The IT Nerd

Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a critical flaw in Microsoft Copilot Personal made of three chained weaknesses that let an attacker exfiltrate data from a victim’s connected accounts, Gmail, Google Drive, Calendar, with a single click on a malicious link, discovered by researchers who questioned Copilot’s own reasoning rather than attacking its code until it disclosed an undocumented URL parameter and the protections meant to block it. Microsoft patched the flaw August 18, 2026, after Varonis reported it in December 2025 with no evidence of exploitation before the fix shipped, making it the third Copilot vulnerability Varonis has found this year.

Arti Raman, CEO & Founder of Portal26

“The exfiltration matters less than how the vulnerability was found. Researchers didn’t break Copilot’s code. They kept asking it questions until it explained its own bypass to them, an undocumented URL parameter, its own history of using it, and the protections meant to block it, all without ever touching the underlying software. The AI’s reasoning is part of the attack surface now, and most organizations have no visibility into what their assistant would say to a user, or an attacker, who kept pushing. This is the third Copilot flaw the same research team has found this year. That points to a structural gap in how these assistants get governed before they ship. You cannot govern what you cannot see, and right now almost nobody can see what their AI assistant would say under pressure.”

Anar Bayramov, Head of Product, Polygraf AI

“CoSnitch did a good job of finding the exploit. The researchers kept asking Copilot why a prompt wouldn’t run on its own, and it named the parameter, the conditions it worked under, and the protections that were supposed to disable it. The problem is that those protections weren’t set.  Everything after that is a mistake the industry repeats – Varonis found this in their Reprompt research, then in RovoBlast against Atlassian’s Rovo, and now in Copilot Personal.

Same idea every time: let a URL parameter seed the assistant’s prompt because it’s convenient for sharing. Once that parameter can execute inside a logged-in session, you’ve got CSRF with an LLM’s permissions. What’s more interesting is the memory. Microsoft addressed this attack class in June – sanitization on write, Task Adherence checks, memory updates surfaced in Defender, and scoped all of it to Microsoft 365. The consumer assistant, where an injected instruction survives password changes and session revocation without leaving a log entry, wasn’t covered by that guidance. The controls exist, but they just weren’t described for the product where this landed.”

The good news is that no user action is required to fix this. But it should make everyone question if having AI in house without the proper safeguards is worth it or not. I personally say not but I am free to be proven wrong.

UPDATE: Mark Mazur, Field CTO of Approov Mobile Security, offers the following comment:

   “CoSnitch proves that user authentication via OAuth isn’t enough when the execution client can be manipulated. Security teams must enforce Client and API Integrity alongside user identity, ensuring that every API request comes from a verified, untampered environment, preventing hijacked AI workflows from silently exfiltrating sensitive enterprise data.”

Microsoft says the growing volume of vulnerabilities identified with AI-powered security tools is contributing to delays in the first Cumulative Update (CU1) for Exchange Server Subscription Edition.

The Exchange team is prioritizing the validation, reproduction, remediation, and testing of newly reported security issues while continuing to release security updates each month.

Microsoft originally expected CU1 in the first half of 2026, later moving the target to the second half of the year. The company now says it has no release date, explaining that 

Steven Swift, Managing Director, Suzu Labs:

   “The problem with using AI to “find vulnerabilities” is that its relatively easy for a model to hallucinate that it’s found a vulnerability, and if  you try to use AI to validate the vulnerability, it will refuse to do so because of its safety tuning. This means teams that are trying to actually process and take these requests seriously end up with an impossible amount of work, trying to prove countless negatives.

   “On one hand, its a good sign that we’re being told security is being taken seriously. If delays are needed to avoid shipping known vulnerabilities, I generally support that. On the other hand, its very easy to blame AI for delays that are due to other factors. Its hard to tell which is which from the outside. Educated guess here is that Microsoft is looking at a bit of both. Its pretty easy to waste cycles on low value AI generated vulnerability reports, and its always easy to mis-manage a project, and end up behind schedule.

   “We should keep in mind that we’ve seen a steady increase in CVEs being published over the past 10 years, before AI became big. We already had a well established industry dedicated to vulnerability management, with tools designed to detect and help remediate vulnerabilities in code. Stacked on top of this now is vibe coded slop being pushed out in bulk by developers, who have been pressured to utilize AI in an effort to improve output. But while AI can push code out faster, it does not mean it does better.

