This week, attackers turned trusted systems into control paths—from water PLCs and firewall managers to cloud calendars, certificate authorities and autonomous agents. The lesson is larger than patching: defenders must map, monitor and revoke delegated trust.