Continue reading the full briefing.
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch. The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first…
Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.
What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.
Operational focus: Check supported builds, update installation, restart state, and the current running version.
What’s new in Microsoft Security: July 2026
This month’s updates help security and IT teams secure their AI environments, use AI to defend, and strengthen the foundations that AI-powered operations depend on. The post What’s new in Microsoft Security: July 2026 appeared first on Microsoft Security Blog.
Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.
What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.
Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.
Tame Dependabot: Group your updates, slow the cadence, keep security fast
Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.
Why it matters: GitHub Security Blog participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.
CVE-2026-65016: N8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability…
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned…
Why it matters: CVE-2026-65016 is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.
What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.
Operational focus: Check supported builds, update installation, restart state, and the current running version.
Open the original NIST National Vulnerability Database record
Better security starts with better questions
Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems. The post Better security starts with better questions appeared first on Microsoft Security Blog.
Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.
What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.
Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.
Deployment plan
Connect each advisory to supported builds and deployed server roles. Identity and internet-facing systems should move before routine endpoint waves, with restart and EDR health verified afterward.
- Match Microsoft and CISA records to Windows builds and server products in inventory.
- Prioritize identity, SharePoint, Exchange, remote access, and domain-privileged systems.
- Test monthly updates, install promptly, and validate reboot or service restart completion.
- Review EDR health, tamper protection, authentication logs, and privileged group changes.
- Give every patch exception a business owner, mitigation, and expiry date.
Endpoint and server checks
Check build numbers, installed updates, restart state, privileged authentication, EDR coverage, and server-role health.
- Check supported builds, update installation, restart state, and the current running version.
- Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.
- Review privileged access and endpoint telemetry for signs of abuse before and after patching.
Windows team takeaway
A successful Windows update cycle protects identity and public server roles first, proves the new build is active, and keeps every exception visible.
References used in this briefing
- NIST NVD and Microsoft: CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation
- NIST National Vulnerability Database: CVE-2026-65590: N8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox…
- NIST National Vulnerability Database: CVE-2026-65595: N8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to…
- Microsoft Security Blog: CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
- Microsoft Security Blog: What’s new in Microsoft Security: July 2026
- GitHub Security Blog: Tame Dependabot: Group your updates, slow the cadence, keep security fast
- NIST National Vulnerability Database: CVE-2026-65016: N8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability…
- Microsoft Security Blog: Better security starts with better questions
Related briefings
Live Windows Security Brief for July 31, 2026: Microsoft Updates and Identity Risk
Live Windows and Microsoft security coverage for Patch Tuesday, identity systems, SharePoint, Exchange, endpoints, servers, and privilege exposure.…
Read More
Live Windows Security Brief for July 30, 2026: Microsoft Updates and Identity Risk
Live Windows and Microsoft security coverage for Patch Tuesday, identity systems, SharePoint, Exchange, endpoints, servers, and privilege exposure.…
Read More
Live Windows Security Brief for July 29, 2026: Microsoft Updates and Identity Risk
Live Windows and Microsoft security coverage for Patch Tuesday, identity systems, SharePoint, Exchange, endpoints, servers, and privilege exposure.…
Read MoreNeed to add context to this briefing?
Send corrections, security tips, source updates, or collaboration notes through the contact page so the editorial team can review them properly.