The brief

Friday, October 9, 2026

Microsoft shipped critical auth and code-execution bugs in Partner Center, Dataverse, Azure App Service, and Bookings; IBM Guardium has path-traversal RCE, and FalkorDB has an auth bypass. Shai-Hulud is now hitting AI infrastructure via a poisoned Tensorlake SDK, while UAC-0099 is hardening MatchBoil for stealth and persistence.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
'AgentCorruption' Puts AWS Environments At Risk With Single Prompt
CVE-2026-107910: CVE-2026-107910 Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling (CVSS 9.2)
CVE-2026-96207: Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a... (CVSS 10)
CVE-2026-88131: Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. (CVSS 9.8)
CVE-2026-94510: Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privil... (CVSS 9.9)
CVE-2026-77900: Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a... (CVSS 9.8)
CVE-2026-69435: Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. (CVSS 9.6)
CVE-2026-107726: Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1... (CVSS 9.3)
CVE-2026-107722: fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-... (CVSS 9.8)
CVE-2026-75875: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path tr... (CVSS 9.8)

Worth a listen

← All editions