How Storm-2949 turned a compromised identity into a cloud-wide breach

In this article 1. Attack chain overview 1. Cloud compromise: Microsoft Entra ID and Microsoft 365 2. Initial access and persistence through targeted social engineering and SSPR abuse 3. Directory discovery and persistence 4. Microsoft 365 discovery and exfiltration 5. Cloud compromise: Microsoft...

Infinite loop

Overview Microsoft.AspNetCore.App.Runtime.linux-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Infinite loop in the FormDataReader.ProcessFormKeys...

CVE-2026-45494

Microsoft Edge Chromium-based Spoofing Vulnerability...

CVE-2026-45492

Improper input validation in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

New Reaper Malware Uses Fake Microsoft Domain to Steal macOS Passwords

The newly discovered Reaper malware bypasses Apple's macOS Tahoe 26.4 security updates to steal passwords, crypto assets, and install a permanent backdoor...

CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

...

EUVD-2026-30785

Microsoft Edge Chromium-based Remote Code Execution Vulnerability...

CVE-2026-45495

Microsoft Edge (Chromium-based) vulnerability CVE-2026-45495 affects Edge versions prior to 148.0.3967.70. PT-2026-41712 documents an improper input validation flaw in the browser’s rendering pipeline and JavaScript engine, enabling an unauthenticated user to execute arbitrary code with the brows...

CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

...

CVE-2026-45494 Microsoft Edge (Chromium-based) Spoofing Vulnerability

...

EUVD-2026-30788

Microsoft Edge Chromium-based Spoofing Vulnerability...

CVE-2026-45494

Microsoft Edge Chromium-based Spoofing Vulnerability...

CVE-2026-45494

Technical details for CVE-2026-45494 are not publicly provided in the supplied documents. Monitor for updates from NVD and Microsoft MSRC.

CVE-2026-45494 Microsoft Edge (Chromium-based) Spoofing Vulnerability

...

CVE-2026-45492 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

...

CVE-2026-45492 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

...

EUVD-2026-30786

Improper input validation in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

Exploit for Double Free in Microsoft

No d...

EUVD-2026-30561

Microsoft APM: Symlinks under .apm/prompts/ and .apm/agents/ are dereferenced during apm install, copying host-local file contents into the project tree...

CLEANSTART-2026-GB83728 Security fixes for CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501 applied in versions: 1.14.0-r0, 1.14.0-r1, 1.14.0-r2

Multiple security vulnerabilities affect the velero-plugin-for-microsoft-azure-fips package. These issues are resolved in later releases. See references for individual vulnerability details...