Security
+3
Nov 13, 2026
•
5 min read
A root-level Gaia bug chained with PHP2Shell hit unpatched Mobile Access gateways. Here's the fix, the stopgap and the hunt.
6 min read
+2
Nov 12, 2026
4 min read
An exploited Chromium XML bug is on CISA KEV. Here's how to patch Chrome, prep Edge and make sure browsers actually restart.
Nov 11, 2026
Two chained flaws hit ESG, WAF and four more Barracuda products. Patch, lock down the Admin UI, and check your Azure NSGs.
A practitioner's mapping of Govern through Recover to Azure controls, plus how to switch on the built-in NIST CSF v2.0 standard in Defender for Cloud.
Nov 10, 2026
The Outlook NTLM leak to patch first, the server CVEs to queue next, and a Resource Graph query to prove your Azure VMs took the update
AI agents hunting leaked secrets, Functions end of support, and a free Cloud Bill Check
KEV deadlines, Azure Functions end of support, and a rollout plan that finishes before Ignite week
Nov 9, 2026
CISA added CVE-2026-123158 to KEV today. Here's who's exposed, how to check, and the one-line mitigation.
Wire an App Service to Key Vault and Blob Storage with RBAC and zero stored credentials.
Networking
Nov 8, 2026
3 min read
Hybrid ML-KEM key exchange is now the default on Front Door's TLS 1.3 edge. Here's how to verify it and when to change the policy.
Set a budget, export the activity log, assign two policies, turn on free Defender posture, and lock down RBAC before anyone deploys a resource.
Nov 7, 2026
CVE-2026-19868 lets alternate credentials skip SAML MFA — CISA KEV due Nov 20
Nov 6, 2026
Five minutes from a public GitHub secret to Key Vault exfil — hunt SP sign-ins and rotate today
AZ-500 retired August 31, 2026 — pick Cloud and AI Security Engineer or Security Operations Analyst by the job you want.
Nov 5, 2026
CVE-2026-98432 and CVE-2026-99999 hit AKS node images — Azure Linux is fixed, Ubuntu is still waiting
Nov 4, 2026
An exploited race in WordPress core opens during the update itself. Here's the safe order of operations, including on Azure App Service.
8 min read
A step-by-step look at how attackers steal post-MFA sessions, and the Conditional Access controls that break each step.
Nov 3, 2026
A CVSS 2.7 bug that hides admin activity is on CISA's KEV list. Patch ESX and vCenter, verify builds, and get logs off the host.
2 min read
Tenant spray, fake help desk calls, and a November 10 Azure Functions deadline
Tenant spray, fake help desk calls and AD CS abuse: what happened and the five fixes to make this week
Nov 2, 2026
CISA's KEV deadline has passed. Find every PHP runtime in your Azure estate, patch it, and check for webshells.
Pick the right SKU, deploy with the Azure CLI, get the NSG rules right, then prove no VM still has a public IP.
Nov 1, 2026
A CVSS 10.0 unauthenticated RCE hit CISA's KEV list with a November 1 deadline. Here's what to upgrade to, and the sibling bug you shouldn't miss.
Oct 31, 2026
CVE-2026-76418 hit CISA's KEV list with a November 1 deadline. Here's how to tell if your firewall is exposed and what to upgrade to.
