Posts

🟠 High | Source: Microsoft Security Response Center CVE-2026-14355 is a memory corruption vulnerability in PHP’s OpenSSL extension, specifically triggered when using the AES-WRAP-PAD encryption mode via the openssl_encrypt function. Memory corruption flaws of this type can potentially allow attackers to crash affected services or, in more severe cases, execute arbitrary code. This is particularly relevant to Azure-hosted PHP workloads where untrusted input may influence encryption operations. Security Architect’s Take: Audit any Azure-hosted PHP applications using openssl_encrypt with AES-WRAP-PAD and prioritise patching to a fixed PHP release; consider applying Web Application Firewall rules to restrict untrusted input reaching cryptographic functions until a patch is deployed. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-8925 is a double-free memory corruption vulnerability in the SASL (Simple Authentication and Security Layer) component, reported via the Microsoft Security Response Center under the Azure advisory track. Double-free flaws occur when a programme attempts to release the same memory allocation twice, which can allow an attacker to corrupt heap memory and potentially execute arbitrary code. If exploitable remotely or within shared cloud infrastructure, this class of vulnerability can have serious consequences for service integrity and data confidentiality. ...

🟠 High | Source: The Hacker News Microsoft has patched CVE-2026-50656, a privilege escalation vulnerability in the Microsoft Malware Protection Engine (mpengine.dll), which underpins Defender antivirus products. Dubbed RoguePlanet, the flaw carries a CVSS score of 7.8 and could allow an attacker to gain SYSTEM-level privileges on affected machines. The patch arrives nearly a month after the vulnerability was publicly disclosed, meaning unpatched systems have been exposed for a significant window. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-11856 is a cross-origin information disclosure vulnerability involving Digest authentication state leakage in an Azure-related component. It allows a malicious or compromised origin to observe or infer authentication state from another origin, potentially exposing credentials or session context without user awareness. This matters because cross-origin auth leaks can be leveraged to facilitate credential theft or session hijacking in multi-tenant or shared cloud environments. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-9547 is a vulnerability in an Azure-related SSH implementation where host validation is performed improperly, potentially allowing an attacker to intercept or manipulate SSH connections via a man-in-the-middle attack. This matters because SSH is widely used for secure administrative access to cloud infrastructure, and bypassing host validation undermines the trust model that protects those connections. Security Architect’s Take: Audit your Azure environments for any services or pipelines relying on SSH connections and ensure host key verification is enforced and not suppressed — review SSH client configurations, automation scripts, and CI/CD tooling for StrictHostKeyChecking=no or equivalent overrides. Apply any available patches or mitigations from Microsoft promptly and consider restricting SSH access to known, trusted networks via NSGs or Azure Bastion. ...

🟠 High | Source: Microsoft Security Response Center CVE-2025-61727 is a flaw in Go’s crypto/x509 package where excluded DNS name constraints are not correctly applied when validating wildcard certificate names. This means a TLS certificate that should be rejected due to name constraint violations may instead be accepted, potentially allowing an attacker to impersonate restricted domains. Services or applications built with affected versions of Go that rely on certificate validation for trust decisions are exposed to man-in-the-middle risks. ...

🟠 High | Source: Microsoft Security Response Center CVE-2025-58188 is a vulnerability in Go’s crypto/x509 package that causes a panic (crash) when parsing or validating certificates containing DSA public keys. This can result in a denial-of-service condition in any application or service that processes untrusted certificates using Go’s standard library. Services running on Azure or elsewhere that handle TLS certificate validation or PKI operations in Go may be affected. Security Architect’s Take: Audit your Azure workloads and container images for Go-based services that perform certificate validation — particularly any that accept externally supplied certificates. Prioritise updating affected Go runtimes to the patched version and review any API gateways, service meshes, or certificate management tooling built on Go. ...

🟠 High | Source: Microsoft Security Response Center CVE-2025-61724 is a vulnerability in Go’s standard library, specifically in the net/textproto package, where the Reader.ReadResponse function can be exploited to cause excessive CPU consumption. This is a denial-of-service class vulnerability that could allow an attacker to degrade or exhaust service availability in applications built with affected versions of Go. Microsoft has flagged this as relevant to Azure services or components that rely on Go-based workloads. ...

🟠 High | Source: The Hacker News Researchers at the AI Now Institute have demonstrated a ‘Friendly Fire’ attack in which malicious code embedded in open-source repositories can trick AI coding agents — specifically Anthropic’s Claude Code and OpenAI’s Codex in autonomous mode — into executing that code on the analyst’s own machine. The attack exploits the agents’ self-approval behaviour when running without human oversight, turning a security scanning tool into an unwitting attack vector. This matters because the very tools used to find vulnerabilities can be weaponised to introduce or execute them. ...

🟠 High | Source: The Hacker News A class of symlink vulnerabilities dubbed GhostApproval, discovered by Wiz, affects six major AI coding assistants including Amazon Q Developer, Claude Code, Cursor, and others. When a malicious code repository tricks the agent into writing to a symlinked file, the actual write is redirected to a sensitive system file — despite the developer only approving what appeared to be a harmless operation. This effectively allows an untrusted repository to execute arbitrary actions on a developer’s machine under the guise of legitimate AI assistance. ...