weekly

[SIGNALS WEEKLY] Telephony, Observability, and Identity Under Quiet Pressure

The boring stack moved. CUCM WebDialer. Splunk sidecar. Messaging recovery keys. Very normal. Very annoying.

Wes

Wes

— 5 min read
Share
[SIGNALS WEEKLY] Telephony, Observability, and Identity Under Quiet Pressure

TL;DR

  • [Vulnerabilities] Active exploitation of CUCM WebDialer SSRF (CVE-2026-20230) and Splunk PostgreSQL sidecar arbitrary file operations (SVD-2026-0603) raises incident likelihood for internet-exposed UC and logging infrastructure; treat patch delays as de facto exposure windows.
  • [Vulnerabilities] CISA KEV additions (SharePoint CVE-2026-45659, Langflow CVE-2026-55255, SP/Joomlack Page Builder CVE-2026-48908/56290, SimpleHelp CVE-2026-48558) indicate real-world exploitation across “edge” web stacks and remote support tooling, often bypassing MFA or WAF assumptions.
  • [Threat Actors] Russian intelligence services are compromising secure messaging accounts via social-engineering of verification codes and backup/recovery keys—not breaking encryption—enabling durable account takeover and potential pivot into enterprise identity and MFA workflows.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Current Stories

TL;DR

  • [Vulnerabilities] Why this matters: Active exploitation + network-reachable critical paths means “patch latency” becomes “incident likelihood” for UC/telephony and core observability stacks. Cisco confirmed active exploitation of CVE-2026-20230 in Cisco Unified CM when WebDialer is enabled (disabled by default), where SSRF can be chained into file write and potential root escalation; Splunk also reported limited exploitation of CVE-2026-20220253 enabling unauthenticated arbitrary file create/truncate via a PostgreSQL sidecar endpoint.

  • [Vulnerabilities] Why this matters: CISA continues to use KEV as the “exploited-now” prioritization signal; this week’s additions include a SharePoint RCE-adjacent deserialization issue that matters for externally exposed collaboration infrastructure. CISA added CVE-2026-45659 (Microsoft SharePoint Server deserialization) to KEV on 2026-07-01 based on evidence of active exploitation.

  • [Geopolitics] Why this matters: Russian intelligence-aligned phishing is targeting high-value users by social-engineering account recovery/backup keys, turning “secure messaging” into an access path for sensitive historical communications. FBI/CISA warn RIS actors are impersonating messaging-app support to steal verification codes/PINs and Backup Recovery Keys; compromise is of accounts, not app encryption, but enables access to message history and account takeover (and keys can remain valid across account recreation unless rotated).

References

Emerging Stories

TL;DR

  • [Vulnerabilities] Why this matters: KEV adds are often the earliest “mass exploitation” signal for smaller ecosystems (plugins/builders/adjacent tooling) that sit behind WAF blind spots. On 2026-07-07, CISA added three KEVs tied to web builders and workflow tooling: SP Page Builder (CVE-2026-48908), Langflow (CVE-2026-55255), and Joomlack Page Builder (CVE-2026-56290).

  • [Vulnerabilities] Why this matters: Remote support tooling is high-leverage (privileged access + broad reach), and auth-bypass flaws can collapse MFA assumptions. SimpleHelp released a security fix stating some deployments are exploitable depending on configuration and strongly urged upgrades; CISA KEV indicates CVE-2026-48558 is exploited-in-the-wild (OIDC token signature not verified in certain OIDC configurations, potentially bypassing MFA).

  • [Vulnerabilities] Why this matters: “Exploitation evidence” and “vendor exploitability rating” can diverge; treat KEV as operational truth even if vendor frames exploitability as less likely. Microsoft’s CVE-2026-45659 guidance notes exploitation was “less likely” at publication, but CISA KEV inclusion signals confirmed exploitation activity; prioritize external SharePoint exposure triage accordingly.

References

Forecasts, Detection Opportunities and References...

Forecasts

TL;DR

  • Short-term: Expect accelerated scanning/exploitation attempts against CUCM WebDialer, Splunk sidecar endpoints, and newly-added KEV CMS/page-builder targets.

  • Long-term: Continued intelligence-led phishing against messaging apps will shift from code exploits to “account recovery/backup” workflows and device-linking.

  • Overlooked: Backup/recovery key theft can outlive account resets; incident response that ignores key rotation may leave a latent re-compromise path.

Read more