Microsoft Sounds Alarm as Perfect-10 Entra ID Flaw Comes Under Attack
Microsoft has mitigated a maximum-severity vulnerability in Entra ID (formerly Azure Active Directory) that was already being exploited in the wild. Tracked as CVE-2026-69836, the flaw stemmed from unsafe data deserialization, allowing an unauthenticated attacker to remotely execute code within Microsoft’s cloud identity service without any user interaction.
Because Entra ID is a fully managed cloud service, Microsoft was able to patch the vulnerable infrastructure directly, meaning no customer action is required. However, the company has not yet disclosed who exploited the flaw, how widely it was abused, or what data attackers may have accessed before the mitigation was deployed.
The vulnerability is direct and devastating: unauthenticated remote code execution in your identity service. Entra ID is the foundation for access to Microsoft 365, cloud applications, and on-premises resources. If attackers had code execution within that service, they could potentially create backdoor accounts, steal credentials, or maintain persistent access to any organization using Entra ID.
The fact that Microsoft hasn’t disclosed the scope of exploitation is concerning. Organizations need to assume their environments may have been accessed and plan accordingly.
Hackers Poison ‘arrayref’ Rust Crate to Push Infostealer Malware
A sophisticated supply chain attack recently targeted the Rust programming language ecosystem by poisoning the highly popular arrayref crate. Threat actors created fake GitHub and crates.io accounts impersonating prominent Rust developer David Tolnay to push a malicious version of the package.
During the build process, the poisoned crate attempted to deploy an information-stealing payload designed to harvest developer credentials and environment variables. This incident acts as a stark reminder of the vulnerability of open-source registries and the importance of verifying package provenance in software supply chains.
The attack is notable for its sophistication: attackers didn’t just inject code into an existing package. They impersonated a prominent developer to build trust. For any developer who installed the poisoned arrayref version, their local environment credentials, API keys, and environment variables were harvested.
This is supply chain attack at the source code level. By the time compiled software reaches end users, the damage is already done.
‘CoSnitch’ Attack Tricks Copilot into Mapping Out Architecture
Security researchers have uncovered a new attack method dubbed “CoSnitch,” which successfully manipulates Microsoft Copilot into exposing internal enterprise architectures and exfiltrating data. By exploiting personal configuration flaws and manipulating the AI’s contextual understanding, attackers can force Copilot to map out connected applications and internal data structures with just a single user click.
This highlights a significant and expanding attack surface surrounding generative AI assistants, proving that interaction-aware guardrails and strict data loss prevention controls are essential to prevent AI tools from inadvertently leaking proprietary network maps.
The attack is insidious because it doesn’t require compromise of Copilot itself. It exploits how users interact with it. A single click, and Copilot reveals internal architecture. This is a new category of threat: AI assistants trained on enterprise data, used with enterprise context, manipulated into disclosure through social engineering and prompt injection.
Organizations deploying Copilot need strict DLP controls and monitoring for when sensitive data is shared with the service.
Read more: https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture
Hackers Compromise 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
In just a 35-day campaign, hackers managed to compromise more than 14,500 internet-exposed Dahua surveillance cameras and IoT devices worldwide. The attackers utilized a combination of credential stuffing, authentication bypass vulnerabilities, and peer-to-peer networking protocols to rapidly spread the infection.
Once compromised, these devices are typically roped into massive botnets used for distributed denial-of-service attacks or as proxy nodes to mask further malicious activities. The swift infection rate underscores the persistent danger of deploying insecure, edge-facing IoT hardware without proper hardening.
Fourteen thousand five hundred devices in 35 days. That’s roughly 400 devices per day. Attackers automated scanning, exploitation, and propagation. For every organization deploying Dahua cameras without isolation or monitoring, those devices are now part of an attacker’s botnet.
The speed is the important part. If you deployed Dahua devices weeks ago and assumed they’d be safe, they’re already compromised and working against you.
Read more: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html
Critical RCE Flaw in Windows IKE Extension Now Actively Exploited
The Cybersecurity and Infrastructure Security Agency has added a critical remote code execution vulnerability in the Windows IKE (Internet Key Exchange) Extension to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-33824 and originally patched by Microsoft in April 2026, the vulnerability involves a “double free” memory corruption issue that allows unauthorized attackers to execute arbitrary code over a network.
Threat actors are now actively targeting this flaw, prompting CISA to order US federal agencies to secure unpatched endpoints immediately. A directive that private organizations should prioritize as well.
This vulnerability was patched in April. It’s now August. If you haven’t patched it by now, you’re vulnerable to active exploitation. The flaw is in the IKE Extension, which handles VPN and remote access. Attackers can remotely execute code without authentication.
Organizations with unpatched VPN infrastructure are being actively targeted right now.
Medusa Ransomware Group Has Attacked 500+ Critical Infrastructure Orgs
An updated joint cybersecurity advisory from CISA, the FBI, and HHS reveals that the Medusa ransomware-as-a-service group has successfully attacked over 500 critical infrastructure organizations since June 2021. The group has aggressively targeted the healthcare and public health sectors, leveraging unpatched, remotely exploitable vulnerabilities such as recent flaws in BeyondTrust and Fortra GoAnywhere often within 24 hours of their public disclosure.
The advisory warns that Medusa relies heavily on “living off the land” techniques and legitimate tools like Advanced IP Scanner and RDP to evade detection, extorting victims by threatening to leak stolen data on their dedicated leak site if a ransom is not paid.
Five hundred organizations. Over five years. Healthcare and public health sectors hardest hit. The pattern is consistent: Medusa exploits publicly disclosed vulnerabilities within 24 hours. They use legitimate tools that look like normal IT administration. They threaten data leaks to pressure payment.
This is industrial scale ransomware operation. The speed from disclosure to exploitation means organizations that aren’t patching critical infrastructure flaws within days are at severe risk.