95 articles
MicrosoftMicrosoft patches maximum-severity CVSS 10.0 flaw CVE-2026-85889 in Azure AI Foundry enabling unauthenticated remote network privilege escalation.
GoogleTechnical analysis of Google Cloud Platform guest-oslogin flaw CVE-2020-8903 enabling non-administrative users to escalate privileges to root.
MicrosoftTechnical analysis of Azure Cloud Provider Interface vulnerability CVE-2017-4964 enabling arbitrary code injection into virtual machines during deployment.
Data BreachIndia initiates DPDP Act Phase 2 enforcement establishing Data Protection Board inquiries, mandatory breach disclosures, and penalties up to ₹250 Crore.
Agentic AIOpenAI releases o1 red-teaming telemetry detailing chain-of-thought safety boundaries, autonomous cyber task planning risks, and the formation of the AI-ISAC.
MicrosoftTechnical breakdown of cloud workload stemcell isolation defects, container escape vectors, and hypervisor boundary hardening across AWS and Microsoft Azure.
MicrosoftDigital forensics analysis dissects how threat actors leverage leaked cloud credentials and cross-account IAM role assumptions to exfiltrate enterprise storage.
GoogleTechnical analysis of Google Cloud Platform (GCP) Kubernetes Workload Identity metadata impersonation vectors, token theft forensics, and enterprise IAM hardening.
Deep DiveThe Reserve Bank of India mandates accelerated 6-hour incident reporting, continuous board-level oversight, and strict third-party cloud outsourcing audits.
Data BreachThe Data Protection Board of India establishes mandatory breach disclosure workflows, Significant Data Fiduciary obligations, and statutory ₹250 Crore penalties.
Deep DiveThe EU CRA’s early reporting mandate is now in effect, requiring manufacturers to report actively exploited vulnerabilities to ENISA and CSIRTs within 24 hours.
Deep DiveRBI’s draft KYC amendment proposes a time-bound process for temporary debit holds on suspected money-mule accounts linked to cyber-enabled fraud.
Agentic AIOpenAI says Daybreak combines models, Codex Security and human oversight into a governed loop for inventory, validation, remediation and proof.
Gov / DefenseCISA's Binding Operational Directive 26-04 drops CVSS from federal patch prioritisation, replacing it with four yes/no questions and a sixteen-row deadline table.
MicrosoftMicrosoft retires SMS and voice MFA on 1 February 2027 with a blocking passkey prompt and no opt-out. Here is a dated plan for service accounts, break-glass and phoneless users.
Deep DiveWiz Research discovered that 10% of internet-facing LiteLLM AI proxy gateways accepted the default documentation admin key sk-1234, leaking upstream model keys and cloud IAM tokens.
MicrosoftSharePoint Server 2016 and 2019 lost support on 14 July 2026 with no paid ESU on offer. Exchange 2016/2019 has until 31 October. Here is how to contain both.
Agentic AIPrompt injection is now OWASP’s top LLM risk with reported success rates of 50–84%. Organisations are shipping agents into production well ahead of their controls.
Deep DiveRegulation (EU) 2026/1744 pushed Annex III high-risk obligations to December 2027, but Article 12 logging, Article 14 oversight and Article 15 hardening are engineering work you cannot start late.
Agentic AIGravitee says 88% of organisations had a confirmed or suspected AI agent incident, while 82% of executives trust their policy. Both figures, one population.
Deep DiveThe European Commission’s cybersecurity package proposes amendments to NIS2 and a revised Cybersecurity Act. Here is what compliance teams need to track.
Deep DiveWith 99% of SaaS compromises originating at the identity provider, MFA is no longer the control organisations think they bought. Here is what changed.
Deep DivePublic companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.