Enterprise IT, rewritten in real time.

Field notes on Azure, identity, security and the AI shift, from someone shipping the fixes, not just the takes.

The latest

One Brotli Decoder, Every Windows Build, and Which Systems Are Actually at Risk CVE-2026-111497 touches every Windows version, but 'every system that handles web traffic' quietly overstates your exposure. Here's how to sort your fleet by actual decompression risk and patch in the right order.
Is Your Apache Box One HTTP/2 Request Away From Someone Else’s Shell? CVE-2026-119618 is unauthenticated remote code execution on Apache 2.4.55–2.4.70 with HTTP/2 enabled. The patch shipped yesterday; here's how to audit your fleet tonight and decide who patches first.
I Pulled Exchange Custom Attributes From Graph. Here’s Where It Stops Working. Microsoft Graph finally exposes Exchange custom attributes on synchronized groups, but it's read-only and won't touch your M365 Groups. I spent a morning testing where the new API helps and where you…
The Service-Principal Governance Hack Is Dead. Agents Got Their Own Identity. AI agents used to squat in service principal clothing, ungovernable by access reviews or lifecycle workflows. Microsoft's latest Entra ID Governance update gave them their own identity class, but only some of…
Android Just Turned On Post-Quantum Crypto. Does Anything in Your Identity Stack Actually Break? Hybrid ML-KEM key exchange landed in Android via Conscrypt, designed to fail backwards when your IdP doesn't speak it. The real question isn't what breaks, it's which of your token endpoints are…
I Hunted Every Apache Server in My Azure Estate. Resource Graph Lied to Me. Resource Graph knows you have a VM. It has no idea whether Apache is running on it. When a critical RCE drops, that gap becomes your problem, here's how to inventory exposure…
Three Things That Break When You Pull a Month of Entra Sign-In Logs Your tenant now logs hundreds of thousands of authentication events daily. Here's what breaks when you try to pull all of them, and how to fix it before your next investigation.
Would You Hand a Service Principal to a Model You Can’t Vouch For? Microsoft proved that fewer than ten neuron edits can turn an AI agent into a sleeper, and your service principal comes along for the ride.
Three Things That Broke When Attackers Gave Their Secret-Hunting a Brain Your detection window didn't just shrink, it disappeared. The only way to win the race against autonomous secret-hunting agents is to delete what they're hunting.
Someone You Never Added Is Reading the Thread iOS 27.2.1 shipped less than two weeks after 27.2 to patch an iMessage flaw that let unauthorized parties join group conversations. Here's how to verify every device in your fleet actually took…
Hackers Rode Qubole’s AWS Access Into Customer Accounts, Audit Your Cross-Account Roles Now Between October 14 and 26, attackers with control of a Qubole-owned AWS account used cross-account IAM roles to breach multiple customer environments. The attack window is known, so you can hunt your…
Three Things That Break When Static Web Apps Move to .NET 10 Your Static Web App didn't crash when .NET 8 and 9 support ended today, it just stopped getting security patches. The harder problem: Azure's API can't tell you which apps are exposed,…
Three Things Microsoft Didn’t Replace When It Killed Prioritize My Inbox Microsoft is retiring Copilot's Prioritize My Inbox by March 2027 with no announced replacement, leaving paid users with the free Focused Inbox everyone else already has. Admins have four months to prepare.

Enterprise IT, rewritten in real time.

The latest

Topics