Another week, another stack of “critical” bugs shipped by people who apparently treat threat modeling like optional homework. Grab your patch calendar and your least-surprised face.
This Week's Hall of Shame: Top CVEs
CVE-2026-69836 — Entra ID goes full trust fall
The Gist: Microsoft Entra ID has a deserialization bug with a CVSS 10.0 that allows unauthenticated remote code execution over the network. It’s being exploited in the wild, a proof-of-concept exists, and a patch is available, which is great because “internet-facing identity platform RCE” is not a phrase anyone wants in their week.
Why It Should Keep You Up at Night: This is identity infrastructure, which means compromise here can become everybody’s problem very quickly. When the thing deciding who gets access can itself be popped remotely, attackers don’t need subtlety; they get the keys, the clipboard, and probably your weekend too.
Your Playbook:
- Apply Microsoft’s security update for CVE-2026-69836 immediately and verify all Entra ID-connected services are covered.
- Hunt for suspicious authentication changes, unexpected app registrations, and anomalous admin activity since this flaw is already in active exploitation.
Sources: Rapid Risk Radar | MSRC Security Updates | CISA Known Exploited | VulnCheck KEV
CVE-2026-72530 — Video conferencing, now with host takeover
The Gist: TrueConf Server contains a critical code injection flaw rated CVSS 9.5 that lets an unauthenticated attacker with network access to port 4307/TCP escape the isolated environment and execute arbitrary code on the host. It’s exploited in the wild, a PoC is out there, and affected versions include 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier.
Why It Should Keep You Up at Night: Collaboration tools already sit in awkward corners of the network where people forget to look until something is on fire. A sandbox escape to host-level code execution means your “just a meeting server” can become an attacker beachhead, because apparently even video calls need their own villain arc now.
Your Playbook:
- Upgrade TrueConf Server beyond the affected 5.3.9, 5.4.9, and 5.5.5 release lines, or isolate and disable exposed instances on port 4307/TCP until remediation is complete.
- Review server logs and endpoint telemetry for suspicious script execution, child processes spawned by the TrueConf service, and unexpected outbound connections.
Sources: Rapid Risk Radar | CISA Known Exploited | VulnCheck KEV | NVD Analysis
CVE-2026-18963 — Password reset, minus the reset rules
The Gist: Red Hat Build of Keycloak is dealing with a CVSS 9.1 flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass the required email verification step and set new credentials for arbitrary users. It’s exploited in the wild, a PoC exists, and the affected component sits at the heart of identity and access management, because of course it does.
Why It Should Keep You Up at Night: This is account takeover without the usual pesky obstacles, aimed at the system many organizations trust to centralize authentication. If attackers can reset credentials for any user directly, your IAM layer stops being a security control and starts being an express lane for compromise.
Your Playbook:
- Update Red Hat Build of Keycloak to the vendor-remediated release and validate the reset-credentials flow in production after patching.
- Audit recent password reset events for unusual spikes, resets targeting privileged accounts, and successful logins from newly changed credentials.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | The Hacker News
Industry Intel: What Else is On Fire This Week
-
Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine — Security teams are dreaming of an AI-powered SOC with fewer alert avalanches and more actual thinking, which sounds lovely if vendors can resist turning it into Clippy with a SIEM badge. Read more
-
Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests — Apparently AI agents have already learned the oldest internet lesson: if a rule exists, someone will script around it and ruin leg day for everyone. Read more
-
OpenAI Bans Russian ChatGPT Accounts Used to Run Influence Operation — The abuse of generative AI for influence ops continues right on schedule, because no new technology goes unweaponized for long. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.