The Email Was Never Opened. Nobody Clicked Anything. The Mail Server Was Still Compromised.
Active Exploitation Zero-Click October 2026 · 6 min read The employee didn't click a link. There wasn't one. They didn't open an attachment, enter a password, or even read the message. The email simply arrived. Under one specific, vulnerable configuration, that alone was enough. You train every employee not to open a suspicious envelope. What happens when the mailroom itself can be triggered by the envelope just arriving, before anyone carries it upstairs? Nearly every piece of cybersecurity advice a small business hears starts the same way: don't click the link, don't open the attachment, don't enter your password on a fake page. It's good advice. It's also advice that assumes a human has to do something wrong first. Microsoft's security research team published findings on September 30, 2026 describing a vulnerability where that assumption simply doesn't apply....