Cloud & Enterprise
Cloud and enterprise IT covers identity, access, SaaS, hybrid infrastructure and corporate attack surfaces. The analysis helps readers follow risks, incidents and architectural decisions relevant to complex environments.
PAYLOAD: A Malicious GPO Replaces Ransomware on Windows
The PAYLOAD group used an Active Directory Group Policy Object to distribute ransom notes and alter wallpapers across all workstations…
RansomHouse Hits Namibia's Defence Ministry: The September 19 Case
Nam-CSIRT has confirmed the RansomHouse ransomware attack on Namibia's Ministry of Defence and Veterans Affairs. The leak-site listing…
Microsoft Fixes CVSS 10.0 Bug in Azure AI Foundry With Zero Customer Action
CVE-2026-85889 earned the maximum CVSS 10.0 score for a missing authentication flaw in Azure AI Foundry. Microsoft mitigated the issue…
Check Point Patches Fifth Critical Management-Plane Flaw in Three Months
CVE-2026-91843 is a pre-authentication stack overflow in Check Point login that yields root RCE. It marks the fifth zero-login vulnera…
S4GET: The Pre-Auth SAP S/4HANA Kernel Flaw with a 9.8 CVSS
On September 8, 2026, SAP patched CVE-2026-58240, a pre-authentication vulnerability in the Message Server that enables unauthenticate…
City Relay Hit by Double Metabase Breach Exposing Financial Data and Lockbox Codes
London property manager City Relay disclosed two separate compromises of its Metabase Cloud instance, potentially exposing bank detail…
NoMachine: SSRF on UDP 4443 Exposes Enterprise Servers Without Authentication
ZDI advisory ZDI-26-712 (CVE-2026-92210) reveals an unauthenticated SSRF vulnerability in NoMachine's nxhtd service. The flaw stems fr…
NoMachine Redis: Insufficient Entropy Opens Local Privilege Escalation
ZDI-26-711 reveals a flaw in NoMachine's Redis authentication mechanism. Patched versions 10.1.7, 9.9.6, and 8.27.1 resolve the LPE ri…
Microsoft Leaves Windows Zero-Day Unpatched: NTLM Credential Theft Without a Fix
ZDI disclosed ZDI-26-708, a zero-day vulnerability in Windows that exposes machine-account NTLM credentials. Microsoft initially slate…
Acronis Patches CVE-2026-87886: In-the-Wild Exploit in cPanel Plugin
Acronis has released urgent patches for CVE-2026-87886, a local privilege escalation vulnerability with a CVSS 7.8 score that is alrea…
Google Workspace Attacks Now Start With OAuth, Not Email
The Google Workspace attack chain has shifted from email-first to OAuth-first. Stolen OAuth tokens survive password resets, never expi…
CVE-2026-46300 Fragnesia: Linux Kernel Bug Exposed on GKE Since May
Fragnesia exploits a flaw in skb_try_coalesce() to corrupt the page cache and gain root. Disclosed May 13, with public PoC and patch i…