[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f3orpv715v0bk8":56,"i-tabler:arrow-left":121,"i-tabler:tag":123},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":71,"metaDescription":72,"shareImage":73,"updatedAt":61,"author":77,"related":79},"microsoft-authenticator-android-cve-2026-80097","Microsoft Authenticator for Android Could Hand Your Work Tokens to Another App (CVE-2026-80097)","CVE-2026-80097 let a malicious Android app trick Microsoft Authenticator into handing over work account tokens. Fixed in 6.2606.4246, patched since September. Not exploited, per Microsoft. Check your version and lock down sideloading.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fmsauth_cve_2026_80097.png","2026-10-27T12:00:00.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",4,"\u003Cp>A headline about Microsoft Authenticator leaking tokens to Android apps with \"zero permissions\" is making the rounds this week. Before anyone panics: this is not a new zero-day. Microsoft fixed it and published \u003Ca href=\"https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2026-80097?ref=ghost.jdneer.com\">CVE-2026-80097\u003C\u002Fa> on September 8, 2026, as part of September Patch Tuesday. What is new is the researchers' write-up, which shows exactly how the bug worked. That makes it a good moment to check that the fix actually landed on every phone you care about.\u003C\u002Fp>\u003Ch2 id=\"what-it-actually-is\">What it actually is\u003C\u002Fh2>\u003Cp>Microsoft calls it the \"Microsoft Authenticator Elevation of Privilege Vulnerability\" and describes it as \"improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally\" (CWE-287). Only \u003Cstrong>Microsoft Authenticator for Android\u003C\u002Fstrong> is listed. The iOS app is not part of this advisory.\u003C\u002Fp>\u003Cp>On Android, Authenticator does more than show codes. When a work account is signed in, it acts as the sign-in broker for Microsoft apps like Teams and Outlook, and hands them tokens so you don't sign in to each app separately. That broker role is where the bug lived.\u003C\u002Fp>\u003Cp>Ofek Levin of \u003Ca href=\"https:\u002F\u002Fenclave.ai\u002Fblog\u002Fauthmask-we-made-microsoft-authenticator-hand-over-tokens?ref=ghost.jdneer.com\">Enclave\u003C\u002Fa> found that an exported activity in Authenticator, \u003Ccode>com.microsoft.identity.client.AccountChooserActivity\u003C\u002Fcode>, could be launched by any app on the device. It built the token request from values the calling app supplied: package name, client ID, redirect URI, scopes and caller UID. The validation checked that the redirect URI matched the signature of the package the caller \u003Cem>claimed\u003C\u002Fem> to be. Since the real Teams app is installed, a malicious app can read its public signature, build the matching redirect URI, and pass the check. Authenticator knew the real caller's package name, but never used it for the trust decision.\u003C\u002Fp>\u003Cp>In Enclave's tests, posing as Teams and asking for Microsoft Graph returned access, refresh and ID tokens with delegated scopes such as Mail.ReadWrite, Mail.Send, Files.ReadWrite.All, Calendars.ReadWrite and Sites.ReadWrite.All. Posing as Authenticator's own client returned scopes for managing authentication methods and passkeys. In plain terms: mail, OneDrive, SharePoint, calendar and Teams, as the signed-in user.\u003C\u002Fp>\u003Ch2 id=\"how-bad-is-it\">How bad is it?\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Score:\u003C\u002Fstrong> CVSS 3.1 base score 8.6, which is High on the CVSS scale. Microsoft's own severity rating is Important. The vector is \u003Ccode>AV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H\u003C\u002Fcode>: local attack, no privileges, user interaction required, scope changed.\u003C\u002Fli>\u003Cli>\u003Cstrong>What the attacker needs:\u003C\u002Fstrong> per Microsoft's FAQ, the attacker has to get a malicious app installed and running on the victim's Android device and convince the user \"to complete an authentication flow in Microsoft Authenticator.\" The news coverage says no approval is needed. I'm going with Microsoft's description, which is what the score is based on.\u003C\u002Fli>\u003Cli>\u003Cstrong>What they get:\u003C\u002Fstrong> Microsoft says a successful attacker \"could potentially gain the ability to authenticate against a remote host using the current user's credentials\" and \"obtain authentication tokens and access resources as the affected user.\"\u003C\u002Fli>\u003Cli>\u003Cstrong>Exploitation:\u003C\u002Fstrong> Microsoft lists it as not exploited and not publicly disclosed before the fix, with \"Exploitation Less Likely.