Today’s Field Note

Three things worth your attention, none of them theoretical. A China-linked cluster is exploiting vulnerable Roundcube webmail at US and Canadian universities to steal credentials and drop backdoors, so if you run Roundcube in academia you are already in scope. Tenda shipped a backdoor in its router firmware (CVE-2026-11405) that hands unauthenticated attackers the web management interface, and there is no patch, which means the fix is network isolation, not a download. And Microsoft finally patched RoguePlanet (CVE-2026-50656), a privilege escalation in the Malware Protection Engine that grants SYSTEM, roughly a month after details went public, delivered quietly via engine update rather than a reboot cycle you would notice.

Today’s Action

  • Patch Roundcube to the current release immediately and hunt for unexpected mail rules, new backdoor processes, and credential access on university mail servers.
  • Confirm the Microsoft Malware Protection Engine has pulled the CVE-2026-50656 fix (engine 1.1.x current build); do not assume it self-updated on isolated or air-gapped hosts.
  • Pull affected Tenda devices off any internet-facing or trusted segment now, and restrict management interfaces to a dedicated admin VLAN until Tenda ships firmware for CVE-2026-11405.
  • Cross-check inbound access logs on all three for exploitation you may have already absorbed, not just future attempts.
  • Flag your helpdesk on the Entra passkey enrollment vishing angle while you are at it, since credential theft is the common thread today.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

You did not get compromised today. You just found out about it today.