   “AI is currently better at generating code and running test cases to validate functionality, than it is in proving that the code it wrote isn’t vulnerable. Part of this is training data and tuning. Its much more straight forward to validate functionality. There’s no test you can write that will prove a negative though. At best, you can match patterns and some known common weaknesses. As AI improves, it will get better at writing secure code. But if current trends hold, and models continue to refuse to validate potential vulnerabilities, it puts a cap on how useful models can be for detections.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “This is concerning. If we have so many vulnerabilities coming in that it’s actually delaying cumulative updates and patches from vendors, that’s a sign the system is starting to seize up a little bit.

   “And there’s a question that keeps rolling around in my head as we continue to see these issues with companies around the world. Did we really think AI was going to lower security headcount across the industry?

   “What we’re seeing is the opposite. AI is dramatically increasing the volume and velocity of security work that needs to be done. That means we’re going to need more security professionals, not fewer. And we especially need to be bringing in people at the junior level, training them, giving them experience, and building them into the senior security professionals we’re going to desperately need in the years ahead.”

Two experts get into why Lazarus exploiting a Windows zero-day is particularly concerning despite the vulnerability’s “Important” CVSS rating. And how kernel-level rootkits like FudModule can undermine the security tools defenders rely on, and what organizations can do when patching or traditional mitigations aren’t immediately possible.

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“This story highlights an important shift in how organizations need to think about defense. Effective cybersecurity can no longer be reduced to firewall rule changes, patching, and configuration updates. Those remain important, but they’re no longer sufficient on their own.

“Security teams need to start training for the moments when those traditional options aren’t available. What happens when a critical system can’t be patched? What happens when operational requirements prevent you from making firewall changes? Those situations are becoming increasingly common, especially in legacy environments and critical infrastructure.

“That’s where compensating controls become essential. Organizations should be regularly exercising these scenarios and asking, ‘What can we do today to reduce risk while we wait for a patch or a permanent fix?’ Whether it’s increased monitoring, network segmentation, deception technologies, stricter access controls, or enhanced threat hunting, teams need to understand which defensive options are available and when to deploy them.

“The goal of compensating controls isn’t to eliminate the risk. It’s to buy time. As zero-day vulnerabilities continue to emerge at a faster pace, organizations need strategies that slow attackers down and reduce their opportunities while vendors develop patches and defenders work to implement them.

“The organizations that will be most successful over the next several years won’t necessarily be the ones that patch the fastest. They’ll be the ones that have rehearsed how to operate safely when patching isn’t immediately possible.”

Denis Calderone, CTO, Suzu Labs (https://www.linkedin.com/in/deniscalderone)

“Lazarus has now exploited use-after-free vulnerabilities in Windows built-in drivers three times in two years to deploy the same rootkit. They went from appid.sys to AFD.sys to AFD.sys again. For a while, the standard playbook for getting kernel access was bring-your-own-vulnerable-driver: load a signed but buggy third-party driver, exploit it, get kernel privileges. Defenders adapted with driver allowlisting. Lazarus adapted by finding bugs in drivers that Windows ships by default. AFD.sys handles every socket operation on every Windows machine. You can’t blocklist it.

“Once the use-after-free fires, the attacker gets a kernel read/write primitive, and from there FudModule takes over. This is a rootkit that disables EDR callbacks, zeros out ETW provider registrations, and hides its own processes from the tools security teams rely on. The latest version, v3.1, adds the ability to tamper with Smart App Control, which means the rootkit is evolving faster than the mitigations Microsoft is building around it. And this CVE carries a CVSS 7.0, rated Important. There are 42 Critical patches in the same August Patch Tuesday release. If your vulnerability management program triages by severity score, this one is going to land in the middle of the queue behind remote code execution bugs that nobody has actually exploited yet. That’s exactly backwards.

“CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities catalog on August 11 with a federal remediation deadline of August 25, so needless to say, get this one patched right away, regardless of the CVSS score. Given that Lazarus had at least five weeks of active exploitation before the fix shipped, organizations in defense, aerospace, and adjacent sectors should be particularly diligent and treat anything unpatched since early July as potentially compromised. Check Point’s report includes the full IOC list covering file hashes, C2 domains, and the specific malware components used in the campaigns. Hunt for evidence of the MISTPEN downloader. It beacons out using Microsoft Graph API and OneDrive traffic, so look for anomalous indicators from workstations that don’t typically use those tools. Also look for unsigned DLLs loaded alongside legitimate PDF viewers and any evidence of ETW provider or kernel callback manipulation. Lazarus has shown that it’s possible to render EDR telemetry useless from the kernel level, and too many defenders still treat their EDR as a single source of truth. That dependency is exactly what FudModule is built to exploit.”

China-linked hackers exploiting a critical vulnerability in Microsoft’s software and turning that access toward ransomware. While you can find out about the issue here, this is the TL:DR. Please read the entire chain:

Phillip Wylie, Chief Security Evangelist & Sr. Consultant, Suzu Labs (https://www.linkedin.com/in/phillipwylie)

“The biggest takeaway isn’t just another critical vulnerability – it’s that attackers are increasingly targeting the tools organizations trust most. RMM platforms, identity systems, and security products provide privileged access by design, making them ideal force multipliers for threat actors. Organizations should treat these platforms as crown-jewel assets, prioritize rapid patching, closely monitor privileged activity, and assume that even trusted management infrastructure can become an attack vector.”

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“This particular attack fits into China’s broader cyber great power initiative that they’ve been working on for well over a decade, building the capability to exploit and gain access to as many systems as possible. I tend to think this particular attack was triggered by the vulnerability being discovered. China may have already been exploiting it for some period of time before the vendor publicly disclosed it on July 31.

“And this gets into a larger question that I think we need to ask whenever we see nation-state attacks suddenly transition into ransomware campaigns. What were they doing before?

“Remember, with a nation state like China, Russia, or even the United States, the primary goal generally isn’t ransomware. The goal is access. They want to dwell inside environments and maintain that access for as long as they possibly can. The way this particular attack has been linked to China leads me to believe the vulnerability may have been used for that type of access and persistence for some period of time. But once the vulnerability became public and a patch was available, its usefulness for longer-term nation-state operations dropped significantly. At that point, you might as well transfer the capability over to ransomware operations and extract whatever remaining value you can from the vulnerable systems that are still out there.

“There’s another issue here involving the vendors we choose for core security technologies, especially RMM tools. We really need to question whether we should be self-hosting these systems at all. If it’s a cloud service, the provider can potentially patch and update that service very quickly across its entire customer base. If you’re self-hosting it, you’re now dependent on your own organization getting that patch deployed as quickly as possible. And that matters here. Some of the research we’ve been seeing indicates that more than 25% of these servers may still be unpatched and vulnerable to this attack.

“Once again, this highlights one of the major problems with on-premises technology when a serious vulnerability drops. Getting a patch is one thing. Getting that patch deployed everywhere fast enough to matter is something completely different.”

The threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the CISA KEV catalog on August 3, 2026. You should apply all updates to your Windows systems and Microsoft Defender for Endpoint detects this activity. So update that too.

Microsoft’s record Patch Tuesday isn’t just a milestone – experts say it won’t hold the record for long. This explains why AI is accelerating both software development and vulnerability discovery, why security teams are facing a growing prioritization challenge rather than simply a patching problem, and why organizations will need to rethink traditional approaches to patch management as vulnerability volumes continue to climb.

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“I think we’re just in the beginning stages of the crush of vulnerabilities that’s going to come from vendors across the industry. The Copilot vulnerability with a 9.6 CVSS score is one that many organizations could easily overlook, but the bigger issue is that this pace isn’t slowing down. Microsoft has one of the most mature and automated patching ecosystems in the world, and even then organizations struggle to keep up. Most vendors aren’t anywhere near that level of maturity, which means security teams are going to be increasingly overwhelmed trying to patch AI-related vulnerabilities across dozens of different products.”

Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)

“Six hundred vulnerabilities in a single patch cycle is not a backlog problem, it is a prioritization crisis waiting to happen.

