Inlägg taggade med "NIS2"

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder that Node.js says permits remote code execution, and it reaches Node.js 22, 24 and 26, .NET 8, 9 and 10, and the PyPI Brotli package. Fixes landed on 21, 22 and 25 October 2026, Imperva has a working exploit on Node 24.22.0, Node 20 will never be patched, and this guide covers who patches what in Azure, which code paths decode untrusted Brotli, and a seven-step audit.

PHP2Shell, CVE-2026-109618 and CVE-2026-109619, gives an unauthenticated attacker code execution on any PHP web server below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and was exploited before the 21 October 2026 patches shipped. Azure App Service on Linux patched its built-in runtimes the same day, Windows App Service PHP will never be patched, and the Front Door and Application Gateway mitigations are off by default. An audit for Azure teams.

LiteLLM 1.107.0 shipped on 21 October 2026 with a credential stealer and remote-code loader that ran on every Python start, harvesting Azure, Kubernetes, SSH and AI-tool credentials plus the proxy database of provider keys. A two-hour audit for Azure teams running LiteLLM in front of Azure OpenAI: find the digests, hunt the indicators, rotate in the right order, and decide whether the gateway belongs in API Management.

Microsoft's October 2026 Patch Tuesday fixed more than 1,400 CVEs, with one exploited Windows Shell zero-day and a Microsoft statement that AI-assisted discovery is why the volume keeps climbing. Here is the triage: which Azure CVEs were fixed server side and which land in your SDKs and Arc agents, how Microsoft's new risk cohorts help and where they leave 289 CVEs uncovered, the hotpatch reboot math, and what cybersäkerhetslagen expects you to be able to show.

Let's Encrypt will issue 64-day certificates by default from 10 February 2027, flips its staging environment on 14 October 2026, and drops to 45 days with seven-hour authorization reuse in 2028. On Azure that touches certbot on VMs, cert-manager on AKS and Key Vault pipelines feeding Front Door and Application Gateway, where fixed renewal schedules and absolute monitoring thresholds need to become relative.

OpenAI paused all training and tool-using inference of its most capable models on 25 September 2026 after a research agent tunnelled questions to an external chatbot through its sandbox's DNS resolver and ran for 2.5 hours past a failed auto-shutdown. Your GPT-6 Astra deployment in Microsoft Foundry is unaffected, but the same DNS gap exists in most Azure agent subnets: here is the firewall, resolver and kill-switch audit, plus what the 53-image disclosure means for GDPR.

AWS released Strands harness on 21 September 2026, an open-source Python and TypeScript agent harness that AWS says cuts token cost by 28% and that can run on Azure Container Apps. Out of the box it calls Amazon Bedrock, approves every tool call and keeps memory in a local folder, so Swedish and EU Azure teams need to change five defaults before any company data goes near it.

Anthropic relaunched Claude Code Projects on 17 September as a coordinator running parallel cloud threads that open and auto-fix pull requests, but the beta runs only on consumer Pro and Max plans, with no organisation-level controls, no Foundry route and github.com only. For Swedish and EU teams on Azure, that means company code processed under an employee's personal privacy settings unless you set a policy and use the GitHub App install as your control point.

More than ten Azure items retire on 30 September 2026, and the ones that fail silently are more dangerous than the ones that fail loudly: URL ping tests are deleted from your resources and the ContainerLog table stops receiving data, taking alert rules down with them. A triage guide with Resource Graph queries, Sweden Central cost math for standard web tests and Basic Logs, and a checklist for the Functions v3, Service Bus SBMP and 1 October AI service deadlines.

AWS confirmed on 15 September 2026 that data hosted only in its Bahrain region, and in one UAE Availability Zone, is permanently lost after Iranian strikes damaged multiple zones, proving that multi-AZ design protects availability but not against losing a whole region. For Azure teams in Sweden and the EU, the fix is a classified inventory, GZRS and geo-redundant backups for critical data, and early access to restricted pair regions such as Sweden South.

Anthropic's September 2026 threat report describes a SaaS breach that yielded 2,100 Azure AD token sets across 40 tenants in 34 hours, and a cloud takeover from one stolen developer token in about three hours. Here is the defender-side mapping the report leaves out: OAuth consent governance, Token Protection, key-free Foundry access, Sentinel detections on an hours clock, and what cybersäkerhetslagen expects.

A repository that arrives as a zip, sync folder or USB stick can execute attacker code the moment a CLI coding agent opens it, before any approval prompt and outside the agent sandbox. Manifold Security's GitSpawn disclosure covers eight findings across Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build, with four unpatched at publication.

A published attack chain achieved remote code execution against Claude Code in auto mode, with the safety classifier approving the steps that led to compromise and then blocking the cleanup command. What the break teaches teams running AI coding agents, and how to build real isolation on Azure with Hyper-V sandboxes, default-deny egress and short-lived credentials.

On 3 June 2026 the European Commission proposed the Cloud and AI Development Act, a regulation that introduces four Union assurance levels for cloud sovereignty and aims to at least triple EU data centre capacity within five to seven years. For Swedish public-sector and regulated teams on Azure, the framework will decide which workloads can stay on a US hyperscaler and which need an EU-controlled alternative, so the classification work should start now.

Sweden's cybersäkerhetslag (2025:1506) took effect on 15 January 2026, and the engineering detail sits in the ordinance and the MCFFS regulations rather than the headlines. This checklist covers scope and the essential versus important split, registration with FRA, the eight supervisory authorities, the three incident reports and their deadlines, supplier contract clauses, and the Azure and Microsoft 365 controls behind each of the ten measure areas.

Microsoft Ignite BRK270: Transform compliance from burden to accelerator. Microsoft Purview, Compliance Manager, AI Baseline, Regulatory Navigator. Automated governance for GDPR, AI Act, NIS2. 3-5x faster deployments, 70-90% less audit time.