UnOAuthorized: Privilege Elevation Through Microsoft Applications

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.

A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.

Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.

This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner

DOM Invader gains cross-domain leak detection: it inspects web messages and flags secrets from the URL being sent to other origins, automating the hunt for OAuth credential-theft misconfigurations.