Posts

🟠 High | Source: The Hacker News The MemGhost attack exploits AI agents with persistent memory and email access, allowing a malicious email to silently implant false ‘facts’ into the agent’s long-term memory store. The injected memory persists across sessions, subtly manipulating future responses without any visible indication to the user. This is a novel prompt injection variant that targets the memory layer of agentic AI systems, making it particularly dangerous as it survives beyond the original conversation context. ...

🟠 High | Source: The Hacker News Forg365 is a phishing-as-a-service platform sold via Telegram for $400/month that targets Microsoft 365 accounts using device code phishing and adversary-in-the-middle techniques to steal authenticated sessions, bypassing MFA entirely. It also incorporates AI-generated lures and antibot evasion to increase success rates and avoid detection. This is significant because it industrialises sophisticated attack techniques, lowering the barrier for threat actors to compromise enterprise M365 tenants at scale. ...

🟠 High | Source: The Register — Security Attackers apparently motivated by World Cup rivalry may have gained unauthorised access to the Argentine Football Association (AFA) using credentials stolen by an infostealer malware infection approximately a year prior. This highlights how dormant credential theft can be weaponised long after the initial compromise, with stolen session tokens or passwords sitting in criminal marketplaces until a motivated buyer acts. The incident underscores the persistent, slow-burn risk posed by infostealer infections even when the initial breach goes undetected. ...

🟠 High | Source: The Register — Security Progress Software has issued an emergency directive instructing customers to shut down their on-premises ShareFile Storage Zones Controllers in response to an unspecified security threat. The company claims there is no evidence of unauthorised access, but the severity of the precaution — a full server shutdown — suggests the underlying risk is considered significant. ShareFile has previously been exploited in the wild, making this advisory particularly noteworthy for organisations running self-hosted instances. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability dubbed ‘EntryBleed’ (CVE-2022-4543) exists in the Linux kernel’s Page Table Isolation mechanism, which is designed to protect against Spectre/Meltdown-class attacks. A local attacker can exploit prefetch side-channels based on TLB timing on Intel systems to leak the kernel’s randomised memory layout (KASLR), effectively bypassing a key exploit mitigation. This significantly lowers the bar for further privilege escalation attacks on affected Linux systems. ...

🟠 High | Source: The Hacker News A threat actor running a Microsoft 365 phishing campaign using the Evilginx adversary-in-the-middle framework accidentally exposed their entire operation by leaving a Python HTTP server with directory listing enabled on a public port. French security firm Lexfo discovered the misconfiguration, recovered the attacker’s toolkit and .bash_history, and used that intelligence to pivot to two additional active phishing operations. The incident highlights how attackers make the same operational security mistakes they exploit in their targets. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-59874 is a vulnerability in node-tar, a widely used JavaScript library for handling tar archive files. A specially crafted tar entry with a negative file size value can trigger an infinite loop during archive replace operations, potentially causing a denial of service. This matters because node-tar is a common dependency in Node.js ecosystems, including tooling deployed in cloud environments and CI/CD pipelines. Security Architect’s Take: Audit your Azure-hosted workloads, container images, and build pipelines for dependencies on node-tar and update to a patched version immediately; pay particular attention to serverless functions and containerised Node.js applications that process untrusted archive inputs. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-59873 is a denial-of-service vulnerability in node-tar, a widely used Node.js library for handling tar archive files. An attacker can craft a malicious archive that causes the parser to consume unlimited resources during decompression, potentially crashing or severely degrading affected services. Because node-tar is a common dependency in cloud-hosted Node.js applications and toolchains, the blast radius across Azure-hosted workloads could be significant. Security Architect’s Take: Audit your Azure-hosted Node.js applications and CI/CD pipelines for dependencies on node-tar and update to a patched version immediately; also review any Azure Functions, Container Apps, or App Service workloads that process user-supplied archive files, as these represent the highest-risk attack surface. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-59871 is a vulnerability in node-tar, a widely used Node.js library for handling tar archives, where a type confusion bug in PAX numeric path handling can cause a process crash. This denial-of-service condition could disrupt applications or services that process tar archives, particularly those running on Azure or other cloud environments. While not directly a code execution flaw, crashing processes can be leveraged to degrade availability or mask other malicious activity. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-15308 is a denial-of-service vulnerability in Python’s incremental HTMLParser, where repeatedly feeding unterminated markup declarations causes excessive CPU consumption, potentially hanging or crashing affected services. Any Azure-hosted application or service that processes user-supplied HTML using Python’s built-in html.parser module may be exposed. An attacker able to submit crafted input could degrade or disrupt service availability without needing elevated privileges. Security Architect’s Take: Audit Azure workloads and Azure Functions that accept and parse untrusted HTML input using Python’s html.parser, and prioritise patching to a fixed Python runtime version once available. In the interim, consider enforcing input size limits and timeouts on HTML parsing operations to constrain the blast radius of any exploitation attempt. ...