Microsoft releases Azure Linux update addressing more than 470 vulnerability references

Posted in Commentary with tags on November 11, 2026 by itnerd

Microsoft has released a major security update for Azure Linux, addressing more than 470 CVE references across the operating system, open-source packages and container infrastructure.

The November 7 release includes fixes affecting the Linux kernel, OpenSSL, Kubernetes, Docker and other components supporting cloud environments. Some vulnerabilities appear multiple times across different packages, so the total does not represent 470 distinct flaws.

The update also addresses certificate trust issues following the eMudhra certificate incident, removing or distrusting affected root certificates and strengthening validation in Python and Go. Additional patches cover container technologies including KubeVirt, containerd and Docker Compose, while the Linux kernel has been updated to version 6.6.161.1.

John Strand, Black Hills Information Security

“Four hundred CVEs in Linux is absolutely terrifying. But honestly, that’s not what makes me most uncomfortable.

“It’s like a magic trick. If the magician is showing you something in one hand, you need to watch the other hand.

“AI is speeding up code analysis and vulnerability discovery in the core applications and operating systems everyone uses. Organizations are trying to patch those vulnerabilities. That’s great. Linux, Windows, and OpenSSL may finally get the level of security scrutiny we should have been giving them all along.

“But what happens when you step away from those frontline technologies? When you move beyond the Linux kernel, OpenSSL, Docker, and Windows, you get into second and third tier projects and products that organizations use every single day.

“Who’s looking at those? Are they getting the same support? Who’s funding the security reviews, and who’s paying someone to fix what gets found?

“That’s what makes me uncomfortable. Attackers don’t need to get through the most heavily scrutinized software in your environment. They need a way in. And I think these less supported technologies are going to give them one.”

ㅤ

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“A patched host can still be running an unpatched workload. That is why I would look beyond the 470-plus CVE references and ask which affected components are actually deployed and reachable. The eMudhra-related certificate changes deserve particular attention because trust decisions can live in operating-system stores, bundled certificates, and application code. Go’s own guidance calls for rebuilt binaries to receive its verifier fix. Installing a newer compiler does not update an application already running in production.

“For operators, the job is to apply the supported updates, rebuild or replace affected application artifacts where necessary, and verify the result. Exposure and potential impact should guide rollout priorities. Certificate testing should confirm that affected chains are rejected while legitimate connections continue to work. From an offensive-security perspective, the useful follow-up is to test whether the relevant attack path has closed. A completed patch ticket records an action. Evidence from the running workload shows whether the intended protection is working.”

I have a post about the latest flaws found in Microsoft software for the month of November. Which to be frank is crazy. Having said that, this is required reading. ㅤ

Leave a comment »

Australia moves to regulate AI after rogue OpenAI agent breaches government portal

Posted in Commentary with tags , on November 11, 2026 by itnerd

Following an incident involving an OpenAI agent that accessed an Australian government website without authorization, Australia is moving to establish stricter oversight of AI developers.

In a November 10 announcement, Prime Minister Anthony Albanese confirmed that the government has accepted all 18 recommendations from a review of the incident, including mandatory reporting of AI-related cybersecurity incidents and stronger accountability for developers.

The incident occurred in June when an autonomous OpenAI agent conducting an internet research task gained unauthorized access to the Medicare Statistics Reporting Service Portal. OpenAI reportedly did not detect the activity until August and notified the Australian government in September.

Australia now plans to establish an AI safety regulator, introduce mandatory safety and security standards, and consider criminal-law reforms for serious misconduct involving AI systems. The proposals also call for improved information sharing and coordination between government cybersecurity agencies and AI developers.

Ryan McCurdy, Vice President of Marketing, Liquibase

“What’s concerning about this incident is that the AI agent wasn’t trying to do anything malicious. It was carrying out a legitimate research task, encountered restrictions, and found another way to access information it wasn’t authorized to retrieve.

“AI agents are probabilistic systems. They interpret instructions, make decisions, and sometimes take actions their operators didn’t anticipate. That’s why the controls governing what they’re allowed to do need to be deterministic. We can’t rely on an AI agent to determine whether its own actions are authorized. Those boundaries need to be enforced independently of the model.

