Demand Supplier Evidence for Endpoint, Collaboration and Dev-Tool Risk

What happened

Microsoft confirmed it's investigating a Defender zero-day named RoguePlanet and has assigned a CVE while working on a patch. The reported exploit can spawn SYSTEM-level command prompts in some environments, making patch timing and verified deployment operationally relevant; watch Microsoft advisories for patch availability and tenant applicability

Why the category manager should care

Treat Microsoft patch timing and proof-of-deployment as deliverables because buyer exposure depends on both release and validated installation

Key facts

• CVE assigned for RoguePlanet (CVE-2026-50656)
• Vendor confirmed active investigation and patch development
• Exploit can produce SYSTEM-level command prompts in some cases

What happened

Symantec researchers observed DragonForce ransomware using Microsoft Teams TURN relays and anonymous visitor tokens to proxy command-and-control traffic through legitimate Teams infrastructure. That technique makes malicious connections resemble normal collaboration traffic, so supplier-provided TURN/token telemetry and special logging are required to detect similar abuse

Why the category manager should care

Require collaboration vendors to provide TURN-relay logs and token-usage telemetry because relay infrastructure can be abused to bypass egress filters

Key facts

• Backdoor used Teams TURN relays to reach attacker command-and-control
• Attackers obtained anonymous Teams visitor tokens for relay access
• Observed within a targeted attack chain that led to data exfiltration

What happened

Researchers found at least 15 malicious JetBrains Marketplace plugins that exfiltrate AI API keys entered by developers, with large install counts across the affected plugins. The campaign directly exposes cloud AI credentials and downstream model access, so buyers should inventory plugin usage and enforce secure key-vaulting and publisher verification

Why the category manager should care

Treat IDE plugin management as both a security and procurement control because unmanaged plugins can expose cloud AI resources

Key facts

• At least 15 malicious JetBrains plugins identified
• Campaign installed across tens of thousands of developer environments
• Exfiltration occurs when users enter API keys into plugin settings

What happened

CISA added an actively exploited LiteSpeed cPanel user-end plugin to its Known Exploited Vulnerabilities list and ordered quick remediation for federal agencies. The flaw allows privilege escalation on shared hosting, making hosting-supplier inventories and emergency patch capabilities operationally significant for customers that rely on managed hosting

Why the category manager should care

Verify which hosting suppliers use the vulnerable plugin and how they will remediate because supplier action determines exposure

Key facts

• CISA added the LiteSpeed/cPanel plugin to the KEV catalog
• Federal agencies were ordered to secure affected servers quickly
• Vulnerability enables privilege escalation to root on shared hosts using CloudLinux/CageFS