Posts tagged with "Security"

Vals AI gave six agents an impossible task on 15 October 2026: recover £350 for a train ticket after the refund window closed, with email, web access and 40 million tokens; one sent 187 emails in 15 days, one leaked the user's mother's illness to five organisations, and all six asked the bank for a chargeback. We map each failure to the rate limits, tool-level blocking, token caps and logging in Azure API Management and Foundry, with the GDPR and AI Act consequences for a Swedish deployer.

Google, JPMorgan Chase, Weaviate, France's DINUM and an Indonesian city government have each fixed the same server-side request forgery flaw in their MCP servers, with Google's case scored CVSS 8.0 as CVE-2026-14540. Every Azure control in front of an MCP server governs inbound traffic, so the fix lives in your server's HTTP client and in network egress rules, and this guide shows both.

A deep dive into Microsoft Entra Agent ID, the control plane for AI agent identity in 2026. Covers identity blueprints, attended and unattended authentication, tool-level RBAC, conditional access, OBO flows across multi-agent systems, and the audit logging that satisfies DORA, NIS2, and AI Act obligations.

A practical pattern for rotating Azure secrets with zero downtime using Managed Identity, Key Vault rotation policies, and versioned references — including the common mistakes that cause rotation-induced outages.

Sweden's cybersäkerhetslag (2025:1506) took effect on 15 January 2026, and the engineering detail sits in the ordinance and the MCFFS regulations rather than the headlines. This checklist covers scope and the essential versus important split, registration with FRA, the eight supervisory authorities, the three incident reports and their deadlines, supplier contract clauses, and the Azure and Microsoft 365 controls behind each of the ten measure areas.

A step-by-step migration playbook for rolling out passkeys in a B2B SaaS — from opt-in enrollment and conditional mediation, through account recovery and device attestation, to the failure modes that still catch teams out.

What Next.js Server Actions actually protect against out of the box, what they do not, and the security patterns — auth, rate limiting, input validation, file-upload hardening — every production app should layer on top.

A review of the npm supply-chain incidents that defined 2025 — typosquats, self-replicating worms, and dist-tag hijacks — plus the concrete hardening steps every Next.js team should have in place before 2026.

Critical security vulnerabilities in Next.js 13-16 App Router: CVE-2025-55184 enables DoS attacks, CVE-2025-55183 exposes Server Action source code. Learn which versions are affected and how to upgrade immediately.

A critical CVSS 10.0 remote code execution vulnerability affects React 19 Server Components. Learn which versions are affected and exactly how to patch your Next.js, React Router, and other RSC applications immediately.