Published · yesterdayLeadership8 min read
One CVSS 10.0 was closed server-side with no disclosure; a signed Defender driver that deletes Defender was declined for servicing. The half of the queue that does ship fixes needs seven builds.
Context for builders, not their beat.See today for builders
Compiled by The Board RoomSomething wrong?How this is made
Sorted by whether anyone in your organisation has something to download, this cycle's critical-severity vendor items divide two and two [1]. Cisco published nine fixes across Crosswork and Secure Workload, five of them scoring CVSS 10.0, and named the builds: Crosswork 7.2.1 and earlier is addressed in 7.2.1-SP, Secure Workload 3.10 and earlier in 3.10.9.1, release 4.0 in 4.0.4.16 [4][5][6]. GitLab's CVE-2026-19478, a code injection flaw scoring 9.4 that lets an unauthenticated attacker modify or delete public projects and rewrite their data without credentials or user interaction, is fixed in 19.2.4, 19.1.6, 19.0.8 and 18.11.11 [8][9]. That is seven distinct patched builds for two of the four items [2].
The other two have no build. Microsoft's Entra ID flaw, CVE-2026-69836, is a deserialization issue scoring CVSS 10.0 that allows unauthenticated remote code execution, and Microsoft says it has been exploited in the wild [1]. Microsoft also says the vulnerability "has already been fully mitigated" and there is no action for users of the service to take [2]. Check Point Research's BTR.sys technique, presented at Black Hat USA 2026 and DEF CON 34, uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform kernel-level file and registry operations on Windows 7 through Windows 11 25H2, with no software flaw exploited and no outside driver imported [14]. Following disclosure, Check Point says MSRC confirmed the findings do not meet the criteria for immediate servicing, because the technique relies on pre-existing administrative privileges [19]. The researcher's repository states flatly that no patch is planned, a characterisation Microsoft has not publicly confirmed [20].
Both of the items with nothing to install are Microsoft's [5]. One was closed by the vendor without saying how or when it was exploited, or whether the activity is ongoing [3]. The other was left open on the grounds that it starts from administrative privilege.
The reason BTR.sys resists the normal response is structural. It is a required Windows component, which means it cannot be added to Microsoft's Vulnerable Driver Blocklist or blocked through Windows Defender Application Control without breaking Defender itself [15]. Every configuration blob the driver accepts is RC4-encrypted with a 256-byte key hard-coded into the .rdata section of every build shipped since Windows 7, and Check Point verified it unchanged across 18 unique 64-bit versions [16]. The proof-of-concept installs the driver as a service through direct HKLM registry writes, bypassing the Service Control Manager and producing no Windows Event ID 7045, then executes the queued operations from Ring 0 attributed in telemetry to the System process, PID 4 [17]. A second trigger mode defers the work to the next reboot, into what the researcher calls the golden window, after the filesystem becomes writable but before Defender's user-mode services start, and a live demonstration used it to delete the entire Defender stack from a fully updated Windows 11 25H2 machine with Tamper Protection active [18].
For a platform team, none of that maps to a patch ticket. The remediation is detection content: service keys written outside the Service Control Manager, a boot-bus-extender entry that appeared without an event log, security binaries missing after reboot. Check Point says it observed no evidence of real-world abuse across its samples and telemetry, and argues this makes proactive detection engineering feasible before weaponisation [21]. That is the whole offer, and it is a scheduling claim rather than a security guarantee. The same driver was patched five years ago when it had an ordinary flaw: SentinelLabs disclosed CVE-2021-24092 in February 2021, a local privilege escalation using a hard link at the driver's log path [22]. The difference between then and now is not the driver. It is whether the vendor classified the finding as a defect.
The two items that do ship fixes are the ones with a hostile clock. watchTowr told The Hacker News it reproduced the GitLab flaw within minutes of disclosure and observed in-the-wild exploitation against its honeypot network [10]. Jake Knott, principal security researcher at the firm, said AI-enabled attackers are compressing the time from disclosure to exploitation and that waiting for the next patch cycle is often too late [11]. The consequence is not only downtime: watchTowr says an attacker can delete entire repositories, forge merge records so a fix appears to have landed when it did not, and ban project maintainers [13]. A forged merge record is an attack on your evidence, not your availability, and it lands in the same system your auditors read.
Cisco, by contrast, says its nine flaws were found during internal testing and are not known to be actively exploited [7]. So four of the seven builds are urgent by exploitation and three are urgent by score alone. If the platform team cannot push seven builds this week, the ordering is already decided by that difference, and the interim control for GitLab is specific: hunt web logs for requests containing "@gl_introduced", and if patching must wait, restrict unauthenticated access to /api/graphql or remove public repository access [12].
