Posts

🟠 High | Source: The Hacker News ACR Stealer is an infostealer that tricks users into running malicious commands via ClickFix social engineering lures, harvesting saved browser credentials, live session tokens, and Microsoft 365 documents including files synced via OneDrive and SharePoint. Once a user pastes and executes the delivered command, the malware silently exfiltrates sensitive data without requiring any elevated privileges. This is particularly dangerous in enterprise environments where browser-stored credentials and active sessions provide direct access to cloud resources. ...

🟠 High | Source: The Hacker News A newly discovered malware family called GoSerpent has been used in targeted espionage campaigns against government and diplomatic organisations in Southeast Asia since late 2025. Uncovered by Kaspersky in early 2026, the malware is designed for persistent, long-term access and intelligence collection. The campaign is consistent with nation-state or advanced threat actor activity given its targets and objectives. Security Architect’s Take: Review your organisation’s endpoint and network detection capabilities for Go-based malware, as GoSerpent is written in Go — a language increasingly favoured by threat actors to evade signature-based detection. If your cloud workloads serve or connect to Southeast Asian government entities, audit ingress/egress traffic for anomalous long-lived connections and ensure cloud-hosted applications enforce strict identity and access controls to limit lateral movement in the event of a compromise. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-59884 is a denial-of-service vulnerability in pyasn1, a Python library used to encode and decode ASN.1 data structures. An attacker can craft malicious input with unbounded long-form tag IDs to exhaust resources in the BER/CER/DER decoder, potentially crashing dependent services. This matters because pyasn1 is widely used in cryptographic and certificate-handling workflows across cloud-hosted Python applications. Security Architect’s Take: Audit your Azure-hosted Python workloads and pipelines for direct or transitive dependencies on pyasn1, then update to the patched version as soon as it is available. Pay particular attention to services that process externally supplied certificates, SNMP data, or ASN.1-encoded inputs from untrusted sources. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-60081 affects DBI::ProfileData, a Perl module used for database interface profiling, in versions prior to 1.651. The vulnerability stems from a failure to limit path index values, which could allow an attacker to access or manipulate data outside intended boundaries. While surfaced via the Microsoft Security Response Center under Azure, any environment running an unpatched version of this Perl module may be at risk. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-60082 is a vulnerability in the Perl DBI (Database Interface) module affecting versions prior to 1.651, where statement handle consistency with row data is not properly enforced. This could allow unexpected or inconsistent data to be returned from database queries, potentially leading to data integrity issues or exploitation depending on application context. Environments running Perl-based applications on Azure that rely on the DBI module for database connectivity should treat this as a priority patching item. ...

🟠 High | Source: Microsoft Security Response Center A signed integer overflow vulnerability exists in Storable versions before 3.41 for Perl, triggered when deserialising a specially crafted SX_HOOK record. An attacker able to supply malicious serialised data could potentially exploit this flaw to cause unexpected behaviour, memory corruption, or arbitrary code execution. This is relevant to Azure environments where Perl-based workloads or dependencies on the Storable module are in use. Security Architect’s Take: Audit your Azure workloads and pipelines for any Perl-based components using the Storable module and upgrade to version 3.41 or later immediately; pay particular attention to any services that deserialise untrusted or externally supplied data, as these represent the highest-risk attack surface. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-15709 is a vulnerability in libsoup, a GNOME HTTP client/server library, affecting its WebSocket permessage-deflate extension. A remote attacker can send specially crafted compressed WebSocket messages that trigger unbounded decompression, consuming excessive memory or CPU and causing a denial of service. This matters because libsoup is used across Linux-based cloud workloads and containerised environments, making internet-facing services potentially susceptible to availability attacks. Security Architect’s Take: Identify any Azure-hosted workloads or container images that ship libsoup and prioritise patching to a fixed version; additionally, consider placing WebSocket endpoints behind a WAF or API gateway configured to enforce message size limits as a compensating control until patches are applied. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-15712 is a heap buffer over-read vulnerability in libsoup3, an HTTP client/server library, triggered when parsing HTTP/2 GOAWAY frames due to an invalid null-termination assumption. An attacker could potentially exploit this to read out-of-bounds memory, leading to information disclosure or application crashes. This affects services and workloads running on Azure that rely on libsoup3 for HTTP/2 communications. Security Architect’s Take: Identify any Azure-hosted workloads or containerised applications using libsoup3 and prioritise patching to the latest fixed version; additionally, review whether HTTP/2 is strictly necessary and consider disabling it where not required to reduce the attack surface. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-15714 is an out-of-bounds read vulnerability in libsoup, a GNOME HTTP client/server library, triggered when processing an oversized multipart boundary string in the SoupMultipartInputStream component. An attacker could exploit this to read memory beyond intended boundaries, potentially leaking sensitive data or causing a crash. This affects Azure environments or workloads where libsoup is used as part of the HTTP processing stack. Security Architect’s Take: Audit any Linux-based Azure workloads, containers, or services that depend on libsoup for HTTP multipart handling, and prioritise patching to the remediated version of libsoup. Consider implementing network-level controls to restrict untrusted multipart HTTP traffic until patches are applied. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-15713 is a vulnerability in libsoup, an HTTP client/server library, where improper handling of HTTP/2 frame window management causes a memory leak that can be exploited remotely to exhaust available memory and crash the service. An attacker does not need authentication to trigger the denial of service condition. This affects Azure workloads and services that depend on libsoup for HTTP/2 communications. Security Architect’s Take: Identify any Azure-hosted Linux workloads or containerised applications using libsoup and prioritise patching to the remediated version; additionally, consider placing rate-limiting and HTTP/2 connection controls at your WAF or ingress layer to reduce exposure in the interim. ...