CVE-2026-46598 is a vulnerability in the Go standard library package golang.org/x/crypto/ssh/agent, where supplying malformed or pathological inputs can cause a client application to panic and crash. This affects any service or tooling built with this SSH agent library, including Azure-hosted workloads that rely on Go-based SSH clients. The practical risk is denial of service, where an attacker able to send crafted SSH agent messages can bring down affected processes.

Architect’s Take: Audit your Azure workloads and internal tooling for any Go applications using golang.org/x/crypto/ssh/agent and update the dependency to a patched version immediately; pay particular attention to internet-facing SSH automation, CI/CD pipelines, and bastion host tooling where untrusted input could reach the SSH agent.

Original advisory: CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

CVE-2026-39828 is a vulnerability in the golang.org/x/crypto/ssh package that allows an attacker to bypass certificate-based restrictions in SSH connections. This could permit unauthorised access to systems that rely on SSH certificate validation as a security control. Services and applications built on Go that use this library for SSH communication — including Azure-hosted workloads — may be affected.

Architect’s Take: Audit any Go-based services deployed in your Azure environment that use golang.org/x/crypto/ssh for SSH connectivity, and update to the patched version of the library as soon as it is available. Pay particular attention to internal tooling, CI/CD pipelines, and infrastructure automation that may authenticate via SSH certificates.

Original advisory: CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Researchers are applying machine learning techniques to crack historical hand-written ciphers used in medieval correspondence, including diplomatic and personal communications. While academically fascinating, this work demonstrates that AI can systematically analyse and break pattern-based encryption schemes that were previously considered too obscure to decode at scale. It highlights the broader capability of AI to accelerate cryptanalysis against weak or legacy cipher designs.

Architect’s Take: No immediate action is required, but this research serves as a timely reminder to audit any legacy or proprietary encryption schemes in your environment — AI-assisted cryptanalysis lowers the bar for breaking non-standard ciphers. Ensure all sensitive data at rest and in transit is protected by modern, well-vetted standards such as AES-256 and TLS 1.3, and avoid reliance on security through obscurity.

Original advisory: AI Used to Decrypt Medieval Ciphers

Researchers are applying machine learning techniques to decode historical hand-written ciphers used in medieval correspondence, including diplomatic and personal communications. Whilst not a direct cybersecurity threat, it demonstrates AI’s growing capability to break encryption schemes that were previously considered uncrackable. This has broader implications for understanding how AI might be applied to attack legacy or weak cryptographic implementations.

Architect’s Take: No immediate action required, but treat this as a signal to audit any legacy or non-standard encryption schemes in your environment — if AI can crack medieval ciphers, weak or deprecated algorithms (e.g. DES, MD5, RC4) are increasingly at risk. Ensure your cryptographic inventory is up to date and aligned with current NCSC guidance.

Original advisory: AI Used to Decrypt Medieval Ciphers