CVE-2026-69836, a CVSS 10 Entra ID remote code execution flaw, was exploited in the wild. Microsoft has fully mitigated it server-side.

#CVE202669836 #EntraID #RemoteCodeExecution #Microsoft #CloudSecurity #RCE

https://securityonline.info/cve-2026-69836-entra-id-rce/?utm_source=mastodon&utm_medium=jetpack_social

「Microsoft Entra IDの脆弱性（CVSS 10.0）が実際に悪用され、リモートコード実行が可能になる 」： #TheHackerNews

「マイクロソフトは木曜日、Entra IDに重大なセキュリティ上の欠陥があり、既に悪用されていると警告したが、顧客による対応は不要であると述べた。

CVE-2026-69836 （CVSSスコア：10.0）として追跡されているこの脆弱性は、 リモートコード実行によって、このテクノロジー大手企業のクラウドベースのIDおよびアクセス管理サービスに影響を与える事例です。このサービスは以前はAzure Active DirectoryまたはAzure ADと呼ばれていました。

マイクロソフトは木曜日に発表した警告の中で、 「Microsoft Entra IDにおける信頼できないデータの逆シリアル化により、権限のない攻撃者がネットワーク上でコードを実行できる可能性がある」 と述べた。 」

https://thehackernews.com/2026/08/microsoft-entra-id-flaw-cvss-100.html

#prattohome

Microsoft has patched a maximum-severity vulnerability, designated as CVE-2026-69836, within the Entra ID identity platform that previously allowed unauthorized remote code execution. No user action is required as the company has already mitigated the flaw.
https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-max-severity-entra-id-flaw-exploited-in-attacks/

Entra ID : une faille critique a été exploitée, mais vous n’avez rien à patcher https://www.it-connect.fr/entra-id-cve-2026-69836-faille-cvss-10-exploitee/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #EntraID

GitLab : la faille critique CVE-2026-19478 est déjà exploitée, deux jours après le correctif https://www.it-connect.fr/gitlab-cve-2026-19478-faille-critique-exploitee/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Explotan activamente la vulnerabilidad CVE-2026-19478 de GitLab pocos días después de su publicación

https://blog.elhacker.net/2026/08/explotan-activamente-la-vulnerabilidad.html

⚠️ Unauthenticated attackers could turn Elementor Pro uploads into RCE.

CVE-2026-32475 lets an attacker skip the file-extension blocklist and upload PHP when a published Form widget has a File Upload field. Elementor fixed it in 4.2.2.

Read: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html

Elementor Pro : une faille critique permet de prendre le contrôle d’un site WordPress https://www.it-connect.fr/elementor-pro-cve-2026-32475-rce-non-authentifiee/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Wordpress

「Elementor Proの重大なバグにより、WordPressサイトがリモートコード実行攻撃に晒される 」： #BLEEPINGCOMPUTER

「WordPressプラグイン「Elementor Pro」に存在する重大な脆弱性により、攻撃者が実行可能ファイルをアップロードして、サーバー上でリモートコードを実行できる可能性がある。

CVE-2026-32475として識別されたこの脆弱性は、Elementor Proのバージョン4.2.2より前のバージョンに影響し、ファイル検証と処理に別々のループを使用するファイルアップロードモジュールに起因しており、ファイル名が空のアップロードの処理方法が異なっています。」

https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/

#prattohome

CVE-2026-32475 (CVSS 9.8) is an unauthenticated file upload flaw in Elementor Pro. It threatens complete site compromise across 6 million sites.

#ElementorPro #CVE202632475 #WordPress #RCE #FileUpload #WebSecurity

https://securityonline.info/cve-2026-32475-elementor-pro-file-upload/?utm_source=mastodon&utm_medium=jetpack_social

「Citrixは、NetScalerの新たな脆弱性をできるだけ早く修正するよう管理者に強く求めている。」： #BLEEPINGCOMPUTER

「Citrixは、NetScaler GatewayセキュアリモートアクセスソリューションとNetScaler ADCネットワークアプライアンスに影響を与える2つの脆弱性からシステムを保護するため、顧客に対し直ちにセキュリティ対策を講じるよう警告した。

2つのうちより深刻な脆弱性（ CVE-2026-19490 として追跡）では、NetScalerのファームウェアバージョンとSAMLアクションが構成されているかどうかに応じて、アプライアンスがAAA仮想サーバーまたはゲートウェイ（SSL VPN、ICAプロキシ、CVPN、RDPプロキシ）として構成されている場合に、権限を持たないリモート攻撃者が認証をバイパスできる可能性があります。 」

https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible/

#prattohome

Critical Alert: CVE-2026-72529 allows unauthenticated command execution on TrueConf Servers. Our T-SUITE report maps the attack surface and provides immediate hardening steps to secure your perimeter. Read the full brief here. https://thecybermind.co/jily

CISA confirms two TrueConf Server flaws, CVE-2026-72529 and CVE-2026-72530, are exploited in the wild to deliver PhantomCore malware. Patch now.

