One weak account, the whole network - a week of breaches that spread too far

Cybersecurity 4 min 13 sources

A newly public exploit lets a low-privileged Windows account seize an entire company domain, part of a week where the walls meant to keep a small break-in small kept giving way.

Key takeaways

A newly public exploit called Certighost lets an ordinary low-privileged Windows account seize control of an entire company network; Microsoft's July patch fixes it.
Three separate flaws this week shared one shape: a boundary meant to contain a break-in - user versus admin, one cloud tenant versus another - failed and let a small foothold reach everything.
Big breaches kept landing (3.5 million Texas school staff, 1.26 million medical-billing records); if you get a notice, set a fraud alert and never reuse passwords.

The scariest security flaws are not the ones that let a stranger in. They are the ones that turn a small foothold into total control. This week produced a clean example, and researchers handed the world a working recipe for it.

The low account that becomes the master

On July 24, two researchers who go by H0j3n and Aniq Fakhrul published a working exploit for a Windows flaw they named “Certighost” [2][3]. The trick: an ordinary, low-privileged company account can quietly obtain a certificate that lets it impersonate a domain controller [1][2]. A domain controller is the machine that holds the keys to a Windows network - it decides who is who and who can do what.

Once an attacker can act as that machine, they can pull the network’s master password secret and, from there, unlock everything [2]. Microsoft calls the underlying issue improper authorization and rated it 8.8 out of 10 [2]. It patched the flaw, tracked as CVE-2026-54121, ten days before the exploit went public, as part of a record 622 fixes in its July update [1]. A CVE is just a catalogue number the industry uses so everyone means the same flaw.

The important detail is not the certificate machinery. It is the shape of the failure. Exploiting Certighost needs no administrator rights and no user interaction - a plain company account is enough [2]. The whole point of giving a normal user a normal account is that it can only reach a little. This flaw erased that line, so one weak seat became the master key.

A week of walls that gave way

Certighost was not alone. The same pattern - a boundary that was supposed to contain damage failing to - showed up three times this week.

Check Point, which makes firewalls used by large organisations, patched a flaw in its management console that attackers were already using [4][5]. The bug let an unauthenticated attacker grab a login token and sign in with full administrative privileges, then change the very security policies meant to keep intruders out [4]. It scored 9.3 out of 10 and was under active exploitation before the fix [4][6].

Microsoft also closed a hole in Azure Automation, a cloud service companies use to run scripted admin tasks [7]. A public-by-default setting could let an attacker with their own account cross into a different customer’s space entirely - reaching another company’s data, credentials, and cloud workloads [7]. Rated 9.9 out of 10, it broke the wall between separate tenants that is supposed to keep every customer sealed off from every other [7].

Three flaws, one lesson. The barriers that should keep a break-in small - user versus admin, one tenant versus another, logged-in versus locked-out - are exactly what attackers aim to dissolve.

The defenders’ answer: build the walls back

The same week, the US and Australian cyber agencies published guidance pointing the other direction [8]. Titled “CI Fortify,” it urges operators of critical infrastructure - water, power, transport - to prepare to isolate their vital control systems during an attack [8]. The idea is to be able to cut the machinery that runs a water plant or a grid off from the corporate and internet-facing networks around it. Then a breach in the office cannot spread to the pumps [8]. CISA, the US cyber-defence agency, warned that state-backed groups routinely burrow into infrastructure to hold access for a future crisis [8].

That is the constructive half of the week’s story. If Certighost shows what happens when the internal walls fail, the guidance shows the fix. Decide in advance which systems must never be reachable from a compromised one, and build the ability to cut them off.

The breaches that kept coming

Underneath the structural flaws, the ordinary drumbeat continued - and it is a reminder of what sits inside these compartments. A breach exposed the data of about 3.5 million teachers and employees in Texas [9]. A medical billing firm, MCBS, disclosed that a 2025 intrusion touched 1.26 million people, with patient records from several healthcare providers caught up in it [10].

In Australia, Origin Energy confirmed a breach. A hacker claims to hold the records of two million customers and is threatening to leak them, though the full scope is not yet confirmed [11]. A leak exposed the personal tax records of some 20 million Russians [12]. Coca-Cola said its dairy subsidiary Fairlife suffered data theft and production outages after a July ransomware attack - malicious software that scrambles a victim’s files and demands payment [13].

For any one of these, the ordinary-person action is the same and dull. If you get a breach notice, place a fraud alert and watch for scam messages that use the leaked details to sound legitimate. And never reuse a password across accounts. One stolen password is how a single breach quietly becomes five.

