Posts

🟠 High | Source: Microsoft Security Response Center CVE-2026-25681 is a vulnerability in the Go standard library package golang.org/x/net/html, where character references within DOCTYPE nodes are handled incorrectly. This can lead to malformed HTML parsing behaviour, potentially enabling injection or bypass attacks in applications that rely on this library for HTML processing. Any Azure services or workloads built with affected versions of the Go net/html package may be exposed. Security Architect’s Take: Audit your Go-based services and container images for dependencies on golang.org/x/net/html and update to the patched version as soon as it is available. Pay particular attention to internal tooling, API gateways, or microservices that parse untrusted HTML input, as these represent the highest risk surface. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-25680 is a denial-of-service vulnerability in the Go standard library package golang.org/x/net/html, triggered by parsing maliciously crafted HTML. An attacker could exploit this to crash or hang services that process arbitrary HTML input. This is particularly relevant to Azure-hosted Go applications and any managed services or pipelines built on the affected package. Security Architect’s Take: Audit your Azure workloads and container images for any Go applications that import golang.org/x/net/html and process untrusted HTML input — patch to the fixed version of golang.org/x/net immediately and enforce dependency scanning in your CI/CD pipelines to catch similar library-level issues going forward. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-48854 is a vulnerability in the elixir-grpc/grpc library where unbounded accumulation of request body data can exhaust server memory, potentially causing a denial of service. Attackers can exploit this by sending large or streaming gRPC requests that the server fails to cap, leading to service unavailability. This affects any cloud-hosted service built on this Elixir gRPC library, including those running on Azure. Security Architect’s Take: Audit any workloads using elixir-grpc and apply the patched version as soon as it is available; in the interim, enforce request size limits at the API gateway or load balancer layer to mitigate unbounded payload attacks. ...

🟠 High | Source: The Register — Security A cautionary tale from a major US telco in the early 2000s describes a new employee being handed unrestricted sudo access to a production database containing full, unencrypted customer records. The anecdote highlights systemic failures in access control, data protection, and onboarding security practices that remain alarmingly relevant today. While historical, it underscores how poor privilege management and cleartext data storage can expose millions of customers with minimal effort. ...

🟠 High | Source: GCP GKE Security Bulletins Multiple high-severity vulnerabilities have been discovered in containerd, the container runtime used by Google Kubernetes Engine (GKE). Attackers with permissions to create Pods can exploit these flaws to bypass Kubernetes security boundaries, potentially compromising the underlying host, poisoning image caches, or causing denial of service. Although some CVEs are rated Critical in containerd upstream, GKE classifies them as High due to the prerequisite of cluster-level Pod creation privileges. ...

🟠 High | Source: AWS Security Bulletins A vulnerability in the AWS Bedrock AgentCore Python SDK (versions 1.1.3 to 1.6.1) allows crafted package name arguments to bypass input sanitisation in the install_packages() method. An attacker could redirect pip to a malicious PyPI server to serve tampered packages, or use the ‘-r’ flag to read arbitrary files within the sandbox. The issue stems from an incomplete blocklist used to construct shell commands, rather than a safe argument-passing approach. ...

🟠 High | Source: The Hacker News Microsoft has disclosed a zero-day privilege escalation vulnerability in Microsoft Defender, tracked as CVE-2026-50656 with a CVSS score of 7.8. The flaw, codenamed RoguePlanet, resides in the Microsoft Malware Protection Engine and allows attackers to elevate their privileges on affected systems. A patch is currently in development, meaning no official fix is yet available. Security Architect’s Take: With no patch available, prioritise compensating controls such as restricting local access to endpoints running Defender, ensuring least-privilege principles are enforced, and monitoring for unusual privilege escalation activity via SIEM or Microsoft Sentinel. Track the Microsoft Security Update Guide for CVE-2026-50656 and be prepared to deploy the patch rapidly once released. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-35433 is an Elevation of Privilege vulnerability in .NET that allows an attacker to gain higher system permissions than intended. Microsoft has revised the advisory to clarify that Windows 11 versions 21H1 and 22H2 are no longer considered affected. Organisations running .NET on other impacted platforms should review their patch status promptly. Security Architect’s Take: Audit your Azure-hosted workloads and CI/CD pipelines running .NET to confirm which runtime versions are deployed, and verify patched versions are in use. Remove Windows 11 21H1 and 22H2 from your affected-systems tracking if previously included. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-42828 is an elevation of privilege vulnerability in the Windows Projected File System (ProjFS), a component that allows applications to present virtual file system content. If exploited, an attacker could gain elevated privileges on an affected Windows system. This update is an acknowledgement addition only and contains no new technical or patch information. Security Architect’s Take: No immediate action is required as this is a non-technical acknowledgement update with no change to patch status or severity. Ensure Windows systems in your Azure or hybrid environments have already applied the relevant cumulative updates addressing this CVE, and verify coverage through your patch management tooling. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-45475 is a remote code execution vulnerability affecting Microsoft Office. A successful exploit could allow an attacker to run arbitrary code on a victim’s machine, typically triggered by opening a malicious document. This update is an acknowledgement addition and carries no new technical detail, but the underlying vulnerability remains a concern for organisations reliant on Office productivity tools. Security Architect’s Take: Ensure Microsoft Office is fully patched across all endpoints, including virtual desktops and cloud-hosted environments such as Azure Virtual Desktop. Verify that your patch management tooling has applied the relevant Office security update and review whether macro execution policies and Protected View are enforced via Group Policy or Microsoft Intune. ...