Sam's News — security — 2026-08-21¶

Security¶

8.5 Rust Supply Chain Attack Compromises Three Popular Crates with 245M Downloads¶

The Rust Project removed malicious versions of three widely-downloaded crates published by a compromised maintainer account that injected a typosquatted dependency with a remote-executing build script.

arrayref crate: 244 million downloads compromised
Infostealer malware executes at developer compile time
append-only-vec also targeted in same attack
Supply chain compromise of widely-used Rust ecosystem packages
Malicious arrayref v0.3.10 published August 20, 2026 on crates.io
Depends on typosquatted crate proc-macro1 executing remote binary at build time
Maintainer account droundy compromised; GitHub repos now unavailable (404)
proc-macro1 published by dtolney account forging David Tolnay authorship
Crates.io team removed malicious versions

Sources: The Hacker News RSS, The Register RSS Update to: Hackers Compromise Arrayref Rust Crate to Distribute Infostealer Malware

8.5 Clop Ransomware Gang Exploits Critical Vulnerability to Breach 50+ Organizations¶

The Clop ransomware group compromised more than 50 organizations including GE, Philips, and Shell by exploiting a critical vulnerability in Windchill and FlexPLM software.

Sources: CPO Magazine Web Search Update to: Cl0p ransomware gang claims over 40 victims in PTC Windchill exploitation campaign

8.5 Microsoft Entra ID Critical Flaw (CVSS 10.0) Exploited in Wild; No Customer Action Required¶

Microsoft disclosed CVE-2026-69836, a maximum-severity remote code execution flaw in Entra ID with a CVSS score of 10.0, being exploited in the wild. Microsoft stated the vulnerability is fully mitigated and requires no customer action.

CVE-2026-69836: remote code execution, CVSS 10.0 (maximum severity)
Affects Microsoft Entra ID (formerly Azure AD)
Being actively exploited in the wild
Microsoft claims full mitigation; no customer remediation required
CVSS 10.0 severity vulnerability in Microsoft Entra ID
Unsafe deserialization flaw enables unauthenticated remote code execution
Exploitation detected in the wild at time of disclosure, August 21, 2026
Microsoft patched directly; no customer action required
Discovered and reported by principal security engineer Robert Fitzpatrick

Sources: The Hacker News AI Web Searched, The Register AI Web Searched

8.5 CISA mandates federal agencies patch actively exploited TrueConf Server flaws¶

The US Cybersecurity and Infrastructure Security Agency ordered federal agencies to urgently patch two actively exploited vulnerabilities in TrueConf Server communications platform.

CVE-2026-72529 and CVE-2026-72530: critical-severity flaws in TrueConf Server
Affect all versions from 2022; patched in June 2026 (5.3.9, 5.4.9, 5.5.5)
Exploit vector: remote access via port 4307/TCP
Actively exploited by hacktivist group Head Mare to deploy PhantomCore malware
CISA KEV catalog: federal agencies must patch within 3 days (72529) or 2 weeks (72530)

Sources: BleepingComputer RSS Update to: CISA Urges Immediate Patching of Actively Exploited TrueConf Vulnerabilities

8.5 Over 9,300 Exposed AWS Access Keys Still Active and Valid¶

Over 9,300 AWS access keys exposed publicly between August 2022 and August 2026 remain active and valid, granting full control over corporate AWS accounts despite years of exposure.

9,300+ AWS access keys exposed over four-year period remain active
Keys provide complete control over corporate AWS accounts
Exposed August 2022–August 2026, yet stayed functional throughout

Sources: Bleeping Computer AI Web Searched, BleepingComputer RSS

8 GitLab CVE-2026-19478 Under Active Exploitation Within Days of Disclosure¶

A critical code injection vulnerability in GitLab (CVE-2026-19478, CVSS 9.4) began being actively exploited within days of public disclosure.

CVE-2026-19478: critical zero-click GitLab vulnerability
Affects self-managed instances
Difficult to detect due to lack of technical disclosure details

Sources: The Hacker News RSS Update to: Critical GitLab vulnerability CVE-2026-19478 exploited in the wild

8 Critical isolated-vm vulnerability enables remote code execution on host¶

A critical-severity type confusion vulnerability in the isolated-vm Node.js library enables remote code execution through V8 sandbox escape. The bug exploits a time-of-check/time-of-use weakness where JavaScript array getters can return different values across iterations, allowing attackers to dereference attacker-controlled pointers and hijack host process control flow.

Type confusion bug in ExternalCopy function affects isolated-vm library
Time-of-check/time-of-use (TOCTOU) weakness: array getters return different values on each iteration
Guest can exploit ivm.Reference to build malicious transferList triggering vulnerability
Successful exploitation causes denial-of-service crash or host process control-flow hijacking
CVE identifier not yet assigned

Sources: SecurityWeek AI Web Searched

8 Microsoft Defender driver can be weaponized to disable security software at boot¶

Check Point Research disclosed a technique exploiting Microsoft Defender's legitimate boot-time driver to perform arbitrary kernel operations and disable security software on Windows 7 through Windows 11 systems. The RC4-encrypted driver cannot be blocked without disrupting Defender itself, and the proof-of-concept was demonstrated at Black Hat USA 2026.

Affects Windows 7 through Windows 11 25H2
RC4 encryption key hard-coded in BTR.sys, unchanged across 18+ versions
Exploitation requires administrator account with SeLoad privilege
Bypasses Service Control Manager and generates no Windows Event ID 7045
Can delete WdFilter.sys and MsMpEng.exe even with Tamper Protection active
Demonstrated at Black Hat USA 2026 and DEF CON 34 on August 20, 2026
No real-world attacks found to date

Sources: The Hacker News AI Web Searched

7.5 Cisco Secure Workload Software Flaws with Critical Severity Ratings¶

Cisco disclosed five vulnerabilities in Secure Workload Software, including two critical flaws rated 10.0 for improper access control. The company has patched its SaaS offering, while on-premises users must upgrade to specific versions. No active exploitation has been detected.

Two critical CVEs (10.0 CVSS): CVE-2026-20315, CVE-2026-20317
One 9.9-rated flaw (CVE-2026-20231: command/OS/argument injection)
On-premises versions 3.10 and earlier must upgrade to 3.10.9.1; v4.0+ to 4.0.4.16
Vulnerabilities identified via AI-assisted internal security review
No malicious exploitation detected to date

Sources: The Register AI Web Searched, The Hacker News RSS

7.5 Critical MLFlow Vulnerability Exploited; Siemens PLCs Targeted; CareCloud Breach Confirmed¶

The US Cybersecurity and Infrastructure Security Agency has warned of an exploited critical vulnerability in MLflow and AI-driven attacks targeting Siemens programmable logic controllers.

Sources: CISO Series RSS, CISO Series Web Search