Cloud Administration Security
The latest Cloud Administration Security coverage — news, analysis, and updates from the WindowsNews.AI desk.
One DHCP Lease Can Change Your Windows 11 DNS and Routes Without You Knowing
A Wireshark experiment reveals that DHCP can reconfigure Windows 11's DNS servers, search domains, and routing tables beyond just IP assignment. Users should audit DHCP-delivered settings to avoid unintended network changes, and admins need to secure DHCP scopes to prevent misconfigurations.
Azure Machine Configuration Now Audits Linux Against CIS Benchmarks — No Scripts Required
Microsoft has brought native CIS Benchmark auditing for Linux into Azure Machine Configuration, letting Azure VM and Azure Arc administrators assess compliance directly through Azure Policy without third-party scanners. The generally available capability supports custom rule selection, exports policy-as-code JSON, and provides per-rule evidence through Guest Assignments and Resource Graph. It’s audit-only, so admins need to plan manual remediation, but the integration unifies hybrid-server compliance monitoring under a single control plane.
CosmosEscape Flaw Fixed: What Azure Cosmos DB Users Need to Know Despite 'No Action Required'
Microsoft has patched CosmosEscape, a cross-tenant vulnerability in Azure Cosmos DB that could have allowed attackers to access other customers' databases. The fix was provider-side, with no customer action required, but experts advise reviewing logs and hardening security measures to mitigate any undetected exploitation.
Critical File Upload Flaw in OpenBlue Employee Puts Facilities at Risk Despite Low Score
CISA's July 30 advisory details three vulnerabilities in Johnson Controls OpenBlue Employee, including an unrestricted file-upload bug that could let attackers compromise facility management systems. While the CVSS score is just 2.4, the software's presence in critical infrastructure makes immediate action essential. Windows administrators need to contact the vendor for updates and harden their deployments.
Hackers Are Locking Water Plant Operators Out of Their Own PLCs—CISA Issues Urgent Disconnect Order
CISA issued an urgent alert on July 30, 2026, warning water utilities that threat actors are increasingly targeting internet-exposed programmable logic controllers, locking out operators and forcing boil-water notices. The agency calls for immediate disconnection of all exposed PLCs and provides guidance on securing remote access, password protection, and recovery.
Microsoft Flags Azure Cosmos DB RCE Vulnerability; Here's What You Need to Do Now
On July 30, 2026, Microsoft published a security advisory for CVE-2026-66803, a remote code execution vulnerability in Azure Cosmos DB. The advisory lacks technical details, forcing organizations to take proactive defense measures while awaiting further guidance. This article explains the known facts, practical impacts for different users, and a step-by-step hardening checklist.
What Windows 11's DNS Over HTTPS Setting Actually Does (and Doesn't Do) for Your Privacy
Windows 11 has included DNS over HTTPS for years, but a recent how-to guide has reignited interest. We explain exactly what the setting does, how to enable it, and why it isn't a substitute for a VPN. The feature encrypts domain name lookups, preventing ISPs from logging which sites you visit, but it does not hide your overall internet traffic. We cover step-by-step setup, browser conflicts, enterprise caveats, and the history of DNS encryption.
Apple's Android Apps Every Windows User Should Know — Security, Switching, and Surprise
Apple maintains three little-known Android apps that fill specific needs: Tracker Detect for manual AirTag scanning, Move to iOS for switching phones, and Apple Music Classical for enhanced classical streaming. While Android now offers built-in tracker alerts, each app still has practical value for Windows users who use Android or plan to move to iPhone.
Galaxy S25, S24 Ultra Owners Hit by Severe Battery Drain After July Security Patch
Samsung's July 2026 security patch for Galaxy S25 Ultra and S24 Ultra is causing severe battery drain, overheating, and slower charging for some users. The culprit may be a stuck WhatsApp backup process, but the root cause likely involves the firmware itself. Owners can troubleshoot by checking battery usage and updating apps, while Samsung has not yet acknowledged the issue.
Watchfire Firmware Patches Contain Plaintext RSA Keys, CISA Urges Immediate Updates
CISA has warned that Watchfire digital sign controllers shipped firmware patches containing plaintext RSA private keys and certificates. The high-severity flaw, CVE-2026-5846, allows authenticated attackers to push malicious firmware and seize control. Affected BC550, BC750, BC760, and BC760DC controllers must be updated to specific patch levels immediately.
CISA Flags Root-Access Backdoor in Toptech Loading-Bay Controllers — Immediate Segmentation Required
CISA has issued a critical advisory for Toptech Systems RCU II+ and Multiload II+ industrial controllers, warning that an unauthenticated network service exposes a debug interface with full root access to the embedded Linux system. The vulnerability requires immediate network segmentation and remediation via Toptech’s removal tool or a firmware update. Windows administrators in OT environments are urged to verify that these controllers are isolated from corporate networks to prevent lateral movement.
No Fix for CVE-2026-13584—Segment Your Mitsubishi CC-Link IE TSN Network Now
CISA published an advisory on July 30, 2026, flagging a high-severity protocol flaw (CVE-2026-13584) in Mitsubishi Electric’s CC-Link IE TSN that will not be patched. The vulnerability lets adjacent-network attackers tamper with control traffic, risking denial-of-service and incorrect equipment operation across a massive range of industrial devices. Network segmentation and physical security are the only mitigations.
MikroTik RouterOS Flaw: Downgraded Accounts Retain API Access, Exposing WireGuard Keys
CISA's advisory for CVE-2026-14227 warns that downgrading a MikroTik RouterOS user's permissions does not immediately end existing API sessions, potentially allowing continued access to sensitive data such as WireGuard private keys. Administrators must manually log out users when their roles change and secure API interfaces until MikroTik provides a permanent fix.