Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address

A batch of high-impact DarkReading stories highlights multiple active exploit campaigns and supply-chain intrusions: a Microsoft Exchange 'Ghost‑Sender' spoofing technique affecting Exchange Online/hybrid setups; the Miasma supply‑chain worm compromising 73 Microsoft GitHub repositories; Russian actors weaponizing WinRAR (CVE-2025-8088) for cyberespionage against Ukraine; and a critical Check Point VPN zero-day under active exploitation (linked to Qilin ransomware). Also reported: an exploited Palo Alto PAN-OS/GlobalProtect auth‑bypass under active attack, expanding phishing and TDS campaigns(