Microsoft disclosed a maximum-severity remote code execution flaw in Entra ID caused by unsafe deserialization. No patch is needed on your end, but the incident is a hard reminder to instrument identity logging before the next one isn't silently fixed for you.
A missing-authorization flaw in the on-behalf-of flow of Azure SRE Agent let low-privileged attackers inherit the agent's tenant-wide managed identity. CVSS 9.9, no customer patch required, but the incident exposes a new class of risk: autonomous agents holding broad service principal permissions.
A critical (CVSS 9.9) deserialization-of-untrusted-data flaw in Azure Service Bus let an authenticated attacker execute code over the network. Microsoft patched it server-side in the August 2026 update, but the incident is a good excuse to revisit who can actually publish to your namespaces.
A missing-authentication flaw in Azure Kubernetes Service, disclosed in Microsoft's August 2026 Patch Tuesday, lets an unauthenticated network attacker elevate privileges. CVSS 9.4. Here's what's known, why AKS control-plane CVEs are different from node CVEs, and the hardening steps that reduce blast radius regardless of patch status.
A CVSS 9.9 flaw in Red Hat Advanced Cluster Management's Application Subscription controller lets any user with namespace-scoped edit permissions deploy a malicious Helm chart that grants themselves cluster-admin — with no official patch yet available. Here's the attack chain and how to detect and contain it across AWS, Azure, and GCP-hosted clusters.
TeamPCP has compromised over 60,000 servers by chaining exposed Docker APIs, unsecured Kubernetes control planes, and the React2Shell RCE across AWS and Azure. Here's how the worm spreads and the controls that stop it.
Azure Policy is one of the most underused security controls in Azure environments. Correctly deployed at management group scope, it prevents the misconfigurations that cause cloud breaches — public storage access, unencrypted disks, open network security groups, and resources deployed without logging. This guide covers the policy effects that matter, the built-in policies worth assigning today, and how to build custom guardrails for organisation-specific requirements.
HashiCorp Vault is widely deployed as a centralised secrets management platform, but misconfigurations in token handling, auth method setup, and ACL policies create high-impact attack paths. This guide covers the principal Vault misconfigs, exploitation chains, and hardening steps.
Service principal over-permissions, Conditional Access gaps, and legacy authentication bypass remain the dominant vectors for Azure Entra ID compromise. This guide covers the five misconfigurations most commonly exploited by attackers in 2026, with Graph API queries and remediation steps.