cybersecurity

Wiz Research disclosed CosmosEscape — a chain of vulnerabilities in Azure Cosmos DB’s Gremlin API that allowed any attacker with a standard Cosmos DB account to escape the query sandbox via .NET reflection, execute code on Microsoft’s multi-tenant DB Gateway, and retrieve the Cosmos Master Key: a single platform-wide signing key giving full read/write access to every customer database across all tenants, regions, and API types. The Master Key also unlocked the Config Store — a queryable directory of every account on the platform, filterable by tenant ID. Microsoft’s internal Cosmos DB databases (Entra ID, Teams, Copilot) were in scope. No customer action required — server-side fix completed July 2026. Black Hat USA briefing: “One Key to Rule Them All.”

ESET researcher Martin Smolár discovered 11 old Microsoft-signed UEFI shim bootloaders — some over a decade old — that could bypass Secure Boot on virtually every UEFI computer in the world with nothing more than a file copy. No new exploit needed. Affected: all UEFI systems trusting Microsoft Corporation UEFI CA 2011, regardless of OS. Enables deployment of Bootkitty, HybridPetya, BlackLotus — bootkits that run before the OS, before EDR, before AV, and survive OS reinstalls. Microsoft revoked the 11 binaries via June 9 Patch Tuesday dbx update. ESET cannot confirm how many additional unrevoked vulnerable shims remain undiscovered.

Bad Epoll (CVE-2026-46242) is a race condition use-after-free in the Linux kernel’s epoll subsystem that lets any unprivileged local user escalate to root on Linux desktops, servers, and Android devices running kernel v6.4 or later. A public exploit achieves root 99% of the time despite a race window only six instructions wide. The disclosure has a significant subplot: Anthropic’s Mythos found the sibling bug in the same 2023 commit — and missed Bad Epoll. It is the third Linux kernel LPE with a working public exploit in two weeks. The patch has been in mainline since April 24 but sat unannounced for 70 days.