Then there is the class of finding where the fix is somebody else's, and your work is search and pinning. On August 20, 2026, the Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9, published from the same owner account and online for 86, 90 and 107 minutes respectively [23]. The malicious code sat in the build script of an injected typosquatted dependency, proc-macro1, so compiling a project that resolved it was enough to run the payload, and nothing from the crates themselves had to be called [24]. There is no patched version and no CVE, and the RustSec advisories record no evidence any malicious version was used [25]. What developers are told to do is grep ~/.cargo/registry/cache for the deleted files and pin arrayref at 0.3.9 or earlier [26].
The delivery mechanism is worth reading twice, because it inverted a safety feature. According to the report filed to RustSec by GitHub user jhobern, the owner account yanked arrayref 0.3.5 through 0.3.9 within the same minute as the malicious publish, leaving the compromised release as the only version Cargo would not warn about, and that warning was the lure [27].
The no-evidence finding is the part to hold loosely. The Hacker News asked the Rust Security Response Team for the basis of it and for the download count of the deleted versions, and had not received a response at the time of writing [28]. Publicly available numbers give a sense of the traffic involved: arrayref has 245,385,500 downloads all time, 53,905,601 in the 90 days ending August 20, and 403 distinct crates depend on it [29]. At that 90-day rate the crate averages roughly 599,000 downloads a day, about 416 a minute, so the 86 minutes the malicious release was live corresponds to around 36,000 downloads' worth of average traffic [3]. That is not a count of malicious downloads and should not be read as one. It is the size of the window the registry has not yet characterised, and it is the gap between "no evidence of usage" and "evidence of no usage".
The pattern repeats elsewhere in the week. TrendAI reported 14 trojanized npm packages that deliver a Linux beacon with no install hook required, because a single import anywhere in the dependency graph, including a transitive one, executes the payload [30]. Kaspersky, which found the case in June 2026, documented malware spreading through the built-in updaters of DoFun Android head unit firmware and said the underlying software distribution abuse was addressed after disclosure, which is a fix nobody in your organisation installs [31].
The governance argument now landing on CISOs is that quarterly certification is obsolete: One Identity's expert-insights piece argues most IGA programs still run on manual certifications, static role models and quarterly reviews, and that regulators and cyber insurers want proof controls run all the time, turning "did you review access" into "can you prove it was appropriate every single day" [32]. Set that beside the Entra ID entry. The identity platform underneath those daily proofs disclosed a maximum-severity remote code execution flaw that was exploited in the wild, published nothing about how or when [3], and told customers there was nothing for them to do [2]. Continuous evidence about your own entitlements does not cover the period during which your identity provider was reachable and you were not told.
Nothing in the public framework compels that disclosure. CISA and the FBI's Product Security Bad Practices guidance is explicit that it is voluntary and non-binding and imposes no requirement on manufacturers to avoid the listed practices [33]. Whatever proof obligation your identity vendor carries, it comes from your contract, not from guidance, and it is worth checking whether the words in it cover an incident the vendor mitigated on its own side.
The severity column cannot carry this. ShadowMap's argument is that most external exposures are not software defects at all, with no CVE, no advisory and no vendor patch because there is no vendor and nothing to patch, and that the standardised severity model has nothing to say about them [34]. Its worked example is four findings arriving in one week with four different response paths and four different owners and no common unit of severity, which is why importing a vulnerability-management ranking model yields an ordered list that is confidently wrong [35]. It also notes that outside-in discovery typically surfaces 30 to 60 per cent more internet-facing assets than the organisation's own inventory held, with a meaningful share of the first pass being attribution noise or third-party infrastructure [36].
Applied to this cycle, the practical reading is unglamorous. Seven builds belong to the platform team and can be counted [2]. Two critical items belong to detection engineering and vendor management, and produce no closed tickets [1]. The registry cleanups belong to developers with a cache to search [26]. A queue sorted by CVSS puts the seven builds on top, which happens to be correct this week, and quietly leaves the unassignable half without an owner, which is how it stays open until someone builds a rule for it or a customer asks what you knew.
Ranked by verification strength, evidence, and original report placement.
Microsoft warned of CVE-2026-69836, a deserialization of untrusted data flaw in Microsoft Entra ID with a CVSS score of 10.0 that allows an unauthorized attacker to execute code over a network, and said it has been exploited in the wild.
Microsoft said of CVE-2026-69836: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take."
As of writing there were no details on how CVE-2026-69836 was exploited, when those efforts began, whether they are still ongoing, or how the flaw was discovered.
Cisco published security updates for Crosswork platforms and Secure Workload covering nine vulnerabilities, five of which score CVSS 10.0 (CVE-2026-20030, CVE-2026-20357, CVE-2026-20358, CVE-2026-20315 and CVE-2026-20317).
The Crosswork issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2.1-SP.
Cisco Secure Workload 3.10 and earlier is fixed in 3.10.9.1, and release 4.0 is fixed in 4.0.4.16, covering both SaaS and on-premises deployments.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
