Posts

🟠 High | Source: Microsoft Security Response Center CVE-2026-40400 is a remote code execution vulnerability in Windows PowerShell, meaning an attacker could potentially run arbitrary commands on an affected system without physical access. Although categorised under Azure advisories, this vulnerability affects Windows environments broadly, including cloud-hosted virtual machines and hybrid infrastructure relying on PowerShell for management. The acknowledgement update suggests the advisory details are still evolving, so organisations should monitor for patch availability. ...

🟠 High | Source: The Register — Security A US defence supplier, IEH Corp, suffered a data breach after an employee fell victim to a phishing attack that gave the attacker access to the company’s Microsoft 365 environment. The intruder was able to access engineering files and potentially export-controlled technical data, which may carry serious legal and national security implications. This incident highlights the ongoing risk of phishing as an initial access vector into cloud productivity platforms holding sensitive data. ...

🟠 High | Source: The Hacker News An 18-year-old use-after-free vulnerability in the Linux kernel’s SCTP networking code allows a local user to escalate privileges to root. Tencent researchers demonstrated that the flaw can also be used to break out of a container and compromise the underlying host. Patched kernels were released on 3 August 2026; any system running an older kernel with SCTP accessible is at risk. Security Architect’s Take: Prioritise kernel updates to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 across all Linux-based workloads, paying particular attention to container hosts and Kubernetes nodes where container-escape risk is highest. If immediate patching is not possible, disable or restrict access to SCTP via kernel module blocklisting or network policy as a temporary mitigation. ...

🟠 High | Source: The Hacker News Researcher Malcolm Stagg has disclosed NatJack, a new class of network attack that manipulates NAT (Network Address Translation) state tables to hijack live TCP connections, forge DNS responses, and exhaust NAT resources. The technique affects multiple independently developed NAT implementations, including Windows, making it broadly applicable. Presented at Black Hat USA 2026, the research highlights a fundamental weakness in how NAT devices track connection state. ...

🟠 High | Source: The Hacker News Attackers are running a large-scale phishing campaign that uses adversary-in-the-middle (AitM) techniques to bypass multi-factor authentication and hijack Microsoft 365 accounts. Once inside, they specifically target staff involved in payroll and finance workflows to harvest sensitive emails and likely enable further fraud. Residential proxies are used to make the malicious logins appear as normal consumer traffic, helping evade detection. Security Architect’s Take: Enforce phishing-resistant MFA (FIDO2/passkeys) across all Microsoft 365 accounts, particularly for finance and HR personas, and deploy Conditional Access policies that flag or block sign-ins from residential proxy ranges and unexpected locations. Review Entra ID sign-in logs for token replay indicators and anomalous session activity, and consider enabling Microsoft Defender for Office 365’s URL detonation and session anomaly alerts. ...

🟠 High | Source: The Hacker News PortSwigger’s AI-assisted research tool, HTTP Terminator, has discovered novel HTTP request smuggling (desync) techniques by evaluating 30,000 candidate attack vectors across 30,000 websites. A separate human-guided investigation also uncovered a zero-day vulnerability in Apache Traffic Server. HTTP desync vulnerabilities can allow attackers to bypass security controls, poison caches, hijack requests, or access internal systems behind shared proxies and load balancers. Security Architect’s Take: Review your stack for any use of Apache Traffic Server and apply patches as soon as they are released. Audit your HTTP pipeline for shared proxy or load balancer configurations that may be susceptible to request smuggling — tools such as PortSwigger’s HTTP Request Smuggler can assist with detection in pre-production environments. ...

🟠 High | Source: The Hacker News Security researcher Dirk-jan Mollema has shown that malware running in an active Windows session can silently hijack a user’s Windows Hello for Business key to authenticate to Microsoft Entra ID without any user interaction. From there, an attacker can register a rogue device, obtain a Primary Refresh Token (PRT), and add their own authentication methods — effectively establishing persistent cloud access. This is significant because it turns endpoint compromise into a durable cloud identity takeover, bypassing typical MFA assumptions. ...

🟠 High | Source: The Hacker News Security researchers at Novee Security demonstrated that simply opening a GitHub issue — without any repository access — was enough to trigger code execution on CI runners used by Anthropic’s Claude Code and Google’s Gemini CLI projects, exposing secrets held in those pipelines. OpenAI’s coding agent was similarly vulnerable, with the same technique able to hijack subsequent agent runs. The attacks exploited prompt injection flaws in AI coding agents operating in default, vendor-shipped configurations, meaning the risk applies broadly to any team adopting these tools as-shipped. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability in rbash (restricted Bash shell) prior to version 4.4-beta2 allowed users to modify the BASH_CMDS array, effectively bypassing shell restrictions and executing arbitrary commands with the shell’s permissions. This matters because rbash is commonly used to confine users to a limited set of commands, and this flaw completely undermines that security boundary. Exploitation requires local shell access but can lead to full restriction bypass. ...

🟠 High | Source: Microsoft Security Response Center CVE-2019-6706 is a use-after-free vulnerability in Lua 5.3.5, specifically within the lua_upvaluejoin function in lapi.c. An attacker who can trigger a debug.upvaluejoin call with specially crafted arguments may cause a crash or potentially achieve code execution. Microsoft has published this advisory in relation to Azure, indicating Lua is a dependency within an affected Azure component. Security Architect’s Take: Identify any Azure services or workloads in your environment that embed Lua 5.3.5 and ensure they are patched to a remediated version. Pay particular attention to services that expose Lua scripting interfaces to untrusted users, such as Redis instances or custom runtimes, as these present the highest exploitation risk. ...