Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Microsoft disclosed a maximum-severity flaw in its Entra ID identity service, tracked as CVE-2026-69836 with a CVSS score of 10.0, tracing back to unsafe deserialization of untrusted data that could let an attacker execute code remotely. Initial guidance said the bug had already been exploited in the wild, but after follow-up questions the company revised its assessment to confirm no exploitation had actually occurred and that the issue was fully mitigated on the server side, with no action required from customers. The engineer who reported the flaw was credited internally, and the disclosure adds to a run of high-severity fixes this month, including a separate Windows zero-day used by the Lazarus Group.
CISA orders urgent patching of actively exploited Zimbra flaw
Government agencies have been given three days to patch an actively exploited command injection vulnerability in Zimbra Collaboration Suite after Polish incident responders flagged in-the-wild targeting of the flaw. The bug lets an unauthenticated attacker send specially crafted requests that trigger arbitrary operating system commands once SNMP notifications are enabled, and monitoring groups have already identified more than 270 compromised servers among the roughly 12,000 instances still exposed online. A fix has been available for over a month, and responders are urging administrators to check logs for unexpected service restarts and unfamiliar files before rotating any exposed credentials.
28,000 Exposed Git Repositories Reveal API Keys, Bank Details and Employee Disciplinary Files
A scan of millions of internet-facing hosts turned up 28,000 publicly reachable Git repositories leaking API keys, banking details and internal employee records, the result of development servers leaving their hidden Git directories open to automated scanners. The exposure yielded hundreds of live AWS, Stripe, OpenAI and Telegram credentials, some of which still worked during testing, along with a cache of employee disciplinary files pulled from a single hardcoded cloud key. Because repository history preserves secrets long after they’re removed from the current codebase, researchers are urging teams to treat any exposed .git folder as a full incident that calls for rotating every credential found across historical commits, not just the latest one.
Critical miniOrange SAML SSO Flaws Let Attackers Take Over WordPress Admin Accounts
Two chainable authentication bypass flaws in the miniOrange SAML single sign-on plugin are being actively scanned for across WordPress sites, letting an attacker forge a signed login assertion and walk in as any user, including an administrator, without ever supplying credentials. The underlying bugs come from the plugin accepting an attacker-chosen signature algorithm and mishandling a cryptographic library’s error code as if it were a valid signature, and confusion over the plugin’s seven separately versioned paid editions meant several stayed unpatched even after a fix shipped for the free version. Scanning traced to multiple countries points to opportunistic rather than targeted exploitation, though a public proof of concept for the free edition raises the odds of broader abuse.
OpenSSL Patches Nine Vulnerabilities Enabling Remote Denial-of-Service Attacks
OpenSSL shipped patches for nine vulnerabilities spanning its QUIC, DTLS, CMS and certificate-management code paths, most of which can be triggered remotely to crash a server or exhaust its memory rather than execute code. The most serious is a double-free bug in the QUIC server stack that can be set off by a single malformed handshake packet with an undersized connection ID, while a separate flaw in encrypted-message handling can force an out-of-bounds heap write during key unwrapping. Maintainers say remote code execution is unlikely across the board but are urging operators to prioritize patching internet-facing QUIC, DTLS and CMP services and to check for statically linked copies of the library that might not surface in routine version scans.