“The CVE count is noise unless you map it against what you are actually running, what is reachable from outside your perimeter, and whether there is confirmed exploitation in the wild, because the actively exploited zero-days in Active Directory and SharePoint deserve your engineers this week, not your ticketing system next quarter. Patch management that treats a record-breaking advisory like a queue to be worked through sequentially will lose, and it will lose to adversaries who read the same bulletin and go straight to the vulnerabilities that matter.”

Jacob Krell, Sr. Director, Secure AI Solutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)

“622 is the biggest Patch Tuesday on record. It won’t hold the record long, because AI is inflating both sides of the vulnerability equation, generating more code that introduces more bugs while scanning existing codebases faster and turning up what humans missed. Microsoft told customers to expect rising volumes from its AI scanning tools, and the trajectory already proves it, June broke the all-time record at 206, July tripled it. Adobe moved to twice-monthly security releases for the same reason.

“That volume changes how patching has to work. The manual process of reading every advisory, scoring by CVSS, and testing in a lab was built for monthly batches of 60, and at 622 it breaks before lunch. What still works is triaging by active exploitation, so the two zero-days in Active Directory Federation Services and SharePoint (CVE-2026-56155, CVE-2026-56164) go first because attackers are already using them to escalate privileges. Anything on CISA’s Known Exploited Vulnerabilities list goes next, then filter by your own attack surface, whether the service is internet-facing, whether the vulnerability chains with existing exposure, and whether it touches identity infrastructure.

“Counting CVEs tells you volume, not risk, and the tools most organizations rely on to tell the difference are failing. Microsoft’s own exploitability index rated this month’s SharePoint zero-day as “exploitation less likely” the same month it landed on CISA’s KEV list as actively exploited. AI models can already produce working proof-of-concept exploits for vulnerabilities that traditional frameworks score as low-priority, which means the scoring systems were calibrated for a human-speed world that no longer exists. Organizations need to match machine-speed discovery with machine-speed defense, because the patch count will keep climbing whether they’re ready or not.”

Patching is one avenue towards addressing this. But organizations need to take a more holistic approach in terms of addressing vulnerabilities in their environment. And the sooner the better.

In The Reverse Information Paradox, coined by Microsoft Chairman and CEO Satya Nadella, he warns that organizations pay for AI twice: once in cash (subscription fees), and again in proprietary knowledge. In doing so, they risk giving away valuable knowledge. Enterprises need greater control over their data and said that a company should be able to use a model without giving up the knowledge that makes it unique – a reverse information paradox we need to confront.

Rohit Valia, CEO of cybersecurity company Tumeryk, provided the following comments: 

“Satya Nadella’s The Reverse Information Paradox is the talk of tech because it uncovers an uncomfortable truth: using Palo Alto Networks, Sentinel One, CrowdStrike or another Security-as a-Service solution means that you’re giving up your intellectual property to another company’s AI. Regulated companies and government organizations need to select security providers that operate within your cloud infrastructure, ensuring no prompts or proprietary data leaves your organization. Prompts are your data.”

While organizations rely on AI, they should not be under the illusion that AI is a free lunch. On the contrary it is the opposite. Organizations may want to keep that in mind.

Frequent readers of this blog won’t find this new. But some of you will which is why I am covering it. For years fake Microsoft alerts have popped up via surfing around. But what makes this campaign unique is that these fake popups have been used to deliver North Korean-linked NarwhalRAT. This is another reminder that attackers don’t always need sophisticated exploits to compromise organizations. Increasingly, threat actors are succeeding by impersonating trusted brands, security notifications, and software providers to manipulate user behavior and bypass traditional defenses. The malware itself is only part of the story. The real challenge is that users are being asked to make security decisions in environments where legitimate and malicious prompts can look nearly identical.

Cybernews for example has details:

The infection begins with a spear phishing email pretending to be an urgent security alert from the “Microsoft Account Team.”

The message warns the recipient about suspicious one-time password activity and directs them to open an attached advisory document. In reality, the attachment is a ZIP archive hiding a malicious LNK shortcut file, not a real document.

Analysts at Genians Security Center said in a report shared with Cyber Security News (CSN) that this threat bears strong similarities to a Python-based backdoor campaign documented in May 2026.