“Australia’s response puts more attention on accountability and incident reporting, which are important. But reporting an incident after it happens doesn’t prevent the damage. Organizations need technical controls that enforce permissions, validate high-risk actions, and prevent unauthorized changes before they’re executed.

“As AI agents take on more responsibility across software development and IT operations, the same security and governance standards should apply whether an action comes from a person or an AI agent.”

ㅤ

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“Giving an AI agent a legitimate research task does not authorize it to bypass someone else’s access controls. OpenAI describes an experimental model crossing that boundary. Its report that individual patient records were not accessed matters, but it does not erase the authorization failure. Australia’s proposed reporting requirements and independent evaluations are sensible steps. I would judge their success by the evidence: can developers show what an agent was authorized to do, what it did, and whether controls stopped unauthorized actions? Permissions need to be enforced outside the model and tested when an agent encounters resistance or changes its approach.

“A prompt is not a permission system. The timeline also raises two separate questions: how quickly unauthorized activity is detected, and how quickly affected organizations are notified after discovery. Both need clear ownership and tested response procedures. Organizations should receive prompt preliminary notice and usable technical evidence while the investigation continues. Autonomy can change how work gets done; it should never make responsibility disappear.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“An OpenAI agent given free access to the public internet during an internal evaluation hit a government portal, got denied, and then created a disposable email address to register for an account anyway. That is the same lightweight social engineering workflow attackers use, with no containment layer inside OpenAI’s own environment catching it on the way out.

“The same AI companies producing these incidents are launching cybersecurity tools with minimal internal expertise to back them, and asking security professionals to trust them in production environments. There’s a real conflict of interest in asking practitioners to trust companies that prioritize speed of innovation over cybersecurity and guardrails every time, and this incident is a direct consequence of that tradeoff. Taking 84 days to notify through a public feedback inbox is a difficult credential to bring to a cybersecurity product conversation.

“Australia accepting all 18 recommendations and moving toward mandatory incident reporting is the right call. Every other government is going to end up here eventually.”

Australia leads the way because there is zero chance that I would trust OpenAI given its track record with the Australians alone. Sadly this will not force them to clean up OpenAI’s act as OpenAI really needs it.

Leave a comment »

Cyber Espionage Group Silent Lynx Compromises Tajikistan Railway, Collects Thousands of Defence Documents

Posted in Commentary with tags on November 11, 2026 by itnerd

A cyber espionage group known as Silent Lynx maintained persistent access to Tajikistan’s national railway network, collected more than 2,000 defence-related government documents and compromised a government-run geospatial platform in Uzbekistan. The operations, uncovered by CloudSEK researchers through an exposed server belonging to the group, also reveal how attackers used an AI agent to assist with reconnaissance, data collection and evidence cleanup.

The exposed server contained more than a dozen gigabytes of data, including malware, compromised credentials, collected government documents and operational records spanning April to October 2026.

Tajikistan’s Railway and Defence Correspondence Targeted

According to CloudSEK’s investigation, Silent Lynx maintained domain-level access to Tajikistan’s national railway network from mid-August until at least October 10, 2026. The attackers accessed multiple servers, extracted administrative credentials and collected internal operational reports and correspondence.

In a separate intrusion, the group used the credentials of a railway employee to access Tajikistan’s national electronic document management platform. Weak document-level access controls allowed the attackers to collect thousands of government records, including more than 2,000 unique documents involving the Ministry of Defence.

The collected material included military personnel transfers, flight-clearance requests, defence procurement correspondence, air-defence cooperation records and identity documents.

The investigation also uncovered a compromise of Uzbekistan’s Smart Forestry GeoServer, where attackers gained command execution, accessed the underlying database and established persistence.

AI Agent Used to Support Espionage Operations

One of the investigation’s significant findings was the use of a self-hosted AI agent built on the Hermes framework, primarily powered by DeepSeek models.

The operator used the agent to support reconnaissance, analyse collected information and perform operational cleanup. Its configuration also allowed certain destructive commands to run without additional approval.

