Salesforce just bought Braze for $5.66 billion, two different security vendors independently clocked a calendar-invite phishing technique exploding by four-digit percentages, and Italy's privacy regulator is about to make open-tracking pixels a consent problem for anyone sending into the country. It's a lot. Let's get into it.
Salesforce announced it's buying Braze for $5.66 billion, folding another major customer-engagement platform — email, SMS, WhatsApp, push — into Marketing Cloud. The deal is expected to close in Salesforce's fiscal 2028, pending shareholder and regulatory approval. Braze serves roughly 2,770 customers, including Canva, Instacart, Venmo, Urban Outfitters, Dairy Queen and Equinox.
Deliverability veteran Al Iverson is already flagging the question that matters more than the price tag: nobody knows yet what happens to Braze's sending infrastructure, IP reputation, and deliverability team once this closes. That's not a rhetorical question — it's the one that determines whether your Braze-sent mail keeps landing in the inbox two years from now.
We've seen this movie before with other martech roll-ups. The acquisition always gets the headline; the sending infrastructure consolidation always gets buried in a "platform migration" email eighteen months later. If you're a Braze customer, start asking your account team now who owns deliverability post-close — don't wait for the migration notice.
Source: Spam Resource, Reuters via Investing.com, StreetInsider
Sponsor this newsletter
Reach 241 people who build and run email.
This spot — and the next 1 week after it — are open. One sponsor per issue, no competing ads — your logo, your words, and a link, right here in the middle of the read.
See rates and availability →Here's the number that should get your attention: Sublime Security measured a 1,216% month-over-month jump in calendar-invite phishing in August 2026, and the first half of September already exceeded all of August by another 1,426%. Check Point, working independently, clocked volume rising from a few thousand per month in April to 118,000 in September — and over 740,000 in just the first two weeks of October.
When two separate vendors' fresh telemetry point to the same attack vector in the same month, it's usually real. The mechanism is the structural gap everyone keeps forgetting about: a .ics calendar invite lands in both the inbox and the calendar app. A quarantined phishing email can still surface as an innocuous meeting reminder that the recipient clicks from their calendar — completely bypassing the mail client and whatever your SEG does there. Attackers are mostly going after Microsoft credentials, using free services like Google Calendar and Framer as the delivery vehicle.
If your anti-phishing stack scans inboxes but not calendar entries, this is the gap actively being exploited right now, not a theoretical one. Audit whether your security tooling actually covers calendar invites before your next incident does it for you.
Sources: Help Net Security, TechRadar Pro
Microsoft's October 13 Patch Tuesday updates — KB5126646, KB5126655, KB5126651, and KB5126868, spanning Windows Server 2016 through 2025 — are disrupting Exchange Server 2016, 2019, and Subscription Edition. Admins are seeing blocked OWA sign-ins and undelivered mail, and it's happening even on systems that haven't installed the latest Exchange-specific cumulative updates.
Microsoft's guidance is a workaround, not an uninstall — don't roll back the security update to fix your mail flow. That trade isn't worth making.
If you run on-prem Exchange, this is a Monday morning crisis call waiting to happen if you haven't already hit it. Check your OWA sign-in and mail queues now, apply Microsoft's documented workaround, and don't assume "we didn't patch Exchange this cycle" means you're safe — the OS-level update alone is enough to break things.
Sources: Cyber Security News, BleepingComputer
Microsoft brand impersonation jumped to 33% of all tracked brand-phishing attempts in Q3 2026, up from 23% in Q2. Apple and Google are tied for second at 8% each. The top five brands — Microsoft, Apple, Google, LinkedIn, and Amazon — now account for over half of all brand-phishing volume, and tech is the single most targeted vertical, ahead of social networks and banking.
The nuance worth knowing: attackers have started impersonating AI tools themselves — a fake Claude payment-failure email and a fake Google Antigravity install-command lure, both aimed squarely at developers and AI-platform users rather than the usual finance/HR targets.
Brand-impersonation training built entirely around invoice fraud and IT-helpdesk lures is already behind. If your phishing-awareness program hasn't added "fake AI tool billing/install emails" as a category, it's time.
Source: Check Point Blog
Eight days from this issue, Italy's data protection authority closes out its grace period on tracking pixels. The Garante classifies open-tracking pixels as a form of access to a recipient's device, which means prior opt-in consent is required for any pixel used for open-rate measurement or behavioral analysis in marketing email. New contacts collected since April 29, 2026 already needed consent; the grace period for pre-existing contacts — informing them of pixel use in your next email and offering an opt-out — expires October 28.
The catch for anyone sending across multiple EU markets: France carved out a narrower exception where deliverability-only open tracking doesn't require consent. Italy didn't follow that model. Don't assume your France-compliant setup covers you here.
If you've got Italian subscribers and your pixel strategy hasn't been reviewed against this deadline, you're out of runway. Fix it before October 28, not after.
Sources: LCA Studio Legale, Maileon
Gmail's AI Inbox is moving from "AI on demand" to "AI by default." Instead of waiting for you to open a thread and ask Gemini for a summary, it proactively scans incoming mail and builds a running briefing of deadlines and status updates across your whole inbox. Gmail Live adds a voice interface for asking questions about your inbox and getting synthesized answers back. AI Inbox started rolling out to Rapid Release Workspace domains on October 12 and hits Scheduled Release domains October 26 — both features are US/English-only for now.
For senders, this is one more layer standing between your subject line and a human actually reading the email. AI Inbox summarization is the new "did they even see my email" problem, and it's arriving right as the attack side of AI inboxes is heating up too: Barracuda recently found phishing emails now carrying two separate payloads in one message — conventional social-engineering bait for the human reader, plus hidden prompt-injection text (HTML comments, zero-width characters, Base64 blocks) aimed at the AI assistant that triages the mail automatically.
Both halves of the inbox are becoming AI-mediated at the same time — the reading and the attacking. Worth watching how fast that arms race moves once AI Inbox is fully rolled out.
Sources: Google Workspace Updates blog, emailexpert
p=none. Security Boulevardaspf=r or risk breaking legitimate transactional mail. dmarcian
|
That's the week. Heaviest items: a $5.66B acquisition that raises real deliverability-continuity questions, and a phishing technique that two vendors independently confirmed is exploding by quadruple-digit percentages. If something is wrong, reply and tell me — I read every response.
— John
This Week In Email — thisweekin.email
Subscribe to This Week in Email and get future issues delivered to your inbox.