Researchers named the malware NarwhalRAT, drawing on the string “naverwhale” found inside its code, believed to be an attempt to masquerade as Naver Whale, a popular browser in South Korea.

The malware primarily targets Korean users, and its behavioral structure confirms this. NarwhalRAT uses “naverwhale” as its working directory name and assigns Hidden and System file attributes to the created folder to stay out of plain sight.

It also handles KakaoTalk-related window identifiers separately during data collection, strongly pointing to Korean targeting. 

The threat actor operated a dual command-and-control structure using a Korean relay server alongside the pCloud API as a Dead-drop Resolver. This lets the attacker change the actual C2 address without touching the malware, and helps traffic blend with normal web activity, making detection harder.

Yagub Rahimov, CEO, Polygraf AI

“It’s interesting to see what NarwhalRAT tells us about where APT37 is focusing on. This group was almost entirely on RokRAT, it was their signature, basically the thing analysts used to point to them. Moving to a new Python-based RAT helped them break that signature – it helps them to look like someone else.

Everything else in this campaign is built around being invisible, not getting in clever. All the attempts like, the LNK chain, the fileless in-memory execution or the Python runtime taken from the official site – none of it is interesting on its own. APT37 has been running using similar playbook for over a year. What’s interesting is the attention to details. Wiped timestamps, a staging directory named to impersonate Naver Whale, persistence through a scheduled task with a name designed to blend into legitimate Windows entries. Every decision was trying not to trip anything that watches disk or signatures. There’s nothing for traditional antivirus to grab onto because almost nothing touches the disk in a recognizable form.

A fake Microsoft account security alert warning about OTP abuse is almost perfectly designed, it uses the victim’s own security awareness against them. The more trained someone is to take account-security warnings seriously, the more likely they are to open the attachment. That’s what this attack relies on. Every technical layer can be defeated by detection eventually, but the entry point is a human being doing what they’ve been told is the responsible thing. That’s where the chain actually breaks.”

While this is targeting Korean’s, you can expect it to target you next. Thus if your charged with defending your organization from threats, consider yourself warned.

In a statement published yesterday, Microsoft warned that recent public disclosures of unpatched zero-day vulnerabilities without prior coordination have placed customers at “unnecessary risk.”  The company said several researchers disclosed vulnerability details publicly before Microsoft had an opportunity to develop and distribute security fixes.

The company said coordinated vulnerability disclosure allows vendors time to investigate reports, prepare mitigations, and release patches before technical details become widely available to attackers. Microsoft argued that premature disclosure can increase the likelihood of exploitation against customers who have no available patch or remediation at the time information becomes public.

The warning comes as Microsoft continues addressing multiple recently disclosed vulnerabilities across Exchange Server, Defender, Azure, Windows networking components, and enterprise products during an unusually high-volume patching cycle. Microsoft released fixes for 138 CVEs during May Patch Tuesday alone, while additional vulnerabilities and mitigations were disclosed outside the regular patch release schedule.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Coordinated disclosure is a shared obligation. Microsoft generates hundreds of billions in annual revenue. No researcher should be expected to subsidize product security for free. Six vulnerabilities across core Windows components including Defender and BitLocker that reached production represent a vendor engineering failure. These flaws should never have shipped. Vendors who ask for coordination must also invest in responsive triage and the development rigor that prevents this.

   “The traditional 90 day embargo was designed for a slower world. AI has compressed vulnerability discovery timelines so dramatically that ninety days is enough time for an entirely new frontier model to be deployed and pointed at the same codebase. Microsoft has patched over 500 CVEs in the first five months of 2026 alone. That volume is a signal that product security posture across the ecosystem is weaker than the market assumes. The Nightmare-Eclipse campaign has followed through on every public threat so far, and the warnings of further disclosures should be taken seriously.”

John Carberry, Solution Sleuth, Xcape, Inc.:

   “Microsoft’s sharp public rebuke against zero-day drops highlights an escalating war of attrition between independent researchers and enterprise vendors. While Microsoft argues that dropping vulnerabilities like RedSun, UnDefend, and BlueHammer puts the entire ecosystem at risk, this friction points to a deeper systemic breakdown. The security research community is clearly growing frustrated with vendor triage timelines, a bottleneck that has become critical given that Microsoft is already drowning in an engineering workload, evidenced by a massive 138-CVE patch cycle this month alone.

