A New App Consent Attack: Hidden Consent Grant

As enterprises integrate Microsoft Entra ID (formerly Azure AD) with on-prem AD, this piece examines hybrid identity risks—above all permission sprawl—and urges a look-before-you-leap approach to cloud identity adoption.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Purple Knight 1.5 adds 10 Entra ID security indicators so organizations can assess gaps across on-prem AD and the cloud, plus MITRE D3FEND tags, seven new on-prem indicators, and enhanced HTML/PDF reporting.

NetSPI describes an MFA bypass found in an external assessment: an Entra ID Conditional Access misconfiguration with Duo let attackers reuse an SSO token without any MFA prompt.

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.

A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.