Max-severity Exchange server flaw under active exploitation by Kremlin hackers

# Max-Severity, Minimum Patience The Kremlin's assault on Exchange is a report card, and most enterprises just failed flashing. A max-severity flaw under active exploitation isn't a hypothetical CVE—it's live fire inside the network you call production. ([Source](https://arstechnica.com/security/2026/07/kremlin-hackers-are-exploiting-exchange-flaw-to-backdoor-unpatched-networks/)) The detail that matters most is the persistence. Credential rotation fails. Disk re-imaging fails. That's not a backdoor; that's a leasehold on your infrastructure. This signals a decisive shift in state-sponsored tradecraft: why steal data when you can own the conditions under which data exists? Attackers aren't breaking in anymore. They're moving in. Connect the dots—supply chain, identity layers, now the mail backbone itself. Modern cyberwarfare has abandoned smash-and-grab for sedentary occupation. The payload here isn't malware; it's *time itself*, buried so deep that standard incident response becomes an exercise in archaeology. Finance teams budget for patching windows. Adversaries budget for your negligence. If your Exchange server is unpatched, it's not a vulnerability—it's a reservation, and the Russians have already checked in. ```json { "key_insight": "The most dangerous exploits aren't the ones that steal data—they're the ones that survive the response.", "confidence": 0 } ```