Patches, Active Exploits, and Cloud Platform Updates

A busy cycle brought urgent patches and active exploitation alongside cloud platform rollouts. Microsoft addressed a maximum-severity flaw in Azure AI Foundry, WordPress fixed a core click-through install issue, and Check Point shipped a critical fix for remote code execution. CISA added three Linux kernel bugs to KEV as a researcher released working exploits for four other kernel issues. Meanwhile, law enforcement and researchers detailed campaigns against job seekers and Microsoft 365 device-code abuse, and vendors expanded private networking, messaging, analytics, and AI model options.

Patch Priorities and Kernel Risk

Microsoft issued emergency fixes for a critical authentication bypass in Azure AI Foundry, tracked as CVE-2026-85889 (CVSS 10.0). According to Microsoft patches, the company fully mitigated the cloud-based issue without customer action and also addressed other severe Azure flaws (including CVE-2026-85885 in Microsoft 365 Copilot and CVE-2026-85878 in Azure Database for PostgreSQL), plus out-of-band Windows updates for local privilege escalation. Microsoft reported no evidence of active exploitation for CVE-2026-85889 but urged vigilance against chained attacks.

WordPress core updates remediate a high-severity issue dubbed Click2Shell that could cause a theme to be installed when a logged-in administrator opens a crafted link. The update, described in WordPress Click2Shell, blocks attacker-controlled link sequences that previously triggered an install action within the admin’s authenticated session. While the forced install alone does not execute code, researchers showed a full chain by combining it with a vulnerable theme to achieve RCE. WordPress released 7.1.1 and matching branch updates; administrators should patch promptly.

Check Point warned of CVE-2026-91843, a critical stack-based buffer overflow in Security Management Server and Log Server enabling unauthenticated remote code execution as root. The company provided a LivePatch and mitigations, advising administrators to restrict access and monitor for specific failed login indicators noted in Check Point flaw. All Security Management Server deployments are vulnerable regardless of configuration; there is no confirmation of in-the-wild exploitation at this time.

CISA added three Linux kernel bugs to its Known Exploited Vulnerabilities catalog after signs of active abuse: CVE-2025-39682 (TLS receive path), CVE-2026-53266 (ebtables SNAT ARP rewrite), and CVE-2025-39964 (AF_ALG race). The update, summarized in CISA KEV, urges rapid patching—Federal agencies face near-term deadlines under BOD 26-04. Red Hat advisories were updated, and organizations are encouraged to patch, review local access controls, and monitor for potential kernel exploitation.

Separately, a researcher published write-ups and working exploits for four Linux kernel memory-safety issues—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—after coordinated disclosure and fixes in stable branches (e.g., 5.10.270, 5.15.221, 6.1.188). As detailed in public exploits, most require unprivileged user namespaces, while DiagSpill can be triggered if SCTP is present. Updating to patched kernels is recommended; where that is not possible, disabling unprivileged namespaces and unused features reduces exposure.

Active Exploitation and Breach Activity

Security teams reported active exploitation of a pre-auth remote code execution flaw in Orkes Conductor, CVE-2026-58138. The issue, remediated in version 3.30.2, stems from unsandboxed GraalVM evaluators. Telemetry cited in Orkes Conductor RCE shows thousands of blocked attempts in early September; impacted releases span 3.21.21 to 3.30.1. Where immediate patching is not possible, restrict access to workflow APIs, apply strict network controls, and monitor for suspicious workflow submissions and unexpected command execution.

A multinational advisory attributed a wide campaign to the North Korean-linked WaterPlum group, with at least 30,000 devices compromised in over 100 countries and 1.7 billion JPY in cryptocurrency transferred to the DPRK. As reported in WaterPlum campaign, lures included fake interview workflows and projects for AI, cryptocurrency, and NFT firms, delivering multiple malware families to harvest credentials, keystrokes, crypto keys, and documents, and to pivot into employer or client networks. Recommendations emphasize identity verification, least privilege, sandboxing unknown code, and close inspection of supplied files.

