Faculty & Staff

To modernize and improve identity security, between May 26 and June 12, 2026 some accounts are scheduled to migrate from ADFS to Microsoft Entra ID. Little impact is expected, however Entra ID does require two-step login. Those who have not activated Duo will need to do so.

What to expect after the migration: 

If someone experiences issues authenticating after this change, they should contact the IT Service Desk.

There will be a Drupal core security release for all supported branches on May 20, 2026, between 17:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.

Not all configurations are affected. Reserve time on May 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory.

We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before May 20, so that you can address any other upgrade issues before the security window. 

References:
https://www.drupal.org/psa-2026-05-18

A vulnerability known as "CopyFail" (CVE-2026-31431) has been disclosed affecting all versions of Linux released since 2017, allowing an attacker to locally escalate privileges to root using a 732-byte Python script. Peer institutions have reported attacks leveraging this vulnerability.

Update 05/08/2026: A newly disclosed Linux kernel local privilege escalation vulnerability chain, dubbed “Dirty Frag” and assigned CVE-2026-43284 and CVE-2026-43500, enables attackers with local access to obtain root privileges by exploiting flaws in the ESP (IPsec) and RxRPC subsystems. While no official patches are currently available, a public proof-of-concept exists. Organizations should assume the vulnerability is valid and exploitable under certain conditions. This vulnerability is a successor to Copy Fail (CVE-2026-31431).

Update 05/08/2026: Organizations and users should not undertake to "test" these exploits, as this will cause unnecessary alerts and incident response.

References:
https://copy.fail/
https://www.wiz.io/blog/dirty-frag-linux-kernel-local-privilege-escalation-via-esp-and-rxrpc

Enter a full description of the incident. This will appear in the "see all information" view of this alert.

Enter a full description of the incident. This will appear in the "see all information" view of this alert.