Wayne Markovich

Oracle closed out Cybersecurity Awareness Month by patching four actively probed bugs, including a ShinyHunters PeopleSoft zero-day that turned out to be three separate CVEs chained together. Any org running Oracle EBS or PeopleSoft as a backend for identity or HR data feeding Entra ID or Intune enrollment should check exposure before EOD. (via The Register)

Anthropic just filed its S-1. Microsoft pulled $10B from OpenAI arrangements last quarter alone. The AI infrastructure layer underneath EUC tooling is consolidating fast around two or three players. Worth tracking which AI vendors your management plane vendors are betting on before your next renewal cycle. (via TechCrunch)

Azure: $33.2B in a single quarter, disclosed publicly for the first time. For anyone building a multi-year AVD or EUC migration business case, platform financial health is part of the risk calculus. Compare that trajectory to what enterprise customers are experiencing on the other side of the Broadcom acquisition. (via TechCrunch)

A 'low severity' ESXi bug that suppresses admin-level operations from log output is not low severity in practice. Chinese APT used it as a zero-day for exactly that reason. CVSS scores rate exploitability and impact, not forensic consequence. Your SIEM has no visibility below the hypervisor OS boundary. Worth knowing. (via SecurityWeek)

CVE-2026-76418 in Cisco ASA and FTD is being exploited now. That is two actively exploited VPN zero-days in the same product line since August. If ASA sits in front of your hybrid AVD host pools or session host egress path, patch first, then ask whether ASA is still the right tool for that job. (via SecurityWeek)

AI-assisted vuln discovery found one critical and three high-severity bugs in EPICS ICS software in under 4 hours. The time-to-discovery gap between researchers and threat actors is closing fast. How current is your endpoint detection coverage? (via The Register)

A threat actor breached GMO's Onamae Desktop Cloud and threatened to detonate ransomware. The incident response was: tell customers to power off their VMs. That is a catastrophic failure of cloud VDI isolation and blast radius design. (via BleepingComputer)

OOB Windows update drops trust in eMudhra CA certs due to compromised keys. Systems without automatic CTL updates need this manually. Worth verifying your AVD golden image and Intune update rings picked it up before the next session host reimage. h/t BleepingComputer

Node2Shell is in CISA KEV and honeypots are already logging attempts. Active exploitation of a Brotli-linked flaw means your internet-exposed endpoints need patch status confirmed now, not at next change window. (via SecurityWeek)

Critical EDK2 UEFI flaw allows pre-boot code execution on most servers. If your AVD session hosts or ANF storage nodes run on affected hardware, firmware patch priority just jumped. Check vendor advisories before your next imaging cycle. (via Ars Technica)