Cloud & Identity
The Azure Cosmos DB flaw now has a name — CosmosEscape — and Wiz's writeup pins down the exposed asset: each account's primary key, granting full read and write access. Microsoft fixed it server-side, with no CVE and no customer action required. What remains is defender credential hygiene.
Vulnerabilities
Google's agent harness surfaced a sandbox-escape bug that hid in Chrome for 13 years. The scale behind it: 1,442 fixes across Chrome 149, 150 and 151 — more than the prior 23 milestones combined. For defenders, the problem is now absorbing patches as fast as AI can find them.
Vulnerabilities
Email open, half-click, mailbox held after password reset — Exchange on the wire this week.
Vulnerabilities
Three hundred seventy CVEs in one release — Chrome's AI patch cadence lands this week.
Cloud & Identity
One key, any database — the Cosmos DB exposure lands this week.
Artificial Intelligence (AI)
Hidden prompts tucked inside a Word document can be copied into the new files Microsoft Copilot for Word generates — a propagation The Register nicknames a "Word worm." A defender-focused look at the mechanism, the disclosure, and what stays unconfirmed.
Vulnerabilities
Static credentials shipped inside a firewall manager handed attackers a built-in way in. Cisco has released hot fixes for Secure Firewall Management Center, and the zero-day is already on CISA's exploited-vulnerabilities list.
Vulnerabilities
Authentication bypass, remote code execution, and a virtual-machine escape landed in one Broadcom patch bundle — vCenter operators are on the clock this week.
Vulnerabilities
From a single image upload to arbitrary file read, and possibly remote code execution — Ruby on Rails has patched the critical Active Storage flaw its finders call KindaRails2Shell, and defenders running Rails should verify their version this week.
Artificial Intelligence (AI)
Unauth commands and poisoned memory in one MCP server — RufRoot lands this week.
Artificial Intelligence (AI)
A PQC candidate down, a patch cadence outpaced — Mythos on the wire this week.
Vulnerabilities
From advisory to public PoC — Check Point SmartConsole in the spotlight this week.