\" CISA's assessment on the \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-80097&ref=ghost.jdneer.com\">CVE record\u003C\u002Fa> also says exploitation \"none.\" Enclave demonstrated the attack in its research and shows code snippets, but I'm not aware of a published, ready-to-run exploit.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"affected-and-fixed-versions\">Affected and fixed versions\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Affected:\u003C\u002Fstrong> Microsoft Authenticator for Android 6.0.0 up to, but not including, 6.2606.4246 (\u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-80097&ref=ghost.jdneer.com\">CVE.org\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80097?ref=ghost.jdneer.com\">NVD\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Fixed:\u003C\u002Fstrong> 6.2606.4246 or later, delivered through \u003Ca href=\"https:\u002F\u002Fplay.google.com\u002Fstore\u002Fapps\u002Fdetails?id=com.azure.authenticator&ref=ghost.jdneer.com\">Google Play\u003C\u002Fa>. Microsoft corrected the fix build number in the advisory on September 15, so if you saw a different number in early September, go with 6.2606.4246.\u003C\u002Fli>\u003Cli>\u003Cstrong>Not listed:\u003C\u002Fstrong> Authenticator for iOS.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"how-to-check-your-version\">How to check your version\u003C\u002Fh2>\u003Cp>On the phone: open \u003Cstrong>Settings > Apps > Authenticator\u003C\u002Fstrong>. The version is shown on the app info page. Anything at 6.2606.4246 or higher is fixed.\u003C\u002Fp>\u003Cp>If you have a test phone on USB with developer mode on:\u003C\u002Fp>\u003Cpre>\u003Ccode>[user@laptop ~]$ adb shell dumpsys package com.azure.authenticator | grep versionName\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Admins can also check the reported app version per device in the Intune admin center under the app's device install status.\u003C\u002Fp>\u003Ch2 id=\"what-to-do\">What to do\u003C\u002Fh2>\u003Cp>\u003Cstrong>On your own Android phone\u003C\u002Fstrong>\u003C\u002Fp>\u003Col>\u003Cli>Open Google Play, search for Microsoft Authenticator, and tap \u003Cstrong>Update\u003C\u002Fstrong> if it shows up.\u003C\u002Fli>\u003Cli>Turn on auto-update for it: on the app's Play Store page, tap the three-dot menu and enable \u003Cstrong>Enable auto update\u003C\u002Fstrong>.\u003C\u002Fli>\u003Cli>Review what you have installed outside Google Play. Go to \u003Cstrong>Settings > Apps > Special app access > Install unknown apps\u003C\u002Fstrong> and switch it off for browsers, file managers and chat apps that don't need it.\u003C\u002Fli>\u003Cli>Keep Google Play Protect on.\u003C\u002Fli>\u003C\u002Fol>\u003Cp>\u003Cstrong>On iPhone\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>The iOS app isn't affected by this CVE. Keep it updated through the App Store anyway, since it is the app that guards your accounts.\u003C\u002Fp>\u003Cp>\u003Cstrong>If you manage devices with Intune\u003C\u002Fstrong>\u003C\u002Fp>\u003Col>\u003Cli>\u003Cstrong>Force the update.\u003C\u002Fstrong> Managed Google Play apps by default only update on Wi-Fi, while charging and when the phone is idle, so they can lag for days. For Authenticator, set the assignment's update mode to \u003Cstrong>High priority\u003C\u002Fstrong> in Apps > All apps > Microsoft Authenticator > Properties > Assignments (\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fapp-management\u002Fdeployment\u002Fadd-managed-google-play?ref=ghost.jdneer.com\">Microsoft Learn\u003C\u002Fa>). Don't leave it on Postponed, which holds updates for 90 days.\u003C\u002Fli>\u003Cli>\u003Cstrong>Block sideloading.\u003C\u002Fstrong> For personally owned work profile devices, set \u003Cstrong>Prevent app installations from unknown sources in the personal profile\u003C\u002Fstrong> to Block, and set \u003Cstrong>Threat scan on apps\u003C\u002Fstrong> to Require. On corporate-owned devices, don't allow installation from unknown sources (\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-configuration\u002Ftemplates\u002Fref-device-restrictions-android-enterprise?ref=ghost.jdneer.com\">device restriction settings\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Check who is still behind.\u003C\u002Fstrong> Look at the install status for Authenticator and follow up on devices that report a version below 6.2606.4246, including phones that haven't checked in recently.