Posts

🟠 High | Source: The Hacker News Researchers have identified a working ransomware technique generated with the help of DeepSeek, an AI model, that exploits a legitimate Chromium browser API to execute entirely within the browser on both Windows and Android. This is significant because it demonstrates that frontier AI models can be used to construct novel, previously theoretical attack paths and turn them into functional malware. The browser-based execution model means traditional endpoint ransomware defences may not detect or block it. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability in GnuPG’s gpgsm tool (versions through 2.5.20) allows a 4-byte AES-GCM integrity check value (ICV) to be accepted where 12 bytes is required by the CMS standard. This weakens authenticated encryption, potentially allowing tampered or forged encrypted messages to be processed without detection. The issue is related to a prior vulnerability, CVE-2026-34182, suggesting a pattern of weaknesses in GnuPG’s CMS parsing logic. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-7532 is a vulnerability in the wolfSSL cryptographic library where IP address-based name constraints in X.509 certificates are not enforced when the WOLFSSL_IP_ALT_NAME compile-time flag is undefined. This means an attacker could potentially use a certificate issued under a constrained CA to authenticate as an IP address that should have been prohibited, bypassing intended access restrictions. The issue affects any workload — including Azure-hosted services — that relies on wolfSSL for TLS certificate validation with IP-based name constraints. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-6291 is a Bleichenbacher padding oracle vulnerability affecting RSA PKCS#1 v1.5 decryption within PKCS#7 Key Transport Recipient Info (KTRI) handling in Microsoft Azure. This class of attack allows an attacker to progressively decrypt RSA-encrypted data by analysing error responses, potentially exposing sensitive cryptographic material. It is a well-understood but serious cryptographic vulnerability that can undermine the confidentiality of encrypted communications if exploited. Security Architect’s Take: Audit any Azure services or workloads relying on RSA PKCS#1 v1.5 encryption for key transport and prioritise migrating to OAEP (RSA-OAEP) padding, which is not susceptible to Bleichenbacher attacks. Apply Microsoft’s patch immediately and review whether any key material exchanged via affected KTRI mechanisms should be considered compromised. ...

🟠 High | Source: Microsoft Security Response Center A integer underflow vulnerability (CVE-2026-57918) has been identified in libnfs, a client-side NFS library, affecting versions up to and including 6.0.2. The flaw occurs when connecting to a maliciously crafted NFS server, where a mismatch between expected and actual PDU sizes can trigger memory corruption. This matters because libnfs is widely used in cloud and virtualisation environments, and exploitation could allow a rogue NFS server to compromise connecting clients. ...

🟠 High | Source: Microsoft Security Response Center A vulnerability in KubeVirt (CVE-2026-13325) means that enabling the ‘disableTLS’ migration setting removes authentication controls entirely, leaving the virtqemud proxy exposed without authentication on all network interfaces. This could allow an attacker with network access to interact with the virtual machine management proxy directly, potentially compromising running workloads. The issue affects the RHEL9 virt-handler component and is published via Microsoft’s security advisory channel, indicating relevance to Azure environments running KubeVirt-based workloads. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-13218 is a symlink-following vulnerability in KubeVirt’s virt-launcher component that allows a malicious or compromised virtual machine workload to overwrite arbitrary files on the underlying host via the writeToCache function. This represents a container/VM escape-class issue, where isolation boundaries between virtualised workloads and the host node can be broken. The impact is significant in multi-tenant Kubernetes environments where KubeVirt is used to run VMs alongside containerised workloads. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-13208 is a vulnerability in KubeVirt’s virt-handler component, where the notify server accepts virtual machine instance (VMI) identity claims from unauthenticated gRPC request bodies without verification. This means an attacker could impersonate a VMI and potentially manipulate or interfere with virtual machine lifecycle operations. The flaw is particularly significant in environments running containerised virtual machines on Kubernetes, including Azure-hosted clusters. Security Architect’s Take: Audit any AKS or Azure Red Hat OpenShift clusters running KubeVirt and apply available patches to the virt-handler component immediately. In the interim, restrict network access to the virt-handler gRPC notify server using network policies to limit exposure to trusted workloads only. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-13322 is a denial-of-service vulnerability in KubeVirt’s virt-handler component, where an unbounded readline operation on a virtio-serial channel can consume excessive memory, causing the process to crash due to out-of-memory (OOM) conditions. This affects Kubernetes environments running KubeVirt for virtual machine workloads, including Azure deployments. An attacker or a misbehaving guest VM could exploit this to disrupt the virt-handler, potentially taking down VM management on an affected node. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-58014 is an off-by-one memory error in GLib, a widely used open-source utility library, specifically within the function that reads locale-specific string lists from configuration files. This class of vulnerability can potentially allow an attacker to read or corrupt adjacent memory, leading to information disclosure or application crashes. Because GLib is a foundational dependency in many Linux-based environments — including Azure-hosted workloads and container images — the blast radius could be broad if exploited. ...