Aug 24, 2026 · 9 min
Microsoft patches critical Entra ID flaw as security defenses face abuse
Microsoft patches perfect-ten Entra ID flaw, Defender driver deletes Defender at boot, Malware turns cars into proxy botnet
The episode connects cloud identity risk, security-tool tampering, exposed credentials, and connected-car botnets into one broader warning about trusted systems being repurposed against defenders.
- 1Microsoft patched a maximum-severity Entra ID deserialization vulnerability after revisiting its claim about active exploitation.
- 2Research showed a signed Windows Defender driver could remove security components during reboot, weakening endpoint protection at a critical moment.
- 3Android car head units joined proxy and ad-fraud botnets alongside hospital data exposure and still-active leaked AWS credentials.
Don't miss
The most striking finding is that a signed Windows Defender driver could be abused to delete security components during reboot.
The brief
David Shipley opens with a concentrated cybersecurity roundup: Microsoft’s Entra ID flaw, Defender driver abuse, hospital attacks, exposed AWS keys, and Android car botnets.
Microsoft patched a near-perfect-severity Entra ID deserialization vulnerability, while the episode examines the company’s handling of a withdrawn claim about exploitation.
Research showed that a signed Windows Defender driver could be abused to remove security components during reboot, turning trusted endpoint software into an attack surface.
The wider fallout includes a third-party data exposure involving SickKids, leaked AWS credentials that remain active, and Android vehicle head units recruited for proxy and ad fraud.
Taken together, the stories show how attackers can exploit trust at multiple layers, from cloud identity and signed drivers to hospitals and connected vehicles.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.