Researchers discovered phishing lures impersonating Turkmenistan Railways and a regional administration, suggesting preparations for further targeting in Turkmenistan.

Evidence Suggests Kazakhstan Connection

CloudSEK attributed the exposed server to Silent Lynx with high confidence based on malware code markers, build paths and similarities with previously documented operations.

The investigation also identified operator test connections originating from residential internet services in Kazakhstan, including Kazakhtelecom. Combined with Russian-language instructions and operational patterns, these findings support earlier assessments of a possible Kazakhstan nexus, although attribution to Kazakhstan remains at medium confidence.

The exposed infrastructure provides a detailed record of the group’s intrusion methods, intelligence collection and use of AI-assisted tools in cyber espionage operations across Central Asia.

Full investigation: www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server

Leave a comment »

Prevent scams this Holiday season, thanks to TELUS

Posted in Commentary with tags on November 10, 2026 by itnerd

A too-good-to-be-true Black Friday deal. A text saying your package couldn’t be delivered. A call that looks like it’s coming from someone you know. Sound familiar?

As Canadians gear up for the holiday shopping season, scammers use this time to catch people off guard.

According to the Canadian Anti-Fraud Centre, Canadians reported more than $704 million in fraud losses in 2025, across more than 112,000 reports. The agency estimates that only 5–10% of frauds are reported, suggesting the true impact could be much greater.

To help Canadians navigate these risks, TELUS recently launched Scam Protection powered by Norton, which includes four distinct features that helps identify suspicious calls, texts and emails and provides an on-demand assistant for checking potentially fraudulent messages.The service is built directly into the My TELUS app and once activated, the service works quietly in the background so customers can continue with their day-to-day knowing they have tools to help identify potential scams and make more informed decisions about what to trust.

TELUS Scam Protection is included at no additional cost with new TELUS mobility data plans. Existing customers can also access it by switching to an eligible plan or adding the service to their current plan for $3 per month.

With that in mind, I wanted to share a timely story idea on common holiday shopping scams and how Canadians can better protect themselves, offering a natural tie in for TELUS Scam Protection.

  • Fake shopping deals: Be cautious of suspicious offers and links promising unbelievable discounts.
  • Fraudulent delivery notifications: Think twice before clicking a link in an unexpected package or delivery text.
  • Spoofed phone numbers: Just because a call appears to come from a familiar number doesn’t mean the caller is legitimate.
  • Phishing emails and texts: Watch for messages asking you to urgently share personal or payment information.
  • Suspicious messages on social media: Be cautious of unexpected requests or links, even when they appear to come from a familiar account.

Leave a comment »

November Patch Tuesday Commentary From Fortra

Posted in Commentary with tags on November 10, 2026 by itnerd

By Tyler Reguly, Associate Director, Security R&D at Fortra

Another Patch Tuesday, another 4-digit patch drop from Microsoft. This month, we do see fewer vulnerabilities than we saw last month. I’m not foolish enough to think that this single drop indicates that we’re into the downward trend that I predicted we’ll see in the coming months. Instead, I think that we’re seeing a continuation of the elevated numbers as Microsoft continues to fix long hidden issues that are being surfaced by AI. Soon, however, these numbers will begin to decline as the last of these long-hidden issues are resolved and we only have new bugs to deal with.

For the past few weeks, everyone has been talking about MS Paint and an associated vulnerability (CVE-2026-83844) from the October Patch Tuesday, that is the kind of noise that experienced administrators and security researchers are ignoring, and everyone else should to. It was not an issue that warranted conversation, yet there was plenty of it. Instead, let’s focus on real issues, like actively exploited vulnerabilities. This month, luckily, we only have one of those, CVE-2026-124194, a vulnerability in Outlook that could allow the disclosure of an account’s NTLMv2 hash. Since Microsoft notes that an exploit has been detected, this one is worth talking about… everyone should work to update Outlook as soon as possible.

