Security news.
Today's security landscape is dominated by critical vulnerabilities and active exploitation, with CISA issuing urgent directives for federal agencies to patch flaws in TrueConf Server and Microsoft Entra ID. Supply chain attacks, particularly targeting the Rust ecosystem, also feature prominently, alongside warnings about AI-generated exploit scripts for critical infrastructure.
Microsoft warns of max severity Entra ID flaw exploited in attacks
Microsoft has patched a maximum-severity vulnerability (CVSS 10.0, CVE-2026-69836) in its Entra ID identity and access management platform that has been actively exploited, allowing remote code execution.
CISA orders feds to patch actively exploited TrueConf Server flaws
CISA has mandated that U.S. federal agencies immediately patch two actively exploited vulnerabilities (CVE-2026-72529, CVE-2026-72530) in the TrueConf Server self-hosted communications platform.
GitLab CVE-2026-19478 Under Active Exploitation
A newly disclosed code injection flaw in GitLab, CVE-2026-19478 (CVSS 9.4), is being actively exploited, allowing unauthenticated attackers to modify or delete public projects.
Rust Supply Chain Attack Linked to North Korean Hackers
North Korean hackers are suspected of a supply chain attack involving poisoned versions of popular Rust crates (arrayref, internment, append-only-vec), which added malicious dependencies to fetch payloads during compilation.
Critical Isolated-vm Vulnerability Leads to RCE on Host
A critical type confusion bug in the isolated-vm JavaScript sandbox can lead to a V8 sandbox escape and control-flow hijacking of the host process, potentially resulting in remote code execution.
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco released security updates for its Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, five of which have a CVSS score of 10.0 and could allow arbitrary code execution or privilege escalation.
Hackers abuse FTP server banners to deliver new Windows malware
Threat actors are leveraging FTP banners to conceal commands that deploy two previously undocumented remote access Trojans, E4del and PINHOLE, on Windows systems.
SickKids data breach exposes employee and job applicant info
Toronto's Hospital for Sick Children (SickKids) announced a data breach affecting personal information of current and former employees and job applicants, stemming from a third-party software flaw, though patient records were unaffected.