The October 2026 Security Update Review
ZDI's October 2026 review lists dozens of critical Microsoft Office, Azure, Exchange, and Windows flaws.
74
Product
Azure App Service
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenSep 9, 2026
- Last mentioned29d ago
Timeline
4 articles · newest firstStorm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
Microsoft says Storm-3168 used stolen Azure identities to delete cloud resources within about seven minutes.
74
Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft says Storm-3168 used compromised Azure service principals to delete cloud resources and collect storage keys.
76
Threat Matrix: Mapping threats across cloud web applications
Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.
35
Related CVEs
by mentions- CVE-2026-1050162%9.8Heap buffer overflow in Microsoft QUIC allows remote code execution
- Use-after-free remote code execution in Microsoft QUIC
- CVE-2026-214131%9.8A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b
- Heap buffer overflow RCE in Microsoft Outlook
- Heap buffer overflow in Microsoft Excel enables network RCE
- Use-after-free remote code execution in Microsoft PowerPoint
- Heap Buffer Overflow in Microsoft Office Visio
- Out-of-bounds write RCE in Microsoft Windows PDF
- Network stack buffer overflow RCE in Microsoft Exchange
- Incorrect authorization RCE in Active Directory Domain Services
Appears with
- Microsoftvendor · 4
- Microsoftorganization · 3
- Storm-3168threat actor · 2
- Azure Backupproduct · 2
- Azure Key Vaultproduct · 2
- Azure Storageproduct · 2
- Azure SQLproduct · 2
- Azure Site Recoveryproduct · 2
- Azureproduct · 2
- Microsoft Outlookproduct · 1
- Microsoft SharePointproduct · 1
- Microsoft Exchange Serverproduct · 1
- Active Directory Federation Servicesproduct · 1
- JADEPUFFERmalware · 1
- Microsoft Excelproduct · 1
- Azure Functionsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.