I don’t know about everyone else, but I’m tired. I can only imagine that if I’m tired, admins and operations teams everywhere are also tired. We must remember perseverance now. It isn’t a question of if vulnerability counts will decrease, it’s a question of when. We just need to hold on a little bit longer – drink that coffee or that energy drink with a sweet treat to keep yourself going. I believe that we will make it through to the other side, if we prioritize updates and focus on what really matters. The noise is coming at us from all sides, and we need to cut through it and figure out what really matters to the business.

This is where CSOs can help their teams by ignoring any noise coming from vendors and any vulnerabilities that are overhyped. When vuln counts started to rise, it was C-level employees who jumped up the fastest and added to the burden their admins were facing. Now it’s time to settle down and support your teams rather than increasing their burden. Keep these four things in mind:

  • AI companies and security vendors may needlessly hype unimportant vulnerabilities because it is a cheap, effective marketing for their services.
  • A vulnerability isn’t critical if you don’t have the impacted software deployed.
  • Prevention is key, focus your efforts on system hardening and mitigation, it will be more effective than chasing vulnerabilities.
  • Prioritization matters. If you’ve developed a prioritization strategy that works for you, don’t change your process just because the media is looking for clicks.

1 Comment »

Your iPhone Saying “Slow Charger” Is NOT A Problem

Posted in Commentary with tags on November 10, 2026 by itnerd

Since iOS 18 from September to November, I get calls from clients who got new iPhones and who want me to fix their “Slow Charger” issue. As in they either plug their phone in or drop it on a wireless charger and they get the message “Slow Charger” pop up on their lock screen.

I am here to tell you that this is not a problem. Here’s why.

First, your phone is still charging. It’s just charging slowly. Why is that the case? well, if your wireless charger is less than 10W or your wired charger is less than 7.5W, Apple considers that to be “slow.” And that you can charge faster if you had a “faster” charger. You will typically see this if:

  • Your charging brick is wired and USB-A. The fix is to go to a USB-C charger and cable.
  • Your cable is not a good quality USB-C cable. In which case get a better quality cable.
  • Your wireless charger is less than 10W. That means you need to upgrade your charger to something faster.

I have also found that shared power adapters cause this issue. By shared I mean that a power adapter is 20W, but it only puts 7.5W or less to the iPhone for example. And I have found that Non–Power Delivery (PD) adapters or uncertified third‑party chargers cause this issue as well. The fix for these are to have either a dedicated charger or a higher wattage shared power adapter, or have a certified charger that does PD.

The key message is that this message is informational, not a sign of damage. It simply indicates that your iPhone could charge faster with a better charger.

Leave a comment »

How to Assess OT Incident Response Preparedness

Posted in Commentary with tags on November 10, 2026 by itnerd

Cyberattacks affecting operational technology (OT) can disrupt production, equipment, and essential services, resulting in consequences that extend beyond disruptions to traditional IT systems. To help organizations evaluate their preparedness, Cloud Range today introduced the Cloud Range OT Cyber Readiness Assessment, a free, 28-question resource designed to identify potential gaps in OT incident response preparedness.

The assessment provides a practical starting point for IT, security, OT, and engineering teams to evaluate how well they understand their environments, coordinate responsibilities, and prepare to detect, investigate, respond to, and recover from cyber incidents affecting industrial operations.

T Cybersecurity Threats Reinforce the Need for Preparedness

Recent research illustrates the scale of cyber threats facing industrial organizations. The Dragos 2026 OT Cybersecurity Year in Review reports that approximately 3,300 industrial organizations were affected by ransomware in 2025.

Palo Alto Networks’ 2026 State of Critical Infrastructure Cybersecurity Report found that 59% of surveyed critical infrastructure organizations experienced a significant security breach in the past year. The research also found that 74% had not fully integrated IT and OT security operations, highlighting the importance of coordinated incident response.

The report also identifies operational consequences of cybersecurity incidents, including safety concerns, unplanned downtime, production disruptions, and financial losses.

Together, these findings underscore a central challenge for organizations operating OT and industrial control systems (ICS): preventing attacks is important, but so is understanding whether teams can recognize, investigate, and respond quickly and effectively when incidents occur.

