The Nine Lives Brief

Microsoft is changing three parts of the Entra authentication and recovery experience between now and next March:

Microsoft published its technical analysis of GigaWiper on July 9, 2026. Microsoft describes it as a modular backdoor with destructive capabilities, including scheduled-task persistence, RabbitMQ-over-AMQP command C2, Redis status and output reporting, potential file transfer to remote storage through the MinIO client, interactive system management, event-log...

CISA revised the Microsoft Expanded Cloud Logs Implementation Playbook on May 1, 2026. The document itself is not a shiny new product launch. The revision history calls it version 1.1 with general content and URL up...

Prompt injection is easy to underestimate when the model can only answer with text. The worst outcome looks like a bad summary, a leaked instruction, or a response that followed the wrong source.

In a tool-using agent, that assumption breaks fast.

A compromised document, support ticket, website, email, or retrieved chunk can influence the model’s next tool call....

A Linux local privilege escalation bug is easy to dismiss if you only think in traditional server terms: “An attacker already needs local access, so how bad can it be?”

In cloud environments, that assumption breaks fast.

A compromised container, a self-hosted CI runner, a developer box, a notebook environment, or a low-privileged shell on a Linux workload can al...