Security Signal Weekly: June 27-July 3, 2026

OverviewThis week kept circling the same operational lesson: the boring control planes are where the damage starts. Remote support, SharePoint, phone systems, firewalls, Microsoft 365, developer packages, and AI workflow servers all showed up because they sit close to credentials, admin access, customer environments, or production data.Reality check: If a system can manage users, reach endpoints, route traffic, or run code on behalf of a team, it deserves faster patching and better logging than a normal business app.Top 10 Security Signals1. SimpleHelp RMM auth bypass is now an active MSP-grade incident riskWhat happened: CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog after active exploitation of SimpleHelp’s OpenID Connect authentication bypass, while Horizon3.ai’s disclosure explains that vulnerable OIDC configurations can let an unauthenticated attacker obtain a technician session. Blackpoint and follow-on reporting tied exploitation to TaskWeaver and…