\u003C\u002Fli>\u003Cli>\u003Cstrong>If you suspect a user was hit,\u003C\u002Fstrong> revoke their sessions in the Entra admin center (user > Overview > Revoke sessions) or with Graph PowerShell, as described in \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fusers\u002Fusers-revoke-access?ref=ghost.jdneer.com\">Microsoft Learn\u003C\u002Fa>. Revoking stops the refresh tokens. Access tokens that were already issued stay valid until they expire. Then review the user's \u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fmonitoring-health\u002Fconcept-sign-ins?ref=ghost.jdneer.com\">sign-in logs\u003C\u002Fa> and mailbox activity.\u003C\u002Fli>\u003C\u002Fol>\u003Cpre>\u003Ccode>PS> Revoke-MgUserSignInSession -UserId $User.Id\u003C\u002Fcode>\u003C\u002Fpre>\u003Ch2 id=\"my-take\">My take\u003C\u002Fh2>\u003Cp>The bug itself is a classic: the app knew who was really calling and trusted what the caller said instead. The useful lesson for the rest of us is about the setup around it. A broker app on your phone holds the keys to your work account, and the only thing standing between it and a malicious app is that app's own checks. Two things make this kind of bug much less scary: phones that pull security updates within hours, not weeks, and no random APKs sitting next to your work account. If your MDM doesn't enforce both yet, this is your reminder.\u003C\u002Fp>\u003Cp>\u003Cem>Sources: \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2026-80097?ref=ghost.jdneer.com\">\u003Cem>Microsoft Security Update Guide, CVE-2026-80097\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-80097&ref=ghost.jdneer.com\">\u003Cem>CVE.org record CVE-2026-80097\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80097?ref=ghost.jdneer.com\">\u003Cem>NVD CVE-2026-80097\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fenclave.ai\u002Fblog\u002Fauthmask-we-made-microsoft-authenticator-hand-over-tokens?ref=ghost.jdneer.com\">\u003Cem>Enclave research write-up\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fplay.google.com\u002Fstore\u002Fapps\u002Fdetails?id=com.azure.authenticator&ref=ghost.jdneer.com\">\u003Cem>Microsoft Authenticator on Google Play\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fapp-management\u002Fdeployment\u002Fadd-managed-google-play?ref=ghost.jdneer.com\">\u003Cem>Microsoft Learn: Managed Google Play app updates\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-configuration\u002Ftemplates\u002Fref-device-restrictions-android-enterprise?ref=ghost.jdneer.com\">\u003Cem>Microsoft Learn: Android Enterprise device restrictions\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fusers\u002Fusers-revoke-access?ref=ghost.jdneer.com\">\u003Cem>Microsoft Learn: Revoke user access in Entra ID\u003C\u002Fem>\u003C\u002Fa>\u003Cem>.\u003C\u002Fem>\u003C\u002Fp>","Microsoft Authenticator Android CVE-2026-80097: what to do","CVE-2026-80097 in Microsoft Authenticator for Android: what the broker flaw does, affected and fixed versions, and what users and Intune admins should do.",{"src":60,"width":74,"height":75,"type":76},1600,900,"image\u002Fpng",{"name":78,"url":10,"owner":5},"JD Bungart",[80,90,99,110],{"slug":81,"title":82,"excerpt":83,"image":84,"publishedAt":85,"topics":86,"readMinutes":89},"collabora-built-in-code-nextcloud-cve-2026-110447","Nextcloud Admins: Update or Remove the Collabora Built-in CODE App (CVE-2026-110447)","CVE-2026-110447 is an unauthenticated command injection in the Collabora Online Built-in CODE Server app for Nextcloud. It is exploited in the wild and in CISA KEV. Disabling the app is not enough: upgrade to 26.4.303 or remove it.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fcollabora-built-in-code-nextcloud-cve-2026-110447-advisory.png","2026-10-27T08:00:00.000+08:00",[87,88],{"key":64,"label":65},{"key":67,"label":68},1,{"slug":91,"title":92,"excerpt":93,"image":94,"publishedAt":95,"topics":96,"readMinutes":89},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[97,98],{"key":64,"label":65},{"key":67,"label":68},{"slug":100,"title":101,"excerpt":102,"image":103,"publishedAt":104,"topics":105,"readMinutes":89},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[106,109],{"key":107,"label":108},"guides","Guides",{"key":67,"label":68},{"slug":111,"title":112,"excerpt":113,"image":114,"publishedAt":115,"topics":116,"readMinutes":89},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[117,120],{"key":118,"label":119},"opinion","Opinion",{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":122},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":124},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]