The cracks are showing in places we trust most. |
One cloud login can ripple across a tenant, a SIEM can become the foothold, and “safe” downloads may not stay flagged for long. Plus: AI lands in OT, and web trackers spark a pricey wake-up call. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Azure SSO Bug in Windows Admin Center Enables Tenant-Wide Pivot |
A new Windows Admin Center Azure SSO vulnerability could let attackers pivot from one compromised machine to tenant-wide control across Azure VMs and Arc-connected systems.
Tracked as CVE-2026-20965, the flaw impacts orgs using WAC to manage Azure — especially via the Azure Portal — by letting attackers pair a stolen WAC.CheckAccess token with a forged PoP token to impersonate admins and run commands across other WAC-enabled systems. |
Microsoft has released a patch for the issue.
Upgrade to Windows Admin Center Azure Extension v0.70.00+, restrict WAC with least privilege and MFA, and lock down port 6516 to trusted gateway-only access. |
FortiSIEM Under Fire as RCE Attacks Spread |
Attackers are actively exploiting a Fortinet FortiSIEM flaw that enables unauthenticated remote code execution on a platform many teams rely on for enterprise visibility.
Tracked as CVE-2025-64155, this FortiSIEM phMonitor command-injection bug can be exploited via crafted TCP traffic, letting attackers write arbitrary files as admin and potentially escalate to root. Fortinet has already released a patch for the vulnerability.
Patch FortiSIEM, block internet access to TCP 7900, and monitor phoenix.log for PHL_ERROR and suspicious file writes. |
Windows Flaw Undercuts Mark-of-the-Web Download Warnings |
Microsoft patched a Windows Remote Assistance vulnerability that can bypass Mark of the Web protection. Because it requires user interaction, the flaw is best suited for phishing-based attacks. A crafted file can bypass MOTW warnings and execution controls, letting payloads run more quietly. There are no reports yet of exploitation in the wild. Patch user-facing Windows endpoints first, restrict or disable Remote Assistance, and enforce WDAC/AppLocker plus SmartScreen/ASR protections to limit risky file execution. |
|
|
Cloud Tenant Armor Check: If one admin endpoint fell, how far could they go? |
|
|
Yesterday's Pulse Check Results |
How locked down is your remote access? |
|
|
Security Tools You Can Use |
|
|
CISA Issues New Playbook for Securing AI in OT |
CISA and international partners released new guidance to help critical infrastructure operators secure AI in OT environments. It outlines OT-specific AI risks — like model drift and safety bypasses in power, water, and other industrial systems — and warns that shadow AI use can create new exposure. |
The guidance highlights four core principles: understand AI risks, validate OT use cases, establish governance, and embed safety and security into AI-enabled OT.
Start with a small, tightly scoped AI pilot in a segmented OT zone and require human-in-the-loop review for any safety-impacting decisions. |
Kaiser Pays $46M Over Patient Data Sharing Claims |
Kaiser Permanente has agreed to a $46 million settlement over claims that patient-related data from its websites was improperly disclosed to third parties.
The claims center on tracking and analytics on Kaiser’s websites — not its medical records systems — allegedly sending patient interaction data to third parties like Google, Microsoft Bing, X, and Adobe from 2017–2024. The settlement is pending final approval from the courts.
Audit all patient-facing websites for pixels and third-party scripts, and require third-party security review before deploying new tracking tools. |
|
|
Discover the next steps in your DevOps, Security, and AI modernization journeys. Learn from industry leaders, preview GitLab's next chapter, watch technology demonstrations, and bring your feedback to the source. Register for GitLab Transcend and save your seat today!
|
|
|
Protect Cloud Tenants from Lateral Movement |
Cloud tenants are prime targets because one misconfigured identity, exposed admin port, or over-permissioned role can escalate into full tenant access. With hybrid and multi-cloud sprawl, attackers don’t need “zero-days” — they look for weak controls that let them move fast across workloads, subscriptions, and accounts. |
How to lock down your cloud tenants: |
- Enforce least privilege with RBAC and PIM to eliminate standing admin access and limit privilege escalation.
- Require MFA and Conditional Access, and restrict management access through segmented networks, jump hosts, and gateway-only paths.
- Lock down inbound admin ports with allowlists and JIT access, and monitor for identity, token, and remote command anomalies.
|
Tenant security comes down to limiting privileged access, reducing exposure, and detecting anomalies fast. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
