Posts

🟠 High | Source: Microsoft Security Response Center CVE-2026-49762 is a denial-of-service vulnerability in a Version parsing module used within Azure, where unbounded integer parsing allows an attacker to trigger excessive CPU and memory consumption. By sending specially crafted version strings, an attacker could exhaust server resources and render affected services unavailable. This matters because DoS vulnerabilities in shared cloud infrastructure can have a broad blast radius, potentially impacting multiple tenants or dependent services. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-7774 is a path traversal vulnerability in Python’s tarfile module that allows an attacker to bypass the data_filter safety control, which is designed to prevent files from being extracted outside their intended directory. By crafting a malicious tar archive, an attacker could write files to arbitrary locations on the host filesystem. This is particularly concerning in cloud and containerised environments where tar extraction is commonly used in build pipelines, deployment scripts, and data ingestion workflows. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability in GD versions before 2.86 for Perl allows attackers to perform OS command injection and overwrite arbitrary files by exploiting a two-argument open() call when handling filename arguments in the _make_filehandle function. This is a well-known Perl pitfall where unsanitised filenames can be interpreted as shell commands. If exploited, an attacker could execute arbitrary commands or corrupt files on the underlying system. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-42768 is a Bleichenbacher-style oracle vulnerability affecting the CMS_decrypt() and PKCS7_decrypt() functions when handling messages encrypted for multiple recipients. An attacker who can observe decryption outcomes may be able to recover plaintext or private key material through a padding oracle attack. This is particularly concerning in any Azure or application workload that processes S/MIME or CMS-encrypted data. Security Architect’s Take: Audit any services or workloads — including Azure-hosted applications — that use OpenSSL or similar cryptographic libraries to decrypt multi-recipient CMS or PKCS#7 messages, and apply available patches immediately. Consider restricting access to decryption endpoints and adding timing-normalisation controls as a short-term mitigation. ...

🟠 High | Source: The Hacker News Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, an authentication bypass vulnerability (CVSS 7.8) affecting the GlobalProtect portal and gateway components of PAN-OS. An unknown threat actor is leveraging the flaw to gain unauthorised access to GlobalProtect VPN portals. This is particularly concerning as GlobalProtect is widely deployed as a primary remote access solution across enterprise environments. Security Architect’s Take: Prioritise patching PAN-OS to the fixed version immediately, and in the interim restrict access to the GlobalProtect portal to trusted IP ranges or enable Threat Prevention profiles to block known exploit signatures if a Threat Prevention licence is in place. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-10846 is a vulnerability affecting an Azure-related component where DNS or network query responses are not sufficiently verified as belonging to their originating query. This type of flaw can allow an attacker to inject malicious responses, potentially leading to data interception, traffic redirection, or cache poisoning. It matters because cloud workloads relying on DNS resolution or similar request-response protocols could be silently redirected without triggering obvious alerts. ...

🟠 High | Source: Microsoft Security Response Center A heap buffer overflow vulnerability has been discovered in SQLite versions prior to 3.53.2, triggered via the Full-Text Search 5 (FTS5) extension’s fts5ChunkIterate function. An attacker able to supply crafted SQL queries could potentially exploit this to corrupt memory, leading to application crashes or arbitrary code execution. Given SQLite’s widespread use across cloud services, applications, and managed databases, the blast radius is significant. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-40034 is a command injection vulnerability in gitoxide (specifically the gix-submodule crate), triggered via a partial override of .gitmodules configuration. An attacker who can influence submodule configuration could potentially execute arbitrary commands on the host system. This is particularly relevant to CI/CD pipelines and cloud build environments that rely on Rust-based Git tooling. Security Architect’s Take: Audit any CI/CD pipelines or Azure DevOps workflows using gitoxide or the gix-submodule crate and update to the patched version immediately. Pay particular attention to builds that clone repositories with submodules from untrusted or partially trusted sources, as these represent the primary attack surface. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-5222 is a vulnerability in Cargo, the Rust package manager, where it can be tricked into sending authentication credentials intended for one registry to a different, potentially untrusted registry. This credential leakage could allow an attacker to harvest tokens used to access private package registries. The issue is particularly relevant in CI/CD pipelines and cloud build environments where registry credentials are commonly stored as secrets. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-5223 is a vulnerability in Rust’s package management ecosystem where crates hosted in third-party registries can override the cached source of legitimately installed crates. This creates a supply chain risk, as a malicious or compromised third-party registry could substitute trusted package code with altered versions. The impact is particularly significant in CI/CD pipelines and cloud build environments where dependency caching is widely used. ...