SharePoint was still the door

The due date on the last SharePoint KEV line was Sunday. The reporting today is that a ransomware group is still using SharePoint as the entrance.

Security Intel Hub, citing a BleepingComputer piece dated 2 October, says the Warlock group got initial access at a water utility, a telecom operator, a regional government body, and a university by exploiting SharePoint vulnerabilities. The summary I am willing to repeat stops there. It does not name the organizations. It does not pin the door to CVE-2026-65660, the bug whose advisory still said “not exploited” in the structured field while the prose said otherwise. I am not going to glue those together because the calendar is close.

What the calendar does support is duller. A federal civilian deadline of 28 September was never the date the rest of the world finished. A water utility and a phone company are not federal civilian agencies. A regional government might be on a different country’s clock entirely. “We patched in August” remains a sentence about a build, not about whether a shell landed on the 25th or the 2nd.

What to ask before adopting the sector list

Whether your SharePoint farm is one of the four is not answered by a headline that withholds the names. Whether SharePoint is still a reasonable place to look is answered by the fact that a current ransomware write-up is still opening with it. Content first: new files, new admin actions, accounts that should only edit pages and can now run code. Then the build.

If the only artifact in the room is a sector, say “a sector.” Do not brief the board that the municipal water company was hit because a paragraph said “a water utility.” Do not brief them that SharePoint is finished because the KEV date passed.

The door in the earlier note was a checkbox that had not moved. The door in this one is a group that did not read the checkbox.