Posts

🟠 High | Source: Microsoft Security Response Center A integer overflow vulnerability in Perl versions up to and including 5.43.10 can trigger an out-of-bounds heap read in the pack and unpack functions. An attacker who can influence the data or structures processed by these functions may be able to read sensitive memory contents or cause a crash. This affects any Azure-hosted workloads or services that use vulnerable Perl versions for data serialisation or processing. ...

🟠 High | Source: AWS Security Bulletins A flaw in the AWS Load Balancer Controller (CVE-2026-15738) causes incorrect priority ordering when both HTTPRoute and GRPCRoute objects share the same ALB HTTPS listener. Because the controller assigns rule priorities by route type rather than specificity, a user with permission to create HTTPRoute objects in one namespace can craft a catch-all rule that intercepts traffic destined for a more-specific GRPCRoute in a different namespace. This enables cross-namespace traffic interception in multi-tenant Kubernetes clusters using the Gateway API. ...

🟠 High | Source: AWS Security Bulletins A server-side request forgery (SSRF) vulnerability in the AWS HealthLake MCP Server allows a remote authenticated attacker to redirect pagination requests to an attacker-controlled endpoint by supplying a crafted next_token parameter. Because the server passes AWS temporary security credentials along with these redirected requests, an attacker could exfiltrate those credentials and use them to access AWS services. All versions of the package prior to 0.0.14 are affected. ...

🟠 High | Source: Krebs on Security Microsoft has released patches for a record 570 security vulnerabilities across Windows and other products — nearly triple the count from the previous record-breaking month. The company attributes the dramatic increase in discovered flaws to AI-assisted vulnerability research. The sheer volume of fixes represents a significant patching burden for security and operations teams. Security Architect’s Take: Prioritise reviewing the advisory list for vulnerabilities affecting Azure-hosted Windows workloads, Remote Desktop Services, and any internet-facing Windows infrastructure. Use Azure Update Manager or your patch orchestration tooling to triage and schedule critical and high-severity fixes immediately, and assess exposure for any unmanaged or legacy Windows endpoints within your cloud estate. ...

🟠 High | Source: The Hacker News LabubaRAT is a newly discovered remote access trojan written in Rust that disguises itself as NVIDIA software to avoid detection on Windows systems. Once installed, it establishes a persistent foothold allowing attackers to profile the host and carry out hands-on activity. Its use of a legitimate-looking software identity makes it particularly effective at evading endpoint defences. Security Architect’s Take: Enforce application allowlisting and code-signing policies to block unsigned or unexpected executables masquerading as GPU vendor software, particularly on cloud-connected Windows workloads and developer endpoints. Review EDR telemetry for Rust-compiled binaries impersonating NVIDIA processes and consider restricting outbound RAT command-and-control channels at the network perimeter. ...

🟠 High | Source: Microsoft Security Response Center A race condition vulnerability in the Windows App Store allows an attacker to gain elevated privileges over a network without authorisation. Race conditions occur when two processes access a shared resource simultaneously in an uncontrolled manner, enabling unintended behaviour to be exploited. This is particularly concerning as the attack can be performed remotely, widening the potential attack surface beyond locally authenticated users. Security Architect’s Take: Prioritise patching Windows endpoints and Azure-connected systems running the Windows App Store, particularly those exposed to network access. Review network segmentation controls to limit lateral movement opportunities if exploitation occurs prior to patching. ...

🟠 High | Source: Microsoft Security Response Center A heap-based buffer overflow vulnerability in the Windows Bluetooth Port Driver allows an attacker on the same network segment to execute arbitrary code on a target machine without any authentication. The flaw is exploitable over an adjacent network, meaning an attacker needs to be physically or logically nearby — such as on the same Wi-Fi or Bluetooth range — rather than reaching the target from the internet. This makes it particularly relevant for shared or co-located environments, including cloud-connected endpoints and hybrid worker devices. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-42982 is a privilege escalation vulnerability in Windows Secure Kernel Mode, a security-critical component that underpins Windows virtualisation-based security (VBS). An attacker who already has local access can exploit improper input validation to gain elevated privileges on the affected system. This is particularly concerning in cloud environments where shared or multi-tenant Windows infrastructure could allow a compromised account to escalate beyond its intended permissions. ...

🟠 High | Source: Microsoft Security Response Center A SQL injection vulnerability in Microsoft SQL Server allows an authenticated attacker to elevate their privileges on the local system. Although exploitation requires existing access, it could enable an attacker who has compromised a low-privileged account to gain significantly greater control. This is particularly concerning in shared or multi-tenant SQL Server environments common in Azure deployments. Security Architect’s Take: Prioritise patching SQL Server instances, especially those exposed to multiple users or running in Azure environments — apply Microsoft’s update immediately and audit SQL Server login permissions to ensure least-privilege principles are enforced. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability in ASP.NET Core contains a flaw in how authentication is implemented, allowing an already-authenticated attacker to gain higher levels of access than they should have over a network. This is a privilege escalation issue, meaning an attacker who has limited access could abuse this flaw to obtain broader control. Applications hosted on Azure or any infrastructure running affected versions of ASP.NET Core are at risk. ...