternative or upgrade path.
Owner: Category
Expected outcome: Approved procurement plan and budget recommendation for endpoint OS upgrades or alternative sync software with supplier migration support options.
[1]

What to watch

CISA KEV inclusion often precedes binding guidance for federal buyers; watch for agency deadlines or vendor advisories that could extend to enterprise expectations
AWS's backfill process may lag visible dashboards; confirm invoice-level reconciliation before making budget or contractual decisions tied to reported spend anomalies
Text-salting relies on rendering tricks (hidden text, CSS cropping, zero-font) that look different to machines and humans—validate defenses with crafted samples rather than vendor assertions alone
CISA KEV inclusion often precedes binding guidance for federal buyers; watch for agency deadlines or vendor advisories that could extend to enterprise expectations.: CISA KEV inclusion often precedes binding guidance for federal buyers; watch for agency deadlines or vendor advisories that could extend to enterprise expectations
AWS's backfill process may lag visible dashboards; confirm invoice-level reconciliation before making budget or contractual decisions tied to reported spend anomalies.: AWS's backfill process may lag visible dashboards; confirm invoice-level reconciliation before making budget or contractual decisions tied to reported spend anomalies
Text-salting relies on rendering tricks (hidden text, CSS cropping, zero-font) that look different to machines and humans—validate defenses with crafted samples rather than vendor assertions alone.: Text-salting relies on rendering tricks (hidden text, CSS cropping, zero-font) that look different to machines and humans—validate defenses with crafted samples rather than vendor assertions alone
CISA added two FortiSandbox command-injection flaws to its Known Exploited Vulnerabilities list, creating a real, immediate patch-and-mitigation priority for any traffic‑inspection or sandbox deployments
Email attackers are using 'text salting' to bypass some LLM/ML-based filters; buyers should treat vendor detection claims as unverified until tested with adversarial samples

Market pulse

Index	Latest	Change	As of
Palo Alto (PANW)	320	+0.00 (+0.00%)	Jul 18, 2026, 10:07 AM
CrowdStrike (CRWD)	285	+0.00 (+0.00%)	Jul 18, 2026, 10:07 AM
Zscaler (ZS)	195	+0.00 (+0.00%)	Jul 18, 2026, 10:07 AM
Fortinet (FTNT)	72	+0.00 (+0.00%)	Jul 18, 2026, 10:07 AM

Fortinet: Fortinet exploit news raises vendor risk sentiment and could affect supplier support negotiations for critical appliances
CrowdStrike: Email-phishing technique escalation increases attention on detection and telemetry vendors for integrated protection and SLAs

Evidence and sources

Inline citations jump here. Expand a source to read stored evidence excerpts.

[1] Microsoft cuts OneDrive support for older Windows 10 versions next month

theregister.com · Jul 17, 2026

Original linkExpand

Source excerpts

OS PLATFORMS 22H2 has until 2028, or there's always Windows 11 Microsoft will end OneDrive synchronization support next month for older versions of Windows 10, leaving users without client updates, fixes, or technical assistance. According to a post on the company's Message Center, OneDrive sync app updates will continue on Windows 10 22H2 until October 10, 2028, but will stop for earlier versions from August 15, 2026

OS PLATFORMS 22H2 has until 2028, or there's always Windows 11 Microsoft will end OneDrive synchronization support next month for older versions of Windows 10, leaving users without client updates, fixes, or technical assistance

According to a post on the company's Message Center, OneDrive sync app updates will continue on Windows 10 22H2 until October 10, 2028, but will stop for earlier versions from August 15, 2026

Open original source

[2] Billing software error sends billion-dollar AWS estimates

theregister.com · Jul 17, 2026

Original linkExpand

Source excerpts

The company apparently identified the root cause within an hour and a half of beginning its investigation, only describing it as “an issue with unit pricing within the estimated billing computation subsystem. ” AWS followed up by pausing estimated bill updates, saying customers would continue to see the inflated figures already displayed, but that those estimates would not increase further

Hacker News users similarly reported estimates in the billions

” AWS followed up by pausing estimated bill updates, saying customers would continue to see the inflated figures already displayed, but that those estimates would not increase further

Open original source

[3] AI spam filters are getting suckered by old-school text salting

theregister.com · Jul 17, 2026

Original linkExpand

Source excerpts

Attackers are using a technique known as "text salting," which hides benign-looking words intended to confuse some AI-powered email filters, says cybersecurity firm Barracuda. The email security outfit said on Thursday that it had detected more than one million retail-themed phishing attacks using text salting since April

Typical techniques include CSS cropping, which sets the visible window small enough that a human won't see the hidden filler text; text manipulation to move the salty copy outside the visible screen; and zero font techniques which insert misleading words between suspicious phishing copy that’s visible to a machine but not a human

security Turns out decades-old email tricks still work against some LLM-powered email filters Notice more spam getting through that corporate email filter lately? Attackers are using a technique known as "text salting," which hides benign-looking words intended to confuse some AI-powered email filters, says cybersecurity firm Barracuda

Open original source

[4] Microsoft gives admins Exchange Online breathing room

theregister.com · Jul 17, 2026

Original linkExpand

Source excerpts

SAAS Retirement of PowerShell -Credential parameter pushed back to the end of 2026 Microsoft has delayed the removal of the -Credential parameter from Exchange Online PowerShell until December 2026, giving administrators more time to update affected scripts and automation. The -Credential parameter is used when connecting to Exchange Online PowerShell

The server-side retirement of the underlying authentication flow is planned "for a later date

SAAS Retirement of PowerShell -Credential parameter pushed back to the end of 2026 Microsoft has delayed the removal of the -Credential parameter from Exchange Online PowerShell until December 2026, giving administrators more time to update affected scripts and automation

Open original source

[5] Attackers target critical FortiSandbox flaws as CISA issues patch order

theregister.com · Jul 17, 2026

Original linkExpand

Source excerpts

1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS

For federal civilian agencies, bugs landing in KEV come with homework. Binding Operational Directive 26-04 requires them to patch within CISA's deadlines or pull the plug on vulnerable products if they can't be adequately secured

The two bugs, tracked as CVE-2026-39808 and CVE-2026-25089, both carry CVSS scores of 9

Open original source

[6] Fortinet

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

[7] CrowdStrike

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

Patch, Validate, and Reassess Cloud-Telco Supplier Exposures Now

Decision at a glance

What changed

Category impact

Cost / money

Supplier / commercial

Safety / operations

What to watch

Action detail for this brief

Today's priorities

Supplier radar

Negotiation levers

Talking points

Recommended actions

Do now

Next few weeks

Watch

Top stories

Attackers target critical FortiSandbox flaws as CISA issues patch order

AI spam filters are getting suckered by old-school text salting

Billing software error sends billion-dollar AWS estimates

Microsoft gives admins Exchange Online breathing room

Microsoft cuts OneDrive support for older Windows 10 versions next month

Market pulse

Evidence and sources