🔴 Azure CLI Password Spray, Adobe 7 Critical Patches, 🎯 CitrixBleed Returns, Quebec Water Hack, 🛡️ Phantom Squatting

The password spray campaign against Azure CLI is the day's defining story. Huntress logged 81 million login attempts across twelve days against Microsoft 365 tenants through the deprecated OAuth ROPC flow, which mints tokens without an interactive MFA prompt; 78 accounts across 64 organizations were compromised, and eight victims had no MFA at all. Policies that only cover browser sign-ins do not see this traffic, so ROPC usage and conditional access coverage of OAuth flows need an explicit audit. Azure CLI password spray

The OT story carries the public safety risk. Canada's CSE disclosed that NoName gained access to a Quebec town's water treatment plant, including the ability to manipulate control pumps and chlorine dosing. The shift from DDoS to ICS manipulation is the escalation that matters for every utility with remote access into OT, and the fix set is standard: segmentation, MFA on HMI and SCADA access, and review of remote entry points. Quebec water plant access

Adobe's emergency patch run for seven maximum-severity ColdFusion and Campaign Classic flaws is the urgent patching item, with unauthenticated remote code execution rated Priority 1 and no user interaction required. The AI attack surface keeps widening: Unit 42's phantom squatting research found LLMs hallucinate real-looking domains that adversaries pre-register to intercept AI-generated traffic, exploiting a zero-reputation blind spot, and LayerX's BioShocking prompt injection compromised all six agentic browsers tested.

Watchlist: OAuth flow coverage in conditional access, water utility OT segmentation, and ColdFusion patching inside the 72-hour Priority 1 window.