An attack does not have to originate within an OT network to affect industrial operations. Compromises involving enterprise IT systems, third-party access, supply chains, or interconnected infrastructure can create consequences for production environments and critical services.

Seven Critical Areas of OT Cyber Readiness

The Cloud Range OT Cyber Readiness Assessment examines seven areas that influence an organization’s ability to prepare for and respond to cyberattacks affecting OT environments:

  • Know Your Environment: Understand critical OT assets, systems, dependencies, and connections between IT and OT environments.
  • Know Your Threats and Stakes: Recognize relevant cyber threats and their potential impact on operations, equipment, and safety.
  • Bridge IT and OT: Establish shared responsibilities, communication, and decision-making across IT, security, OT, and engineering teams.
  • Detect and Investigate: Identify suspicious activity, investigate threats, and determine their potential operational consequences.
  • Respond Without Making It Worse: Make coordinated incident response decisions that account for production continuity, equipment, and safety.
  • Recover and Maintain Resilience: Understand recovery priorities, system dependencies, and procedures for restoring critical operations.
  • Prove Readiness Before It Matters: Validate response capabilities through realistic cyberattack simulations and measurable performance.

Each area includes three questions, with responses of Ready, Developing, or Unsure.

Rather than assigning a numerical score, the assessment helps organizations identify gaps, uncertainties, and areas requiring further attention. IT, security, OT, and engineering teams can complete it independently and compare their responses to uncover differences in understanding, unclear responsibilities, or differing assumptions about preparedness.

Why OT Incident Response Preparedness Requires Cross-Functional Coordination

OT environments present distinct incident response challenges because cyber decisions can affect physical equipment, industrial processes, production availability, and potentially safety.

Actions that may be appropriate in an enterprise IT environment, such as isolating a system or shutting down a device, can require additional operational evaluation when industrial systems are involved.

Effective OT incident response therefore depends on coordination among teams with different responsibilities and expertise.

IT and security personnel may focus on identifying malicious activity, containing threats, and investigating compromised systems. OT and engineering personnel understand process dependencies, equipment limitations, and the operational consequences of response decisions.

Both perspectives are essential. The integration gap identified in the Palo Alto Networks research reinforces the importance of shared understanding, clear responsibilities, and coordinated decision-making across IT, security, OT, and engineering teams.

Understanding how to assess OT cyber readiness across these functions helps organizations identify where their procedures, communication, and decision-making may require further attention.

The assessment is intended to support those conversations before an actual incident demands coordinated action.

From OT Cyber Readiness Assessment to Attack-Based Validation

An assessment can help organizations identify preparedness gaps, but it cannot establish how effectively teams will perform during a real cyber incident.

That requires opportunities to investigate attacks, make decisions, coordinate across functions, and evaluate the results in realistic environments.

Cloud Range helps organizations strengthen critical infrastructure cyber readiness, realistic cloud-based OT/ICS, IT, cloud, and hybrid environments where teams can investigate cyber threats, coordinate incident response, and measure performance. Its critical infrastructure cybersecurity and readiness programs help organizations prepare for attacks that may disrupt industrial processes, equipment, and essential services.

The Cloud Range OT Cyber Range supports flat and Purdue-model industrial network architectures, allowing teams to investigate how connectivity, segmentation, and system dependencies influence attack progression and response. Hardware-in-the-loop capabilities can also connect physical OT laboratory equipment to the cyber range for cyber-physical security validation.

Through OT cyberattack simulations and adversary emulation, teams can investigate ransomware, supply-chain compromise, credential theft, lateral movement, and threats affecting industrial systems.

Performance metrics highlight how teams improve in detecting threats, investigating activity, coordinating decisions, and improving incident response over time.

Across Cloud Range customer engagements, measured improvements have included reductions of up to 66% in mean time to detect and improvements of up to 30% in overall incident response time. These results reflect broader cyber readiness programs and are not specific to OT environments.

Building a More Complete Picture of OT Cyber Readiness

As IT and OT environments become more interconnected, organizations face growing pressure to understand both their cybersecurity exposure and their ability to respond to incidents with operational consequences.