#TrueConf #CVE #ExploitedInTheWild #PhantomCore #HeadMare #InfoSec #PatchNow

https://securityonline.info/trueconf-cve-2026-72529-exploited/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

Clop ransomware operators deployed a custom JSP web shell targeting PTC Windchill and FlexPLM servers, exploiting CVE-2026-12569 to decrypt stored credentials and exfiltrate engineering data. Any organization running vulnerable Windchill instances is at immediate risk of credential compromise, late…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CRITICAL: CVE-2026-77776 in Headroom Labs Headroom (<0.36.1) allows unauth'd attackers to spoof x-headroom-user-id and access/modify any user's LLM memory. Default configs expose this via 0.0.0.0 binding. Restrict access & use auth tokens. https://radar.offseq.com/threat/cve-2026-77776-authorization-bypass-through-user-controlled-key-in-headroom-labs-headroom-0c2eff15c1a3dc1f #OffSeq #CVE #infosec #LLM

CVE-2026-77776 - Critical IDOR in Headroom LLM proxy. Spoof x-headroom-user-id to read/write other users' memory. CVSS 9.1. No patch yet - restrict access now. #CVE #Headroom #infosec

https://www.valtersit.com/cve/CVE-2026-77776/

This Week in Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, and Comcast Senses Movement

Apple has started sending some users push notifications warning that they have been targeted with specific malware. No specific information about the threat Apple detected is available. While multiple iOS attacks were released in spring of 2026, they all target much older versions of iOS and older hardware versions.

Users in 110 countries have received notifications recently, warning them they may have been targeted or already impacted by malware such. Apple typically uses the crash reporting mechanism for system apps to track new attack trends. The majority of users will likely never see an alert from Apple because malware with state-level capabilities like the Pegasus family is extremely expensive to develop. However, commercial availability means that some governments have deployed them against political opponents, protesters, human rights lawyers, and journalists.

If Apple pushes a security alert, it will show up as an email and a standard system notification, but also as a notification inside the Settings application. While email and notifications can be spoofed as part of phishing attempts, to date there is nothing which can generate false alerts inside Settings.

Almost universally in these cases, Apple recommends enabling “Lockdown Mode“, which adds extra protection to devices at the cost of decreased battery life and slower performance. Lockdown mode disables custom fonts on web pages, accelerated JavaScript, restricts message attachments over SMS and iMessage, and disables other common paths used by malware to steal data. Android devices offer a similar feature since Android 15 that is less comprehensive but can still provide additional safeguards for users directly at risk.

Attacking Airplane Networks

With research that will surely result in some breathless reports, researchers presented at Usenix 2026 an attack against the communications bus of a Boeing 737.

The ARINC 429 bus is a communications architecture for planes, similar to the CAN bus used in cars. Once you are connected to that bus, it can be vulnerable in the same ways cars can be vulnerable to data manipulation. In the Usenix paper, researchers discovered that one access port to the airplane communications system is easily reached from the outside of the plane, though “easily” in this context means “by airplane maintenance technicians”. The paper represents over a decade of work by the team in obtaining and building a test lab of avionics equipment to represent an actual airplane, culminating in an embedded device described as “the size of a quarter” that plugs into the communications port and provides remote access over WiFi.

It needs to be emphasized, given other recent news, that this is a piece of hardware being added to the plane which communicates over WiFi, and not a way to attack an unmodified plane via passenger WiFi!

Once part of the ARINC bus, it seems access is basically unfettered: the team describes being able to reprogram the autopilot, feed the pilot displays false data, and being able to modify the temperature and weight data shown, which could lead to miscalculations in take-off speeds with obviously catastrophic results. Fortunately, the researchers have also been working with Boeing since 2020 to address the issues being found, and the practicality of the attack in the wild remains largely theoretical. The research team has recommended removing the external ports in future aircraft, and blocking access to them physically, like with epoxy, in the current designs.

If reading security research papers is your kind of fun, be sure to check out the rest of the papers that were part of Usenix 2026.

Copilot Reveals Secrets

Microsoft Copilot was tricked into executing hostile prompts without user intervention, and the team that accomplished it used Copilot itself to expose the vulnerability.

Copilot has a set of guardrails in place intended to safeguard against disclosing private information. Given the initial question — asking how to submit a prompt without the user confirming — the model said this was impossible. Over the course of many questions, researchers at Varonis were able to get Copilot to disclose the exact errors and restrictions that prevented running unauthorized queries, culminating in it admitting that there was an undocumented URL parameter (“autorun=1”, naturally) that would automatically execute a query.

Why such a parameter would exist in the first place is a little unclear. The Ars Technica article says that when Microsoft removed the parameter as part of the initial fix, it caused several AI browser extensions to fail, hinting that it may have been in place to enable automation on behalf of the user without showing the user the actual prompts being run. Regardless, prompts set to autorun were allowed to execute with no intervention, including prompts to disclose the contents of the users inbox, stored information in the users Copilot session, and any connected apps and services.

