A critical identity provider flaw, a four-day power plant shutdown, and a tenfold surge in framework vulnerabilities — today’s brief covers three stories that each demand a different kind of conversation with customers. The Keycloak CVE requires immediate patching. The OT attack requires an architecture review. The Spring numbers require a planning session.

In the News

Keycloak Password Reset Flaw Enables Unauthenticated Account Takeover

CVE-2026-18963 (CVSS 9.1) is a critical vulnerability in Red Hat Keycloak and Red Hat SSO that allows a remote, unauthenticated attacker to trigger a password reset on any account. No credentials, no prior access, no social engineering required — an attacker sends a crafted request to the password reset endpoint and gains control of the target account.

The blast radius here is not limited to Keycloak itself. Keycloak is the dominant open-source identity provider for enterprises running federated architectures. If an organization uses Keycloak as the IdP behind their SSE platform, VPN concentrator, SaaS applications, or internal tooling, then a single compromised Keycloak account can provide initial access to every downstream service that trusts that identity assertion. This is not a web application bug — it is an identity infrastructure compromise (MITRE ATT&CK T1078 — Valid Accounts).

The immediate mitigation is to apply the patch from Red Hat. If patching cannot happen within hours, disable the self-service password reset flow entirely and monitor Keycloak audit logs for anomalous RESET_PASSWORD events. Phishing-resistant MFA (FIDO2, WebAuthn) enforced at the Keycloak layer provides a compensating control — even if the password is reset, the attacker cannot complete authentication without the hardware credential.

What defenders should do: Patch Keycloak and Red Hat SSO immediately. Disable self-service password reset if patching is delayed. Audit identity provider logs for reset events that do not correlate with legitimate user requests. Enforce phishing-resistant MFA on all Keycloak-federated applications.

Source: The Hacker News

Iran-Linked Hackers Shut Down UK Power Plant for Four Days

An Iran-linked threat group caused a multi-day operational shutdown of a UK power generation facility — the first confirmed case of a nation-state OT attack producing sustained downtime at a Western energy site. The attack traversed from IT networks into operational technology environments, ultimately disrupting the control systems responsible for power generation.

This incident changes the threat model for energy-sector defenders. Previous OT-targeted attacks — Industroyer, TRITON, the 2022 Sandworm campaign against Ukrainian substations — demonstrated capability and intent but had not produced multi-day outages at Western facilities. A four-day shutdown at a power plant is a board-level event with regulatory, financial, and public safety consequences. The attack pattern — IT-to-OT lateral movement via inadequate segmentation — is repeatable across any facility where IT and OT zones share network infrastructure or trust relationships (MITRE ATT&CK T1021 — Remote Services, T0886 — Remote Services (ICS)).

The primary defensive question is straightforward: can an attacker who compromises an IT workstation reach OT control systems? If the answer is yes — or unknown — the architecture is not defensible. East-west visibility between IT and OT zones, OT asset inventory, and network segmentation enforced at Layer 3 and above are the foundational controls.

What defenders should do: Audit IT/OT segmentation boundaries. Deploy OT-specific asset discovery and anomaly detection. Ensure incident response plans explicitly cover OT scenarios. Validate that IT-side compromises cannot traverse to OT control networks.

Source: SecurityWeek

Spring Framework Ships 91 CVE Patches — 10x Surge Over 2025

Spring Framework has disclosed and patched 91 CVEs so far in 2026, compared to 16 for all of 2025. The tenfold increase could reflect an intensive internal audit, increased external researcher attention, or both — but the operational reality is identical regardless of the cause: customers running Java-based APIs, microservices, or cloud-native stacks now face a remediation backlog an order of magnitude larger than their 2025 baseline.

Spring is embedded deeply in enterprise Java applications. It is not a single product that can be patched in one maintenance window — it is a set of libraries woven into application dependencies, often multiple layers deep. Organizations that lack a current software bill of materials (SBOM) for their application portfolio will struggle to even identify which applications are affected, let alone prioritize remediation across 91 distinct vulnerabilities.

