Azure API Connections flaws enable cross-tenant compromise of backends

🕵️ RESEARCH & DEEP DIVES

• Azure API Connections flaws enable full cross-tenant compromise of connected backends
  Researchers found five vulnerabilities in Azure API Connections that let anyone fully compromise other tenants' connections and their backends.

  • Affects Azure Logic Apps API Connections and any connected backend, including Key Vault, Azure SQL, Jira, and Salesforce.
  • API Connections let an attacker operate on a victim's connection and use its configured token against the backend service.
  • Attacks use ARM REST API DynamicInvoke and /extensions/proxy/ endpoints to reach the shared API Management instance, with path traversal to reach other connections.
  • After Microsoft blacklisted DynamicInvoke paths, four undocumented sibling functions (e.g. DynamicList) remained reachable and exploitable the same way.
  • The researcher earned $200,000 in bounties and presented the findings at Blue Hat Asia 2026.
  Sources 📎 Coverage: binsec.no · 👁 via r/netsec

• TIKTOUK toolkit harvests AWS, SMTP and API credentials from exposed WordPress backups
  LevelBlue researchers exposed the TIKTOUK credential-collection toolkit that mines exposed WordPress backups and JavaScript for cloud and email credentials.

  • Applies to WordPress operators, including sites running WP Mail SMTP, Easy WP SMTP, and FluentSMTP plugins.
  • A leaked TIKTOUK control panel held ~50,000 real server-side credentials across ~37,000 domains, including hundreds of validated active AWS keys.
  • Toolkit uses two Python components (wp2s_poll.py, wp2s_crack.py) and a Go crawler (jscrawl-amd64) coordinated by a central HTTP hub.
  • It probes WordPress REST batch endpoints with a malformed http://: URL, retrying JSON requests as multipart after HTTP 403 responses.
  • The collector fetches wp-config.php.bak, .env, .git/config, backup.sql, and wp-content/debug.log, and decrypts SMTP plugin settings using keys from leaked config files.
  • The JavaScript crawler scans client-delivered scripts for SendGrid, Anthropic, Amazon Bedrock, and AWS credential patterns.
  • Probing overlaps with CVE-2026-60137 and CVE-2026-63030, affecting WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2; exploitation was not demonstrated live.
  • IOCs include SHA-256 hashes of the three components, IPs 193.32.162[.]134, 195.178.110[.]209, 31.56.58[.]59, and endpoints /v1/ingest and /api/crack/report.
  Sources 📄 Source: levelblue.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Session cookie flaw in yard management platform bypasses Entra ID MFA, impersonates 95 users
  Resecurity found a custom session-cookie flaw that let unauthenticated attackers impersonate 95 employee accounts in a yard management platform without passwords or MFA.

  • Affects a supply-chain yard management platform using Entra ID SSO and MFA; the flaw is in the app's custom session layer, not Entra ID itself.
  • The cookie was signed with a hard-coded HMAC-SHA256 secret equal to the cookie name ("session_secret_example") and carried the user's publicly exposed CUID database identifier as payload.
  • CUIDs were obtainable from /api/v1/auth/me, user-directory APIs, and createdBy/updatedBy fields; /api/v1/auth/me also exposed the user's Entra refresh token.
  • Researchers forged sessions for 95 of 241 tested user IDs, including administrators, and a forged admin session performed a state-changing API request; an unauthenticated Swagger interface at /api-docs/ exposed a 251-route API surface.
  • The forged cookie worked on both API and administrative application hosts, bypassing SSO, MFA, RBAC, and password protections (MITRE ATT&CK T1550.004).
  Sources 📄 Source: resecurity.com · 📎 Coverage: gbhackers.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Relapse jailbreak unlocks PS5 firmware up to 13.60; Sony ships firmware 14.00 security update
  A new public PS5 jailbreak called Relapse works on firmware 7.00–13.60, prompting Sony's firmware 14.00 security update.

  • Applies to PS5 and PS5 Pro consoles running firmware 7.00 through 13.60; consoles updated to firmware 14.00 are outside the exploit's supported range.
  • Relapse is a tethered exploit chain that targets a long-known WebKit vulnerability in the PS5 browser, then escalates via a kernel flaw to gain kernel read/write access and run unsigned code and homebrew payloads like etaHEN.
  • The jailbreak enables homebrew, emulators (including Switch emulation), unofficial 60 fps mods, and an ELF loader for arbitrary code; it must be re-run after every restart and the browser stage may need several attempts.
  • Developers warn of system instability, crashes, data loss, and PlayStation Network account bans; Sony has not publicly described specific Relapse fixes in firmware 14.00.
  • Sony provides no official downgrade path, so consoles updated to 14.00 cannot return to a vulnerable firmware version.
  Sources 📄 Source: github.com · 📎 Coverage: arstechnica.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

• 📄 Source for Crypto Scammers Hijack Microsoft's Official X Account to Promote Fake Clippy Token — theverge.com

• 📄 Source for Dell patches two CVSS 10 CSM flaws allowing full admin takeover of storage arrays — dell.com