Comcast Senses Motion With WiFi

Comcast is enabling “WiFi Motion Detection” on its fleet of home router/access point devices. Conceptually, it’s a fairly simple trick. When a WiFi device changes position, or if something partially blocks the signal, the signal level of the device will change. People and pets are basically various sized bags of radio-blocking water, and as we move around we cause fluctuations in the signal levels of surrounding devices.

The risks lie in the second-order aspects: how much data is collected, how is it stored, and what does it expose about your home? Comcast says the feature is optional, and is opt-in: it won’t be turned on unless a customer enables it. This is refreshing, but once enabled, how is the data protected? Currently, Comcast states that the fidelity of the information may not be able to distinguish between a large pet and a small child, and can not identify individual people, but other public projects have refined a similar process to identify the number of people and characteristics about specific people, all based on the signal level. (Be careful when looking for other projects, though. There are several that appear to be completely AI generated, with both false claims and false data!)

As a company subject to the laws of any countries they operate in, Comcast may also be legally compelled to turn over motion and presence data in criminal or civil cases, or may opt to re-sell the data for other training or advertising purposes. Leveraging equipment you already have to collect more data is cool, but personally I’m not sure I want even more tracking data of when I’m home or where I spend time in my home to be that easily collected by a third party.

Stripe Merchant Keys Leaked

The payment processor Stripe has not been hacked, but it looks like 650 companies using it may have been.

Someone has collected hundreds of Stripe API keys, probably from GitHub, mis-configured servers, and infostealer malware, and made them available on trading forums. Despite guardrails by GitHub, a common mistake is committing configuration files, environment files, or code with API keys into public repositories. Once data goes into git, it’s fairly hard to remove it without resetting the entire repository: the whole point of code management is to be able to go back in time and identify the changes! The prevalence of information stealing malware on developer devices, VSCode plugin repositories, and inside packaging systems is another excellent source of stolen authentication tokens for many services.

A Stripe API token acts as the login credentials for the company using Stripe to process payments: it allows creating charging, listing past customers, extracting stored payment data, and essentially anything else a logged in administrator can do.

Stripe themselves say that they actively scan GitHub and other source management platforms looking for leaked keys and notifying customers, and hopefully impacted companies will be notified and can rotate their API tokens before they are used against actual customers.

More Windows Defender Issues

Last week was another Microsoft Patch Tuesday, which somehow didn’t set a third record for the highest number of security fixes in a month. Nonetheless, it would hardly be a proper Patch Tuesday in 2026 without another bypass of Windows Defender.

Previous exploits released by the researcher known as NightmareEclipse have demonstrated bypasses for BitLocker and Windows Defender and have stirred legal threats from Microsoft. Previous attacks against Windows Defender were fixed in the July set of patches, however now the “ShieldBreak” exploit, identified as CVE-2026-69414, uses Windows Defender itself to escalate to admin privileges.

The current fix? Disable Windows Defender. Which probably isn’t a great plan. Hopefully Microsoft is able to release an official fix rapidly.

Kicking Out Hackers by Cutting the Cable

A new article discusses how, during the Salt Typhoon attacks, T-Mobile operators drove to the datacenter physically cut the cable from a compromised system to prevent the attackers from accessing the rest of the network.

Salt Typhoon is believed to be a group based in China, often credited as part of the Ministry of State Security, which perpetrated widespread hacks of the United States telecom industry in 2024. The attackers utilized the hooks in the infrastructure devices required for US wiretap law, which gave them access to call records, contents of text messages, and voice recording of calls, targeting industry, government, and election officials.

Stopping a hack with a pair of wire cutters is definitely a story worth remembering.

Supply Chain Attacks Hit Rust

Supply chain attacks appear to be spreading to Rust packages now. The Rust Security Response Team was notified that a set of packages were downloading malicious payloads during build and confirmed the behavior.

To facilitate building required components, Rust packages can include a build script that is automatically compiled and executed. This is extremely similar to the build hooks enabling the spread of malware in the NPM and PyPI repositories, and could be used to perform the same authentication token theft and manipulation of packages.

Time will show if the Rust Cargo repository is able to prevent a similar scourge of infected packages now that the alarm is raised.

DEF CON Speakers and Attendees Targeted

Huntress reports some DEF CON speakers and attendees are being targeted with a phishing campaign on X/Twitter.

Starting with a claim to be the vice president of Coindesk, the phishing lure asks to collaborate on a future conference and provides a link to a Google document. The Google doc then tries to trick the user into running a click-fix style attack where the user is asked to copy and paste malware into a command shell, or into downloading a malware binary outright.

The malware payload targets the usual selection of cryptocurrency, authentication tokens, SSH keys, and the like. The Huntress article dives deep into the makeup of the malware, which has custom deployments if the victim is on Windows or macOS and can download several dynamic stages as the infection is triggered.

hackaday.com/2026/08/21/this-w…