[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (MSRC cloud-service CVE, released Nov 5); no customer action required; not exploited per Microsoft

Microsoft discloses a CVSS 10.0 authorization bypass in Entra Device Registration, already fixed in the cloud

  • Microsoft publishes CVEs like this for cloud services to be transparent even when no customer patch exists.
  • Nothing to install. If you want to double-check, review Entra audit logs for unexpected device registrations or device-owner changes from before the fix, but Microsoft reports no exploitation.

Sources: MSRC: CVE-2026-109469 · SANS Stormcast, Nov 9