Beat
Trust & Security
DKM enforcement activated this week to harden AD FS trust boundaries. Patch Tuesday reveals two new spoofing CVEs reopening the same surface. The trust-through-defaults pattern is not closing.
◆ Heath Callahan
Trust & Security
A critical authentication bypass in the Frontegg SAML SSO plugin allows attackers to forge SAML assertions and take over any WordPress site, including administrator accounts. No patch is available.
◆ Heath Callahan
Trust & Security
GHSA-965c-763c-88jm allows an attacker to redeem an OAuth state value at the Magic Link endpoint, authenticating as any user without mailbox access. The CVE-2026-110862 identifier that appeared in dispatches does not exist in any vulnerability database.
◆ Heath Callahan
Trust & Security
CTX697191 published Oct 8, 2026: second emergency patch on Citrix NetScaler SAML in one week. CVE-2026-107406 is a Critical RCE/DoS on SAML SP/IdP appliances. The Oct 3 fix line (14.1-73.37-41) sits inside the Oct 8 affected range. No workaround. Upgrade to 14.1-73.46+ or 13.1-64.29+.
◆ Heath Callahan
Trust & Security
CVE-2026-70229 reaches Active Directory Domain Services unauthenticated over the network – and the 9.8 circulating in secondary summaries is not Microsoft's number. The record carries CVSS 3.1 8.1 with high attack complexity, no observed exploitation, and the fix in Tuesday's update; the gap between those two figures decides how fast this gets patched, not whether.
◆ Heath Callahan
Trust & Security
An OIDC identity-provider update that leaves the client secret as the masked sentinel while the token URL changes re-binds the real stored credential to the new endpoint. Fixed in Keycloak 26.8.1: configuration changes now force the secret to be re-submitted instead of reused.
◆ Heath Callahan
Trust & Security
The management interface of IBM Security Verify Access processes untrusted data in a way that allows an unauthenticated remote attacker to execute arbitrary code. It is not an authentication bypass; the system processes the malicious payload directly.
◆ Heath Callahan
Trust & Security
Defenders who relied on Ivanti's September batch bulletin remain vulnerable to an actively exploited authentication bypass (CVE-2026-104935) that requires an emergency firmware upgrade. Federal agencies have 72 hours.
◆ Heath Callahan
Trust & Security
Defenders who relied on Citrix's September batch bulletin remain vulnerable to a memory overflow (CVE-2026-88779) reported under active exploitation that requires a second, emergency upgrade.
◆ Heath Callahan
Trust & Security
CVE-2026-108860 sits one level below 'Ships Without Auth': the authentication gate works as designed, but the HMAC secret it validates against is committed in the framework's own configuration file. No patched version is published.
◆ Heath Callahan
