Posts

🟢 Low | Source: The Register — Security Anthropic has expanded its Glasswing partner programme fourfold, inducting 150 new organisations including the first non-US members, while UK banks have notably been excluded from the initiative. In parallel, OpenAI is offering UK financial institutions access to GPT-5.5, highlighting a competitive dynamic in AI partnerships within the regulated financial sector. The exclusion raises questions around data sovereignty, regulatory compliance, and which AI vendors UK-regulated entities can practically partner with. ...

🟢 Low | Source: The Register — Security Anthropic has expanded its Glasswing partner programme fourfold, inducting 150 new organisations including the first non-US members, while UK banks have notably been excluded. OpenAI has moved to fill the gap by offering UK financial institutions access to GPT-5.5. The development highlights growing competitive dynamics in enterprise AI access and raises questions about supply chain concentration risk for financial sector security teams. Architect’s Take: Cloud security architects in UK financial services should assess the security posture, data residency commitments, and compliance certifications of any AI provider they are offered as an alternative — do not treat OpenAI’s GPT-5.5 access as a like-for-like replacement for Anthropic without conducting due diligence on API security controls, data handling agreements, and regulatory alignment with FCA/PRA expectations. ...

🟠 High | Source: The Hacker News An unpatched vulnerability in Windows’ ‘search:’ URI handler can be exploited to leak a user’s NTLMv2 credential hash to an attacker, similar to a recently disclosed flaw in the Windows Snipping Tool (CVE-2026-33829). NTLMv2 hashes can be cracked offline or used in relay attacks to authenticate as the victim. The vulnerability remains unpatched, making it an active risk for any Windows environment, including cloud-connected hybrid setups. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability in BusyBox wget versions up to 1.3.7 allows attackers to inject arbitrary HTTP headers by embedding carriage return, line feed, or other control characters into the URL path or query string — a technique known as HTTP response splitting or header injection. This can enable request smuggling, session hijacking, or cache poisoning depending on the backend infrastructure. Any Azure or cloud workload using an affected BusyBox version to make outbound HTTP requests may be at risk. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-25541 is an integer overflow vulnerability in the Rust ‘bytes’ crate, specifically within the BytesMut::reserve function. Integer overflows in memory management libraries can lead to heap buffer overflows, potentially enabling arbitrary memory corruption or remote code execution. This is particularly significant given the widespread use of the ‘bytes’ crate across cloud-native Rust applications and frameworks such as Tokio. Architect’s Take: Audit your Rust-based services and container images for dependency on the ‘bytes’ crate and update to a patched version immediately. Pay particular attention to any Azure-hosted workloads or pipelines that process untrusted input, as memory corruption vulnerabilities of this class can be exploited to achieve code execution. ...

🟡 Medium | Source: Microsoft Security Response Center CVE-2025-29923 affects go-redis, a popular Go client library for Redis, where a timeout during the CLIENT SETINFO command at connection establishment can cause responses to be returned out of order. This race condition can result in a client receiving incorrect data, potentially leading to data corruption or unintended application behaviour. Applications using go-redis in Azure or other cloud environments that rely on connection pooling may be silently affected. ...

🟠 High | Source: Microsoft Security Response Center CVE-2024-7598 is a race condition vulnerability in Kubernetes namespace termination that can allow an attacker to bypass network restrictions within Azure-hosted clusters. During the brief window when a namespace is being deleted, network policies may not be correctly enforced, potentially permitting unauthorised traffic between pods or services. This matters because it could allow lateral movement or data exfiltration in multi-tenant or segmented environments. ...

🟠 High | Source: The Hacker News A newly discovered vulnerability dubbed ‘HTTP/2 Bomb’ allows attackers to remotely crash major web servers — including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora — without authentication. The flaw exploits default HTTP/2 configurations, meaning most deployments are vulnerable out of the box. Because it affects such a broad range of widely used infrastructure, the potential impact is significant across cloud and on-premises environments alike. ...

🟡 Medium | Source: Microsoft Security Response Center CVE-2020-8561 is a vulnerability in the Kubernetes API server (kube-apiserver) that allows an attacker to redirect webhook traffic, potentially enabling server-side request forgery (SSRF) against internal network resources. By manipulating admission webhook configurations, a malicious actor could cause the API server to make requests to arbitrary internal endpoints, bypassing network controls. This affects Azure Kubernetes Service (AKS) and any Kubernetes environment where untrusted users can modify webhook configurations. ...

🟢 Low | Source: AWS What’s New AWS IoT Core has introduced two new CloudWatch log event types: Ping logs for MQTT Keep-alive messages and Connection.AuthNError logs for failed authentication attempts. These logs help operators identify devices struggling to maintain connections and quickly diagnose certificate or credential failures across IoT fleets. This is an observability improvement rather than a security fix, but it meaningfully strengthens the ability to detect and respond to authentication anomalies. ...