Posts

🟠 High | Source: The Hacker News N-day vulnerabilities — flaws with available patches but unpatched deployments — are being weaponised faster than ever, sometimes within hours of a patch being released. Attackers reverse-engineer the fix to reconstruct a working exploit, then target organisations that haven’t yet deployed the update. This article argues that faster patching alone is insufficient and that complementary controls are essential. Security Architect’s Take: Prioritise virtual patching and network-layer controls (WAF rules, IDS signatures) that can be deployed in minutes, not days, to reduce exposure during the window between patch release and production deployment. Pair this with continuous asset inventory and automated vulnerability correlation so you know exactly which workloads are exposed the moment a patch drops. ...

🟠 High | Source: The Hacker News Bit2Watt is a newly disclosed attack technique that allows a cloud tenant with standard GPU access to rapidly fluctuate a data centre’s power consumption, potentially destabilising the electrical grid it relies on — no exploit or privileged access required. Researchers from Zhejiang University demonstrated this by deliberately crafting GPU workloads that cause large, rapid swings in power draw. The significance is that it crosses the boundary between cyber and physical infrastructure risk, threatening grid stability as a side effect of legitimate-looking cloud usage. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-63796 is a vulnerability in ocfs2, the Oracle Cluster File System, related to the improper handling of oversized group bitmap descriptors. If exploited, this flaw could allow an attacker to trigger unexpected behaviour within the kernel file system layer, potentially leading to system instability or privilege escalation. It has been flagged by Microsoft as relevant to Azure infrastructure. Security Architect’s Take: Ensure Azure Linux-based virtual machines and any workloads using shared cluster file systems are patched promptly once Microsoft releases the relevant update. Review whether ocfs2 is in active use across your Azure IaaS estate and prioritise patching for any multi-node clustered storage configurations. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-3842 is a vulnerability in QEMU-KVM’s Hyper-V synthetic debugger (SynDbg) implementation where a missing length validation after a physical memory mapping call can lead to an out-of-bounds write on the host system. This type of flaw in hypervisor emulation code is particularly serious because it potentially allows a malicious guest virtual machine to corrupt host memory. If exploited, an attacker with control of a guest VM could compromise the underlying host, affecting all co-resident workloads. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-63801 is a memory safety vulnerability in the Linux kernel’s TIPC (Transparent Inter-Process Communication) networking subsystem, specifically a slab-use-after-free bug in the TIPC AEAD decryption path. This class of vulnerability can potentially be exploited to corrupt kernel memory, leading to privilege escalation or system crashes. It is relevant to Azure workloads running Linux-based virtual machines or containerised environments where the TIPC module is active. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-64017 is a Linux kernel vulnerability in the blk-mq (block multi-queue) subsystem, affecting how cached I/O requests are handled. Microsoft has published an advisory via the MSRC, indicating it affects Azure infrastructure or Azure-hosted Linux workloads. Depending on exploitability, this type of kernel-level flaw can potentially be leveraged for privilege escalation or denial of service within affected environments. Security Architect’s Take: Review whether your Azure Linux VMs or AKS node pools are running kernel versions affected by this blk-mq flaw, and apply any available OS or platform patches promptly. Monitor Microsoft’s MSRC advisory page for updated severity scores and patch guidance as details emerge. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-63879 is a vulnerability in the Linux kernel’s DRM/AMDGPU driver, specifically within the amdgpu_hmm_range_get_pages function, which handles GPU memory management. Microsoft has published this advisory in the context of Azure, likely affecting Linux virtual machines running AMD GPU workloads. If exploited, this type of kernel-level flaw can potentially allow an attacker to cause memory corruption, a system crash, or privilege escalation within an affected VM. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-64077 is a Linux kernel vulnerability affecting the netfilter ebtables subsystem, which handles network packet filtering at the Ethernet bridge layer. The fix introduces a two-stage removal scheme to address a likely use-after-free or race condition during rule cleanup. This is relevant to Azure because many Azure Linux-based virtual machines and container workloads rely on the kernel’s netfilter subsystem for network security enforcement. ...

🟠 High | Source: The Hacker News A threat actor tracked as JADEPUFFER has exploited a remote code execution vulnerability in Langflow, an open-source AI workflow platform, to deploy ENCFORGE — a new Go-based ransomware specifically designed to encrypt AI infrastructure assets such as model weights, vector indexes, and training datasets. This marks a notable evolution in ransomware targeting, moving beyond traditional data and business systems to attack AI pipeline components directly. The incident signals that AI development infrastructure is increasingly being treated as high-value by ransomware operators. ...

🟠 High | Source: The Register — Security Researchers have identified a threat scenario in which malicious cloud tenants could deliberately design workloads to maximise power consumption, potentially destabilising the electrical grid infrastructure that serves data centres. Because data centres already place significant and variable demand on power utilities, adversarially crafted compute workloads could amplify this effect to cause localised or regional power disruption. This represents an emerging cross-domain risk at the intersection of cloud computing, physical infrastructure, and critical national infrastructure security. ...