The Cloud Range OT Cyber Readiness Assessment provides a structured way to evaluate preparedness across seven critical areas. Organizations can use the findings to prioritize improvements and identify where realistic attack-based validation can provide stronger evidence of readiness.

The objective is not simply to have an incident response plan. It is to build confidence that the people, processes, and technologies involved can work together when an attack affects operations.

Leave a comment »

For the Sports Fan Who Has Everything, Consider Fubo

Posted in Commentary with tags on November 10, 2026 by itnerd

Fubo, the sports-first live TV streaming platform h brings fans closer to the teams, leagues and competitions they love, making it a great addition to any gift that you might be giving. Let me hit the highlights:

  • For the sports lover who has everything: As the exclusive home of the English Premier League in Canada, Fubo streams every match live throughout the season, alongside Serie A, Bundesliga, Ligue 1, Concacaf and the Canadian Premier League. For fans who love more than soccer, Fubo Sports Pro bundles Fubo with DAZN, including NFL Game Pass for every NFL game.
  • For the last-minute gift giver: No shipping delays or crowded malls! A digital streaming subscription offers a convenient, instant-access option for shoppers looking for a thoughtful gift without the last-minute scramble.
  • For those who prefer experiences over things: Forget another gadget! From iconic rivalries and unforgettable sporting moments to entertainment, news and lifestyle programming, Fubo offers something for the whole family to enjoy together.

With cloud DVR, streaming across devices and select Premier League matches in 4K, Fubo delivers live sports excitement week after week, long after the holidays are over. So if you’re a last minute shopper, or you plan ahead, you should give Fubo a look.

Leave a comment »

Keeping iPhone Users Safe From Spyware

Posted in Commentary with tags on November 10, 2026 by itnerd

I don’t talk my clients out of much. But based on a quick interview with them, I often talk them out of having their iPhone scanned for spyware. That however might be changing.

iPhone spyware is usually reserved for government surveillance. So if you are a politician, an activist, a human rights campaigner, your a target. That likely changed with iVerify’s Advanced Mobile Threat Report 2026, published November 10. To highlight:

“In 2026, that changed. The exposure of DarkSword and Coruna in March, and the leak of DarkSword on GitHub, put government-grade iOS exploits in criminal hands. Attackers delivered them through online ads, reached ordinary employees, and erased their traces before defenders could respond. Android faced the same shift, with cheap, ready-made kits that let criminals take over phones remotely.”

This is of course, bad. Google’s Threat Intelligence Group sings a similar story. What this means is you need to be on guard. But the question is how? I have a few tips:

  • Keeping your iPhone updated is the most effective defense. You should install patches shortly after they are available.
  • Only download apps from trusted sources, and check the developer before installing unfamiliar software. I would not trust the Apple App Store to keep you completely safe. The same goes for certificates or profiles that you have no knowledge of.
  • Using strong, unique passwords and two-factor authentication also helps protect accounts.
  • People concerned about sophisticated, targeted spyware can consider Lockdown Mode, which restricts certain apps, websites, and features to reduce potential attack paths. That is the nuclear option. But it does work.

I also recommend watching this video from John Scott Railton of The Citizen Lab at the University Of Toronto for other useful tips.

Leave a comment »

Fraud Awareness Week: AI voice cloning, exposed data and holiday scams

Posted in Commentary with tags on November 10, 2026 by itnerd

With International Fraud Awareness Week (Nov. 15–21) kicking off next week and the holiday season approaching, I wanted to give you and the ones you love something to work with.

Virtual kidnapping is on the rise. Criminals can use AI-generated voices and personal details pulled from data breaches or social media to fabricate an emergency involving a loved one, then pressure victims into sending money before they can verify the story.

PureVPN recently highlighted this threat and the role exposed personal information can play in these scams, along with practical steps consumers can take to protect themselves, including checking their data exposure and establishing family verification plans. You can find more details here.

This is timely as holiday travel and online activity pick up. Thus it should be required reading.

Leave a comment »

« Older Entries