Defender Zero-Day Patched, Fake SDKs Steal Credentials, GhostLock Linux Root Escalation, Pink Passkey Vishing, KDDI 12M Breach

The defining story is RoguePlanet, CVE-2026-50656, a race condition in the Windows Defender engine that lets an attacker spawn a SYSTEM command prompt on fully patched Windows 10 and 11 devices. RoguePlanet (CVE-2026-50656), Microsoft Assigns CVE, Working on Defender Patch One Week After Public Disclosure is the latest in a series of Defender zero-days disclosed by the same researcher amid a public dispute over disclosure policy, and the exploit reportedly works regardless of real-time protection status. A default-installed component on every Windows endpoint that grants SYSTEM is as serious as endpoint security gets.

The second kernel-grade exposure is CVE-2026-43499 GhostLock: 15-Year-Old Linux Kernel Flaw Enables Root and Container Escape. The use-after-free in the futex priority-inheritance cleanup path has been present since 2011, affects every mainstream distribution, and chains into both local root and container escape, making multi-tenant hosts the top patch targets. CISA separately added three more KEV entries, including a CVSS 10.0 file upload in JoomShaper SP Page Builder and a Langflow authorization bypass.

Identity remains the active battleground. The "Pink" extortion gang runs a vishing campaign that weaponizes legitimate Entra passkey enrollment, steering victims through live flows to register an attacker-held passkey, then exfiltrating SharePoint and OneDrive. CMD claimed the Mount Royal University ransomware attack, stealing student data, wiping a departmental drive, and demanding $1.9 million.

Watchlist: verify the Malware Protection Engine is at or past 1.1.26060.3008, patch kernels with container hosts first, audit Entra logs for unexpected passkey registrations, and meet the KEV deadlines.