This past week alone, security teams watched five unrelated vendors get hit with five unrelated vulnerability classes — an identity platform, an industrial control system, a code repository, a video conferencing server, and an endpoint security tool. On the surface, these look like five separate news stories. Look closer and a single pattern emerges: none of these were collateral damage. Each was the primary target, and each was targeted precisely because it’s the kind of system organizations trust by default.
Five systems, one blind spot
Microsoft’s Entra ID — the identity backbone that authenticates users across countless enterprise environments — was hit by a deserialization flaw rated a perfect 10.0 on the severity scale, allowing code execution with zero credentials required. Microsoft fixed it server-side before public disclosure, which sounds reassuring until you realize customers have no patch to verify, no log to check, no way to confirm exploitation didn’t happen during the exposure window. When the fix is invisible, so is your evidence of safety.
Industrial control systems saw a parallel shift. Federal agencies warned that attackers are now using AI-assisted scripting to build custom exploitation tools against Siemens PLCs — hardware that runs physical processes in water treatment, energy, and manufacturing. Building this kind of tooling used to require deep, specialized OT expertise. AI has lowered that bar significantly, meaning attackers with ordinary IT skills can now target infrastructure that used to require a rare specialist.
Developer infrastructure wasn’t spared either. A GitLab flaw allowing unauthenticated code injection was reportedly exploited in the wild within minutes of the patch being released — not days, minutes. That compression matters: it means no human-driven patch process can realistically outrun exploitation once details go public.
A widely-used video conferencing platform, deployed specifically by organizations wanting to avoid third-party cloud dependencies, was chained through two flaws by a nation-state-linked group to gain full code execution on host servers — turning the very tool meant to keep communications private into an entry point.
And even “fixed” isn’t always fixed: a researcher demonstrated a complete bypass of a Windows privilege escalation patch Microsoft issued months earlier, meaning organizations that closed that ticket and moved on were still exposed the whole time.
Why this pattern matters more than any single CVE
None of these five systems are unusual attack surfaces — quite the opposite. They’re identity, OT, source control, internal comms, and endpoint defense: the categories of infrastructure organizations rely on to protect everything else. That reliance is exactly the problem. Foundational systems are trusted by default, which means they get less scrutiny than the assets they’re protecting. Attackers who understand this aren’t going after what you’re defending — they’re going after what’s doing the defending.
What to actually do about it
Patching individual CVEs matters, but it’s not the lesson here. The practical takeaway is to ask a harder question: which categories of infrastructure in your environment have been quietly exempted from the same adversarial scrutiny you apply to public-facing systems? Identity providers, CI/CD pipelines, internal collaboration tools, and OT networks often get audited less rigorously simply because they’re “internal” or “managed.” That assumption is now a known targeting strategy, not a safe one.
Start by inventorying what your organization implicitly trusts without verifying, and treat re-auditing those trust boundaries as seriously as you treat patching a public web app.
Co-authored with Claude
References
- Microsoft Security Response Center — CVE-2026-69836 advisory
- CISA — Advisory AA26-231A: Siemens S7 PLC Threats
- GitLab — Security Release: GitLab 19.2.4
- CISA — Known Exploited Vulnerabilities: TrueConf
- Cybersecurity News — ShieldBreak CVE-2026-69414
Securify 
Leave a comment