29 minutes. Not the problem.
Per The Hacker News, a leftover debug flag in Microsoft 365 Android apps disabled account-token sharing checks, while SecurityWeek confirms this setting bypassed protections for billions of installations.
The technical mechanics: any app on the same phone could request and obtain the signed-in user's token, allowing unauthorized access to emails, files, calendars, and messages without passwords or permission prompts.
This incident reveals what everyone reads as a "vulnerability problem" is actually a "development governance failure". According to industry benchmarks, 82% of detections were malware-free in 2025, up from 79% in 2024 (CrowdStrike Global Threat Report 2026), underscoring the need for secure development practices.
The defensive math: -> Implement secure coding reviews to catch leftover debug flags, with a target of 100% code coverage within the next quarter. -> Enforce token-sharing restrictions to trusted Microsoft apps only, using techniques like code signing and permission validation. -> Conduct regular security audits of production builds to identify and rectify similar configuration weaknesses, aiming to reduce mean time to remediation by 30 days.
Can your development team commit to code reviews that prioritize security over speed?