Today’s Field Note

Two active-exploitation items land on the same day, and they both hit trust anchors. Microsoft’s Entra ID flaw (CVE-2026-69836, CVSS 10.0) is a remote code execution bug in the identity layer that everything downstream leans on. Microsoft says it patched the service side and no customer action is required, which is technically true and operationally insufficient: if it touched your tenant during the exposure window, you want to know. Meanwhile GitLab’s CVE-2026-19478 (CVSS 9.4) went from disclosure to in-the-wild exploitation in days per watchTowr, letting unauthenticated attackers rewrite or delete public projects. And North Korean actors quietly poisoned the arrayref Rust crate (plus internment and append-only-vec), executing malware at compile time across packages with hundreds of millions of downloads.

Today’s Action

  • Patch self-managed GitLab to the fixed release for CVE-2026-19478 now, and audit public projects for unauthorized modification or deletion.
  • Review Entra ID sign-in and audit logs for anomalous activity during the exposure window; hunt for unexpected service principals, app registrations, and token grants despite Microsoft’s “no action” line.
  • Pin and audit Rust dependencies: block arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, and scan CI build logs for outbound fetches during compilation.
  • Rotate any developer credentials or secrets exposed on machines that built with the poisoned crates.
  • Confirm your GitLab and Entra instances are logging to somewhere attackers cannot reach, then set alerts on the above indicators.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Vendors patched the server. Your logs are still your problem.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.