The patch tuesday msft.it/6018SZEg0

Couple of days ago I noticed that Steam does not work. I thought it might be DDOS and it was. share.google/LTKsVzkZxi2N...

Checkout this Meetup with Microsoft Security User Group Finland: meetu.ps/e/PrJsH/11qZ...

Fixed thehackernews.com/2025/09/micr...

New blog about automated malware remediation from storage account blobs www.jussimetso.com/index.php/20...

My Microsoft Sentinel data lake blog is out now www.jussimetso.com/index.php/20...

My first renewal 🔥🔥🔥

The sequel with task lists for modernizing on-prem SIEM to Sentinel www.jussimetso.com/index.php/20...

How to modernize your on-prem siem to Microsoft Sentinel aka Cloud Siem www.jussimetso.com/index.php/20...

Last blog post in my Defender for Cloud series so far. The end has come. Topic this time is Data and AI Security Dashboard. www.jussimetso.com/index.php/20...

Old but still valid.

New bl0g! Defender for Cloud - Advanced protection is kind of LARGE area to cover but I tried. Advanced Threat Protection provides a new layer of security, which enables customers to detect and respond to potential threats as they occur by providing security alerts on anomalous activities.

Workload Protection in Microsoft Defender for Cloud refers to cloud-native security posture management (CSPM) and threat protection for workloads running in Azure, hybrid, and multi-cloud environments (including AWS, GCP, GitHub, Azure DevOps and others).

Blog: Regulatory compliance in Defender for Cloud. If you need to check how your Azure, AWS, GCP resources comply against industry standards you can use this feature. www.jussimetso.com/index.php/20...

OpenAI's #Sora became available in Europe today. 🔥 If you have #ChatGPT Plus or Pro subscription you can create your own videos with it. Naturally, I needed to test it by creating some bernese mountain dog videos! 🥰 #openAI #aivideo #bernesemountaindog #ai #texttovideo

"Once installed, Auto-color allows threat actors full remote access to compromised machines, making it very difficult to remove without specialized software," security researcher Alex Armstrong."

Worst. Episode. EVER.

The seventh part of my Microsoft Defender for Cloud EPIC blog series. Read and learn. :) #microsoft #security #defenderforcloud #cloudsecurity #mvpbuzz

"The use of this utility would help to obfuscate the original source, and ultimate destination, of the request and would also allow its operator to move through potentially otherwise non-publicly-reachable (or routable) devices or infrastructure," Cisco noted.

"An attacker who can generate a SQL injection via CVE-2025-1094 can then achieve arbitrary code execution (ACE) by leveraging the interactive tool's ability to run meta-commands"

In device code phishing, threat actors exploit the device code authentication flow to capture authentication tokens, which they then use to access target accounts, and further gain access to data and other services that the compromised account has access.

The vulnerability, tracked as CVE-2025-0108, carries a CVSS score of 7.8 out of 10.0. The score, however, drops to 5.1 if access to the management interface is restricted to a jump box.

Google has released an urgent update for its Chrome browser to address a critical security vulnerability that could allow attackers to remotely execute malicious code on vulnerable systems.

"Two of the highest areas of failure were the ability for users to generate malware and viruses using the model, posing both a significant opportunity for threat actors and a significant threat to enterprise users. " 😱

Jukka, Tommi & co have created a podcast to YouTube. So watch and learn💪

Blog time! Finally I have time to continue my MDC (Defender for Cloud) series with topic Attack Path Analysis. #cloudsecurity #defenderforcloud #mvpbuzz

I wrote a refresh blog about Security Copilot from which I first wrote in late 2023. It have developed a lot since then. #securitycopilot #mvpbuzz

Italy's data protection watchdog has blocked Chinese artificial intelligence (AI) firm DeepSeek's service within the country, citing a lack of information on its use of users' personal data. Statement issued January 30, 2025.

Buzzy Chinese artificial intelligence (AI) startup DeepSeek, which has had a meteoric rise in popularity in recent days, left one of its databases exposed on the internet, which could have allowed malicious actors to gain access to sensitive data. >> Nice work from China.

"Threat actors use these platforms by adopting 'living-off-the-land' techniques and using native tools like SSH to establish a SOCKS tunnel between their C2 servers and the compromised environment."

The vulnerability, tracked as CVE-2025-24085, has been described as a use-after-free bug in the Core Media component that could permit a malicious application already installed on a device to elevate privileges.

"In scenarios where the ZeroMQ socket is exposed over the network,attackers could exploit this vulnerability by sending crafted malicious objects to the socket," Lumelsky said."Since recv_pyobj will unpickle these objects,an attacker could achieve arbitrary code execution (RCE) on the host machine."

"An attacker can continuously crash the Mobility Management Entity (MME) or Access and Mobility Management Function (AMF) in an LTE/5G network, respectively, simply by sending a single small data packet over the network as an unauthenticated user (no SIM card required)."

New blog about AI LLM attacks and how to protect AI solutions with Microsoft products - part 2 #microsoft #ai #aisecurity #azure #mvpbuzz

Huomenna on vuoden ensimmäinen msug.fi tapaaminen. www.meetup.com/microsoft-se...?

The campaign has been observed going through four distinct attack phases that commenced around November 16, 2024, allowing the bad actors to progress from vulnerability scanning and reconnaissance to configuration changes and lateral movement.

The security vulnerability in question is CVE-2025-0282 (CVSS score: 9.0), a stack-based buffer overflow. "Successful exploitation of CVE-2025-0282 could lead to unauthenticated remote code execution"

Key Takeaways from 2024 Cybersecurity Trends *Healthcare Under Siege *Geopolitical Espionage *Supply Chain Vulnerabilities *AI Weaponization Read more on link below! #cybersecurity

A high-severity flaw impacting Four-Faith router models F3x24 and F3x36 come under active exploitation in the wild, according to new findings from VulnCheck. The vulnerability, tracked as CVE-2024-12856 (CVSS score: 7.2), has been described as an operating system (OS) command injection bug.

Because of why not

Tracked as CVE-2024-52046, the vulnerability carries a CVSS score of 10.0. "This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious serialized data, potentially leading to remote code execution (RCE) attacks."

Palo Alto Networks has disclosed a high-severity vulnerability impacting PAN-OS software that could cause a denial-of-service (DoS) condition on susceptible devices. The flaw, tracked as CVE-2024-3393 (CVSS score: 8.7), impacts PAN-OS versions 10.X and 11.X, as well as Prisma Access with PAN-OS.

There are lot of changes in m365maps.

Do you like camp fires? It calms me watching the fire. This was at a friends party yesterday but I do like to hike in the forest and make these like almost everyone else in Finland.

"This issue results from the lack of input validation on request parameters allowing an attacker to traverse directories and read any log file on the system" -Zach Hanley, Horizon3.ai.

The issue, tracked as CVE-2024-53677, carries a CVSS score of 9.5 out of 10.0, indicating critical severity. #patch #vulnerability