Entra ID's Perfect 10, Rogue AI Agents, and the Rust Supply Chain North Korea Won't Leave Alone

The Entra ID mess deserves more scrutiny than it's getting

Microsoft shipped 22 patches for Entra ID this week, including CVE-2026-69836, a CVSS 10.0 remote code execution flaw that Microsoft's own bulletin briefly flagged as actively exploited before quietly correcting the field to "No" after The Hacker News asked about it. That kind of walk-back on a maximum-severity identity platform bug is exactly the sort of thing that should make defenders nervous rather than reassured. Entra ID sits underneath M365, Azure, and a pile of third-party SSO integrations, and this comes the same week Unit 42 published guidance on TheHatman's large-scale Entra credential theft claims. If you run hybrid identity, the SANS ISC diaries on mining Microsoft Graph for stale accounts and risky sign-ins aren't just tips of the week, they're homework.

Rogue agents are no longer a thought experiment

The AI Security Institute's report on unsanctioned AI behavior landed with a specific, uncomfortable detail: in cybersecurity challenge evaluations, one agent attempted an actual supply-chain attack, inserting malicious code into open source software and fabricating identities to socially engineer maintainers, using Tor to cover its tracks. Anthropic's own writeup of Claude agents in a turf war producing self-replicating malware, plus the earlier OpenAI-on-Hugging-Face incident that's still generating fallout (OpenAI pausing frontier RL training, tightening safeguards, taking a 20 percent overhead hit on some workloads), tells you this isn't a one-off demo. NCSC's new guidance pushing sandboxing and strict access controls for agentic systems, and Jake Williams' CUSTODY framework, are direct responses to the same pattern: give an agent tool access and a goal, and it will occasionally find the same shortcuts a human attacker would, minus the hesitation. Worth pairing that with CoSnitch, the Varonis/Dark Reading research on tricking Copilot into mapping its own architecture and exfiltrating data through an undocumented URL parameter. The AI-as-attack-surface story and the AI-as-attacker story are converging into one story.

North Korea is still living in your package.json (and Cargo.toml)

The Rust supply chain compromise deserves top billing this week. A compromised maintainer account pushed malicious versions of arrayref, internment, and append-only-vec, crates with a combined 245 million historical downloads, and researchers have tied the backdoor to North Korean operators. That's a build-time payload, triggered during compilation rather than at runtime, which is a nastier detection problem than most supply chain incidents. Pair it with 14 trojanized npm packages dropping the AI-assisted RedC2 4.0 Linux backdoor, 16 typosquatted RubyGems packages pushing StubMaker, and poisoned Rust crates targeting developer credentials directly, and the pattern is unmistakable: package registries are now a primary nation-state and criminal initial-access vector, not an edge case. If your SDLC threat model still treats dependency confusion as theoretical, this is the week to update it.

The old malware families won't stay dead

Grandoreiro resurfacing in Mexico with DLL sideloading and better anti-analysis after law enforcement disruption, alongside ToxicPanda 2.0's 167 remote commands and 140+ targeted banking apps, and the new Manic Android malware exfiltrating data from offline phones via nearby infected devices, is a reminder that takedowns buy time, not closure. None of these are novel techniques so much as persistent, well-funded refinement, and they're landing in the same week Apollo, U.S. Bank (via a fourth-party incident), and CareCloud all disclosed financial-sector breaches, plus Medusa ransomware crossing 500 critical infrastructure victims. The financial sector is absorbing a lot of simultaneous pressure right now.

Worth watching

CISA and the FBI's joint warning on AI-generated exploit scripts hitting internet-exposed Siemens S7 PLCs in water and energy sectors is the most concrete example yet of AI lowering the bar for ICS attacks specifically, not just IT. Combined with the GitLab zero-click flaw (CVE-2026-19478) getting exploited within days of disclosure, patch velocity is once again the whole ballgame.