   “For enterprise risk leaders, this public spat is a dangerous distraction from the actual operational threat. The moment a researcher publishes full technical details or a working proof-of-concept for core Windows components like Defender, Azure, or Exchange Server, the time-to-exploit window for threat actors drops to zero.

   “Security executives cannot afford to wait around for vendor patches to slowly wind their way through QA and deployment pipelines. They must establish an aggressive, internal mitigation capability that treats uncoordinated disclosures as immediate, active incidents, forcing them to deploy temporary configuration workarounds and hyper-specific EDR detection rules the moment a flaw hits GitHub, long before the official automated fix arrives on a future Patch Tuesday.

   “Critical Takeaways

•    “The zero-day names to watch: The uncoordinated drops specifically targeting core architecture(RedSun, UnDefend, BlueHammer, and the YellowKey BitLocker bypass) are not theoretical exercises. They represent immediate blueprints that threat actors are actively integrating into automated scanning tools.
•    “Vendor triage under siege: Microsoft’s massive 138-CVE May release proves that vendor patch pipelines are stretched to their limits, systemically increasing the delay between a researcher’s initial private bug report and a public patch.
•    “The mitigation engineering mandate: Relying entirely on automated patch management leaves an enterprise completely exposed during uncoordinated drops. Teams must be structurally capable of manually applying complex, out-of-band scripts and registry mitigations.

   “When researchers choose to drop working exploit code for core enterprise infrastructure directly to the public, they are giving the entire Internet an immediate, unauthenticated pass into your network before a lock has even been engineered.

   “The current standoff proves that the traditional model of coordinated vulnerability disclosure is buckling under its own weight, leaving enterprise security teams stuck in the crossfire between impatient researchers and overextended software vendors.”

Lydia Zhang, President & Co-Founder,Ridge Security Technology Inc.:

   “The number of CVEs patched by Microsoft on Patch Tuesday highlights the challenge facing security teams which is, what should I be prioritizing?   Security tools that just identify vulnerabilities are insufficient.   In fact, even knowing that a vulnerability is exploitable is insufficient.  Knowing the kill-chain is insufficient.  The missing piece of the puzzle is combining that exploitability and kill-chain knowledge with business context such as what assets can be reached thru these exposures and how valuable are those assets?”

My only advice is to hold companies like Microsoft accountable. Otherwise we will have vendors deciding what is and isn’t public domain. Which is of course dangerous.

So over the last few days, the Internet has been losing its mind over the fact that Microsoft on July 13 2026, Microsoft Office 2021 and 2019 for Mac will only be able to open files. But they cannot save them. This is documented here. And the reason for this is an expired certificate. If you want examples of how people are losing their minds over this, take this Reddit thread or this one to see what I am talking about.

But is the outrage justified? I am not sure because I can see this from both sides.

On one hand, Office 2019 for Mac has reached the end of support in October 2023. That means that it is not receiving security updates or bug fixes. Office 2021 for Mac will be in the same state in October 2026. So users realistically should be installing either Office 2024 or using Microsoft 365 as it’s never a good idea to run unsupported software as that’s a gateway for threat actors to pwn you.

On the other hand, many people on Reddit feel that this is anti consumer as comes across Microsoft deciding to effectively kill a license that they paid for. Also they feel that Microsoft could easily come out with a software update that addresses the certificate issue. But clearly they don’t want to do that. And forcing users to pay for an upgrade is good for Microsoft’s bank account.

Mac users have a few choices if they are in this situation:

• Upgrade to Office 2024 or Microsoft 365. I should note that Microsoft 365 is currently free via the web version of the suite. So that’s a free alternative if you have constant access to the Internet.
• Use Apple’s iWork suite as it is free for normal use.
• Switch to an open source alternative such as LibreOffice. 

A few random thoughts. I have said for years that that hell hath no fury as an Apple user scorned. Microsoft may be about to find this out shortly as this is unlikely to go away. Also, these Mac users who are outraged need to recognize that there are options for them and they should look into those alternatives ASAP. Because running these versions of Office is not going to be an option.