Know what changed.
Trace why it matters.

Microsoft reported that Storm-3168, associated with JadePuffer, compromised two service principals in one Azure tenant and used them for reconnaissance, resource destruction, and credential collection over about 18 hours. The reconnaissance phase completed more than 300 successful read operations across Azure virtual machines, subscriptions, resource groups, and other resources, providing broad visibility into the organization’s Azure environment.

Microsoft said the activity appeared to be preparation for ransomware: it combined resource destruction, attempts to interfere with recovery mechanisms, and credential collection that could enable access to data.

Authlib versions up to and including 1.7.2 contain a JWS general JSON serialization signature-verification bypass in JsonWebSignature.deserialize_json(). The affected function accepts a JWS object with an empty signatures array and treats its payload as successfully verified, allowing arbitrary forged content without key material.

Systems relying on Authlib JWS verification for authentication, authorization, inter-service message integrity, or signed configuration may accept attacker-supplied content as legitimate.

Apple patched CoreGraphics zero-day CVE-2026-86950 after reporting possible exploitation in an extremely sophisticated attack against specific targeted individuals using iOS versions before iOS 27. The vulnerability is an out-of-bounds write that may enable arbitrary code execution when a specially crafted file is processed.

Apple has not disclosed the targets, number of affected people, exploitation timing, attack success, delivery method, technical attack details, or threat actors.