02 · Lesson · why it matters

Why the smart question isn't "can they get in" but "how far can they get"

Every account is a room in a building; the danger isn't the break-in, it's whether the intruder finds one door that opens all the others.

The break-in was never the surprise

Read enough security news and one thing stops shocking you: attackers get in. A password leaks, a flaw slips through, someone clicks the wrong link. Getting in is not rare. It is the weather.

So the flaws that actually frighten the people who run networks are not the ones that let a stranger through the front door. They are the ones that let a small intruder reach everything. This week’s Certighost flaw is the clean case. It did not hand an attacker the front door. It handed an ordinary, low-level company account the ability to become the master account for the whole network. No admin rights needed, no clever trick - just a certificate the system should never have issued.

That is the fear made concrete. Not “someone got in.” “Someone got in through the smallest door, and the smallest door reached the biggest room.”

The idea with a boring name

The defence against that has a name so plain it sounds like nothing: least privilege. Give every account, every program, every service exactly the access it needs to do its one job, and not a scrap more. The cleaner in the office building gets a key to the supply closet, not to the vault. The reason is simple. If the cleaner’s key is copied, you lose the mop bucket, not the money.

The mirror image of least privilege is blast radius - how far the damage spreads when, not if, one part is breached. A network built on least privilege has a small blast radius. Break one account and you reach one room. A network where accounts carry more than they need has a large one. Break one account and the shrapnel travels.

You already live inside this idea. A hotel keycard opens your room, not every room. A bank teller can hand you cash but cannot approve a mortgage. A ship is built with watertight compartments so a single hole floods one section, not the whole hull. None of these stop the leak. They stop the leak from becoming the sinking.

Why the walls quietly come down anyway

If compartments are so obviously wise, why did three separate flaws this week come from walls that failed? A low account reaching the domain controller, one cloud customer crossing into another, an unauthenticated visitor gaining full admin.

Because least privilege is expensive in the currency that runs organisations day to day: convenience. Giving a service account broad access means it never gets stuck. Letting one login work everywhere means fewer support tickets. Running everything under a single powerful account is simply easier to set up and faster to fix. Every one of those choices is rational on an ordinary Tuesday, when nothing is on fire.

The cost of that convenience is invisible until the day of the breach. Then the same broad access that saved a hundred small headaches becomes the highway the attacker rides to everything. The trade-off is real, but it is paid at two different times - the saving comes daily, the bill comes once, later, and much larger. That gap is why networks drift toward too much access. Nobody decides to build a fragile system; they make a hundred sensible small choices, each of which shaves a wall a little thinner.

Not the same as stacking guards

It is worth being precise, because there is a neighbouring idea that sounds similar and is not. Stacking guards - a password, then a second code, then a check on the device - is about the front door. More gates, so a break-in has to beat several at once. That reduces the chance anyone gets in.

Least privilege assumes that failed and asks a different question: once they are in, how much can they touch? One is about the number of locks on the way in. The other is about the size of the room behind the lock. A building can have five locks on the front door and still be one open hall inside - hard to enter, catastrophic once entered. The genuinely resilient design does both: hard to get in, and small once you are.

What you are standing inside

Here is the part that reaches past the network diagram. Your data - your medical records, your tax file, your employer’s copy of your details - sits inside someone else’s compartments, arranged by choices you never saw. When a company runs its whole operation on one master account for convenience, your records are one breach away from strangers. And you were never in the room when that trade-off was made.

The breaches this week make the point without trying. About 3.5 million school staff in Texas, over a million medical-billing records, two million energy customers in Australia. Each of those people is a node inside a system whose blast radius was set by someone else’s sense of what was worth the effort. The domain controller that Certighost targets is not an abstraction. It is the single room that, if it falls, takes the rest with it, in networks that hold ordinary lives.

Seeing this does not make you safe. Almost none of the walls are yours to build. But it changes what you notice. The next breach headline is not really a story about how they got in. Everyone gets in. It is a story about how far they got. And that distance was decided long before, quietly - by how many walls someone chose to keep, and how many they let come down.

03 · Lab · your turn

Contain the blast

Set how much access each account carries, trigger a break-in, and feel how least privilege shrinks the blast radius while broad access lets one foothold reach everything.

04 · Hope · carry this

The same week that showed how far one weak door can lead, the people who defend these networks were quietly publishing the map for building the walls back - proof that for every hole found, someone is already at work making the next break-in reach less far.