Saturday, August 22, 2026
Daily digest
A maximum-severity Entra ID flaw exploited in the wild and a technique abusing Microsoft Defender's own boot-time driver both land today — GCC High tenants and Intune-managed Windows fleets should treat these as priority patch/monitor items.
Microsoft patches max-severity Entra ID flaw exploited in attacks
Microsoft disclosed and patched a maximum-severity (CVSS 10) vulnerability in Entra ID that was actively exploited before the fix was issued. Microsoft has not disclosed who exploited it or how widely, only confirming the flaw is now remediated on its end.
Why it matters: Entra ID underpins identity for M365 GCC High and Intune conditional access; review sign-in and Entra audit logs for anomalous activity even though Microsoft has already applied a service-side fix.
Microsoft Defender's own boot-time driver can be weaponized to delete security software
Check Point Research disclosed a technique using Microsoft Defender's legitimately signed BTR.sys (Boot Time Removal Tool) driver to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2. No vulnerability is exploited and no external driver is needed — the built-in signed driver itself is abused.
Why it matters: Because BTR.sys is legitimately signed, this technique can bypass driver-blocklist and EDR defenses on Intune-managed Windows 11 endpoints; watch for Microsoft/CISA guidance on mitigation or attack surface reduction rules.
Cisco patches nine Crosswork and Secure Workload flaws, five rated CVSS 10.0
Cisco released security updates for Crosswork and Secure Workload platforms addressing nine vulnerabilities, five of which scored a perfect CVSS 10.0. The patches are part of a continued internal security review of these product lines; some flaws affect Crosswork Data Gateway, Network Controller, and Planning regardless of configuration.
Why it matters: If Crosswork or Secure Workload is deployed anywhere in the network management stack, these unauthenticated max-severity flaws need immediate patching to stay within NIST 800-171 vulnerability management timelines.
CISA orders federal agencies to patch actively exploited TrueConf Server flaws
CISA added two actively exploited vulnerabilities in the self-hosted TrueConf Server video conferencing platform to its Known Exploited Vulnerabilities catalog, mandating federal patching. Ukrainian hacktivists have reportedly been exploiting the bugs, and TrueConf's use extends beyond Russia.
Why it matters: KEV entries carry binding patch deadlines for federal agencies and are a strong signal for CMMC L2 contractors to check whether TrueConf or similar third-party comms tools exist anywhere in the environment.
Hundreds of leaked AWS keys found still active, granting full account control
Researchers found more than 9,300 AWS access keys publicly exposed between August 2022 and August 2026 that remain active and valid, some granting full control over corporate AWS accounts. The exposure spans multiple years of leaked credentials sitting in public repositories and other sources.
Why it matters: Worth an audit of AWS GovCloud IAM keys, secrets scanning in CI/CD and Ansible playbooks/repos, and enforcement of short-lived credentials or role assumption instead of static access keys.
Hackers poison popular Rust crates to steal developer credentials
Malicious updates were pushed to popular Rust crates (packages) that turned routine builds into a delivery mechanism for infostealer malware targeting developer credentials. The compromised packages were widely used before the malicious versions were identified.
Why it matters: Reinforces the need for dependency pinning, SBOM review, and build-pipeline isolation in any Ansible/automation or self-hosted AI toolchain that pulls Rust or npm packages during CI.
New SynkLoader malware pushed via Microsoft Teams phishing campaign
A previously unknown malware family called SynkLoader is being distributed through Microsoft Teams phishing campaigns, using a fake lock screen to steal credentials. The campaign leverages Teams as the delivery vector rather than email.
Why it matters: Teams is a primary collaboration tool in M365 GCC High; ensure user awareness training and Defender for Office 365 Teams protection policies cover this vector, not just email phishing.
Commentary: FedRAMP 20x signals the end of point-in-time compliance
A NextGov commentary argues FedRAMP 20x shifts government cloud security assessment away from periodic, point-in-time reviews toward continuous, automated validation, given that attacks now outpace human-paced patch cycles. The piece frames this as ending years of 'compliance theater' for vendors selling to government.
Why it matters: FedRAMP 20x's continuous-monitoring model foreshadows where CMMC L2 assessments are headed too — worth evaluating current continuous monitoring/logging tooling now rather than waiting for a mandate.
Lawmakers call for investigation into impact of CISA staffing cuts
Members of Congress are calling for a formal investigation into how recent staffing cuts at CISA have affected the agency's capabilities. Lawmakers say there's little visibility into how the lost expertise and institutional knowledge have been replaced.
Why it matters: Reduced CISA capacity could mean slower KEV updates, advisories, and incident response support that CMMC-regulated contractors rely on for threat intelligence and coordinated disclosure.
CISA issues guidance to improve federal cybersecurity data logging
CISA released new guidance to help agencies improve cybersecurity data logging practices, aiming to enable priority logging capabilities that support continuous event monitoring, threat hunting, and incident response. The guidance is intended to standardize logging maturity across federal systems.
Why it matters: Directly relevant to NIST 800-171 audit and logging (AU) control family requirements — worth comparing current SIEM/log retention configuration against this new baseline guidance.
GitHub pledges architectural overhaul after second outage this month
GitHub's CTO acknowledged reliability failures and pledged to scale up infrastructure following a second major outage in August. The company committed to an architectural overhaul to prevent recurring disruptions for developers relying on the platform.
Why it matters: If GitHub hosts CI/CD, IaC, or Ansible repos for the environment, repeated outages are a business-continuity risk worth factoring into DR/backup planning for source control.