The Nine Lives Brief

Microsoft published its technical analysis of GigaWiper on July 9, 2026. Microsoft describes it as a modular backdoor with destructive capabilities, including scheduled-task persistence, RabbitMQ-over-AMQP command C2, Redis status and output reporting, potential file transfer to remote storage through the MinIO client, interactive system management, event-log...

CISA revised the Microsoft Expanded Cloud Logs Implementation Playbook on May 1, 2026. The document itself is not a shiny new product launch. The revision history calls it version 1.1 with general content and URL up...

Prompt injection is easy to underestimate when the model can only answer with text. The worst outcome looks like a bad summary, a leaked instruction, or a response that followed the wrong source.

In a tool-using agent, that assumption breaks fast.

A compromised document, support ticket, website, email, or retrieved chunk can influence the model’s next tool call....

A Linux local privilege escalation bug is easy to dismiss if you only think in traditional server terms: “An attacker already needs local access, so how bad can it be?”

In cloud environments, that assumption breaks fast.

A compromised container, a self-hosted CI runner, a developer box, a notebook environment, or a low-privileged shell on a Linux workload can al...

Device code phishing is nasty because the user does not hand over a password. They hand over a session.

The lure sends the victim to a legitimate Microsoft device sign-in page. The victim enters a short code. Entra ID issues tokens to the attacker’s waiting client. MFA can still be satisfied because the victim completed the approval ceremony at Microsoft, not on a fake...