This is where vulnerability prioritization becomes a capacity problem. Not all 91 CVEs carry equal risk. Exploit-correlated prioritization — matching disclosed CVEs against known exploit availability, asset criticality, and internet exposure — separates the handful of patches that must ship this week from the dozens that can be scheduled into normal maintenance cycles. Software composition analysis (SCA) tools that map Spring dependencies across the application portfolio are the prerequisite for that prioritization.

What defenders should do: Generate or update SBOMs for all Java-based applications. Use software composition analysis to identify Spring dependencies across the portfolio. Prioritize the 91 CVEs by exploit availability and asset exposure, not just CVSS score. Plan remediation capacity for sustained elevated patching through the rest of 2026.

Source: SecurityWeek

Threat Pulse

UAT-10147 scales attacks with AI, deploys SPECTRE implant. A Chinese-speaking threat group tracked as UAT-10147 is targeting Windows and Linux web servers across education, media, tech, and gaming sectors — primarily in Brazil, Bolivia, China, Canada, and Vietnam. The group deploys the SPECTRE implant, which uses a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR agents on Windows and a rootkit for persistence on Linux. Notably, the group is using AI to scale reconnaissance and initial exploitation — an operational pattern that increases the volume of attacks a small team can execute. MITRE ATT&CK: T1068 — Exploitation for Privilege Escalation, T1014 — Rootkit. (The Hacker News)

Operation QUICSILVER targets Myanmar government. A China-nexus APT is using QUICAgent — a Go-based backdoor — against Myanmar government and IT sector targets, delivered through graduation ceremony lure documents. The name suggests possible QUIC protocol abuse for command-and-control evasion, which would bypass security tooling that inspects only TCP-based C2 channels. (The Hacker News)

Defender Action Items

  • Patch Keycloak / Red Hat SSO for CVE-2026-18963 immediately. Disable self-service password reset if patching is delayed. Enforce FIDO2 MFA on all federated applications.
  • Patch Zimbra Collaboration Suite for CVE-2026-73570 — actively exploited and CISA KEV listed with a 3-day federal deadline. Confirm Zimbra instances are inventoried; legacy deployments are commonly forgotten.
  • Audit IT/OT segmentation at energy and critical infrastructure sites. Validate that IT-side compromises cannot traverse to OT control networks. Deploy OT-specific asset discovery.
  • Inventory Spring dependencies across Java application portfolios. Generate SBOMs, run software composition analysis, and prioritize the 91 disclosed CVEs by exploit availability and exposure.
  • Monitor for BYOVD activity — UAT-10147’s SPECTRE implant loads a vulnerable driver to disable EDR. Detect unsigned or known-vulnerable driver loads via Sysmon Event ID 6 or equivalent EDR telemetry.

Detection Spotlight

UAT-10147’s SPECTRE implant uses bring-your-own-vulnerable-driver (BYOVD) to disable endpoint detection. Detecting vulnerable driver loads is a high-fidelity signal — legitimate software rarely loads unsigned or known-vulnerable kernel drivers. The following Splunk SPL query identifies driver load events from Sysmon (Event ID 6) where the driver signature status indicates an unsigned or expired certificate, or where the loaded driver hash matches known BYOVD candidates.

index=sysmon EventCode=6
| eval sig_status=coalesce(SignatureStatus, "Unknown")
| where sig_status IN ("Expired", "Revoked", "Unsigned", "Unknown")
| stats count by Computer, ImageLoaded, Hashes, SignatureStatus, _time
| sort - _time
| lookup byovd_hashes.csv hash AS Hashes OUTPUT driver_name, cve_id
| where isnotnull(driver_name)
| table _time, Computer, ImageLoaded, driver_name, cve_id, SignatureStatus

This query assumes a byovd_hashes.csv lookup table populated with known vulnerable driver hashes from the LOLDrivers project. False positives are low — legitimate drivers with expired signatures do occur but are uncommon in well-managed environments. Any match against the BYOVD hash list warrants immediate investigation.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.