GitLab released an out-of-band critical patch for CVE-2026-19478, an unauthenticated code injection vulnerability affecting public projects across all supported GitLab versions. The vulnerability allows remote attackers to tamper with public projects via a single HTTP request without requiring authentication or prior access. watchTowr reproduced the vulnerability within minutes of disclosure using only public advisory information and GitLab’s own code fix, demonstrating low barrier to exploitation. The flaw extends beyond GitLab’s initial “modify or delete” description, enabling attackers to delete entire repositories, forge merge records to falsely indicate fixes have been implemented, and remove project maintainers from their own projects. GitLab has released patches across all affected versions. Exploitation is not yet confirmed in the wild but security researchers note rapid weaponization timelines for critical vulnerabilities using AI-assisted exploitation.

Impact: Attackers can delete repositories, falsify project history to hide malicious code, remove maintainers, and compromise supply chain integrity. Public repositories hosting widely-used libraries face significant risk of silent compromise.

Recommendation:

• Upgrade all GitLab instances to patched versions immediately.
• If unable to upgrade, restrict public access to project manipulation endpoints.
• Review project access logs for suspicious modifications or deletions.
• Audit recent merge records and commit history for unauthorized changes.
• Monitor for repository deletions, maintainer bans, and anomalous merge activity.
• Implement network-level access controls restricting project operations to authenticated users.

CISA, NSA, FBI, DOE, and EPA warned of an active cyber threat targeting Siemens S7 Series programmable logic controllers across U.S. critical infrastructure. Threat actors are using Internet scanning services such as Censys and ZoomEye to identify exposed or poorly segmented S7-200, S7-300, S7-400, S7-1200, and S7-1500 controllers, then using AI assistance to rapidly generate and refine exploitation scripts based on publicly available vulnerability information. The activity is focused on Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential exposure extending to other sectors including the Defense Industrial Base.

The actors are combining AI-generated Python scripts with open-source industrial automation libraries such as snap7.dll and python-snap7 to create tools that mimic legitimate OT monitoring software while providing read/write access to PLC memory, configuration data, and ladder logic over S7comm. Current activity includes reconnaissance, insecure credential abuse, data-block reads, and write operations that the agencies assess may support capability testing and pre-positioning for future operational effects. The advisory emphasizes that AI is reducing the expertise and development time required to build working ICS exploitation tooling, allowing actors to more quickly adapt public research into operational capabilities

Impact: Unauthorized access to Siemens S7 PLCs could enable manipulation of industrial processes, safety interlocks, emergency shutdown systems, configuration data, or ladder logic. Potential consequences include production disruption, degraded public services, personnel safety incidents, equipment damage, extended downtime, theft of sensitive operational information, and cascading effects across interconnected facilities and supply chains.

Recommendation:

• Inventory S7-200, S7-300, S7-400, S7-1200, and S7-1500 PLCs, including firmware versions, network exposure, and associated TIA Portal or STEP 7 engineering workstations.
• Remove PLCs from direct internet exposure and block inbound TCP port 102 at perimeter boundaries; use segmented OT/IT architectures and controlled remote-access paths.
• Apply current Siemens firmware and TIA Portal/STEP 7 security updates, prioritizing internet-facing or DMZ-connected systems after appropriate operational testing.
• Restrict PLC programming and S7comm access to approved engineering workstations using IP/MAC allowlisting, password protection, protection levels, and MFA for remote OT access.
• Hunt for anomalous S7comm activity, including connections from non-engineering systems, off-hours access, unusual data-block reads, unauthorized writes, or configuration changes without corresponding work orders.
• Monitor for snap7.dll or python-snap7 usage outside approved engineering environments and investigate Python-based tooling that performs S7comm enumeration or read/write operations.
• Detect reconnaissance patterns such as sequential scanning of TCP port 102, repeated connection attempts with varying parameters, CPU property enumeration, or access originating from unexpected geographic locations.
• Validate PLC project files, ladder logic, and online versus offline configurations for unauthorized changes, and establish known-good backups before restoring or locking controller configurations.

Microsoft disclosed CVE-2026-69836, a critical remote code execution vulnerability affecting Microsoft Entra ID. The flaw stems from deserialization of untrusted data and could allow an unauthenticated remote attacker to execute code over the network without user interaction. Microsoft assigned the vulnerability a CVSS 3.1 score of 10.0, with low attack complexity, no privileges required, and high potential impact to confidentiality, integrity, and availability. Microsoft’s exploitability assessment confirms that the vulnerability has been exploited in attacks, although it was not publicly disclosed before the advisory and public exploit code is not currently known to be available.

Microsoft has already fully mitigated CVE-2026-69836 within the Entra ID cloud service and states that customers do not need to deploy an update or take action to resolve the vulnerability. The CVE was published primarily for transparency, and Microsoft has not disclosed technical details regarding the exploitation method, affected attack activity, threat actors, victim scope, or indicators of compromise.

Impact: Successful exploitation could have allowed an unauthorized remote attacker to execute code within the affected Entra ID service context, with Microsoft rating potential confidentiality, integrity, and availability impacts as high. Given Entra ID’s role in authentication and access management across Microsoft 365, Azure, Dynamics, and connected applications, exploitation of an identity platform vulnerability at this severity warrants attention even though the underlying service issue has already been remediated. However, Microsoft has not disclosed what access or downstream effects were achieved in observed attacks, so the actual scope of exploitation cannot currently be determined from public reporting.

Recommendation:

• No remediation action is required for the vulnerability itself; Microsoft states that CVE-2026-69836 has already been fully mitigated within Entra ID.
• Review Entra ID sign-in, audit, and identity-risk telemetry for anomalous privileged activity, unexpected account changes, suspicious application access, or unusual authentication patterns.
• Prioritize investigation of unexplained administrative or tenant-level changes occurring before Microsoft’s August 20 disclosure, particularly where no legitimate user action explains the activity.
• Review privileged identities, service principals, enterprise applications, and OAuth grants for unexpected additions, permission changes, or newly established access.
• Confirm that Entra ID audit and sign-in logging is enabled and retained long enough to support retrospective investigation if Microsoft releases additional exploitation details.
• Revoke suspicious sessions and tokens and rotate affected credentials if independent evidence of identity compromise is identified.
• Avoid creating CVE-specific detection logic based on unsupported assumptions, as Microsoft has not released exploit mechanics, attack indicators, or observable exploitation artifacts.
• Continue monitoring Microsoft guidance for additional technical details, indicators, or changes to the current “no customer action required” status.