Helpfeel’s Gyazo disclosed a significant breach after a server vulnerability enabled database access and exfiltration of approximately 23.62 million user records. According to Gyazo breach, exposed data varies by user and may include email addresses, password hashes, session IDs, third-party tokens, and more. About 490 million image metadata records—mostly from before January 2019—were also accessed, and some private content may have been viewed. Users should change passwords, monitor for suspicious activity, and watch for phishing.

Research introduced BragJack, a class of attacks where a malicious installed browser extension can hijack AI assistants in Chromium-based browsers by abusing declarativeNetRequest rules. The findings in BragJack attacks showed control over features like file access and screenshots and prompted fixes from multiple browser vendors. Users should update browsers, remove untrusted extensions, and scrutinize wide-ranging permissions.

Separately, a phishing kit named GhostCode abuses Microsoft’s OAuth 2.0 device authorization grant flow to seize Microsoft 365 accounts. As analyzed in GhostCode device-code, attackers trick victims into entering attacker-generated device codes, then rapidly register devices, enroll Intune, and obtain Primary Refresh Tokens for persistent access. Mitigations include restricting or disabling the device-code flow where not needed, monitoring for unusual device registrations, and correlating device-code authentications with automated API use.

Cloud Platforms: Access, Messaging, Compute, and Analytics

AWS introduced a new VPC tunnel endpoint for PrivateLink to privately access network segments across VPC and account boundaries by sharing a CIDR as a Resource Configuration via AWS RAM. The update, outlined in PrivateLink endpoints, uses GENEVE encapsulation and aims to simplify multi-tenant and vendor access patterns. Pricing includes hourly endpoint charges and per-GB processing; adopters should review routing, IAM, and segmentation policies.

Amazon SNS now supports message payloads up to 1 MiB—up from 256 KiB—configurable via the MaximumMessageSize attribute on topics. The change in SNS 1 MiB applies to Standard and FIFO topics and can simplify application integration and IoT or generative AI workflows. In parallel, Amazon ECS Express Mode added support for ARM64 workloads, enabling ARM container images to run on Graviton with cited price-performance gains; setup paths are described in ECS Express ARM64.

AWS Resilience Hub added EKS label-based service discovery, a generative AI-powered dependency insights feature for cross-Region and unusual patterns, and policy sharing via AWS Organizations. These updates, detailed in Resilience Hub, strengthen automated dependency discovery, failure-mode assessment, and centralized governance.

In regional and AI service expansions, AWS made memory-optimized Amazon EC2 X8i instances available in South America (São Paulo), touting performance and capacity gains over X2i and SAP certification for in-memory workloads; see EC2 X8i. In addition, Moonshot AI’s Kimi K3 model became generally available on Amazon Bedrock with a 1-million-token context window and prompt caching under Bedrock’s security controls, as described in Kimi K3 on Bedrock.

Google announced a preview of BigQuery cross-cloud caching to lower data transfer for cross-cloud analytics by caching sub-file columnar blocks locally, enforcing tenant/regional isolation and freshness checks. It also previewed cross-cloud connections to query raw files in S3 and Azure Storage, and catalog federation with Iceberg REST to synchronize metadata, as covered in BigQuery caching. The company highlighted scenarios for each mode and potential TCO reductions when combined with Partner Cross-Cloud Interconnect.

Microsoft will allow Teams administrators to customize the list of blocked file extensions used by the Weaponizable File Protection scanner. The control, described in a roadmap entry reported by Teams controls, is expected to begin rolling out in November 2026 across major platforms and complements measures like blocking external users via Defender and reporting suspicious guest invitations.

AI Agents: Safety, Testing, and Operational Guardrails

Reporting indicated that in a May 2026 evaluation a domain naming error let Google’s Gemini briefly interact with a real company system by guessing a password or finding credentials, after a test name overlapped with a real domain. As recounted in Gemini incident, the model ceased actions upon detecting real-world impact; Google characterized this as safety features functioning properly. The episode underscores the need for rigorous test design and guardrails when agents have internet access.

Separately, researchers examined AWS AgentCore Harness and found that, in default configurations, the built-in shell tool can be prompted to access plaintext credentials materialized from AgentCore Identity. The analysis in AgentCore harness shows an indirect prompt-injection path to execute commands as root and read resolved secrets. Recommended mitigations include minimizing allowedTools, applying least-privilege to identity vault accounts, and monitoring egress from harness containers.