Wiz says a now-patched flaw in Azure CosmosDB would have let a hacker remotely compromise any of its users; Microsoft has seen "no evidence of customer impact"
THE SO WHAT
A single Cosmos DB flaw that could have exposed any tenant is a reminder that cloud concentration creates correlated security risk, even when patches land quickly. If you’re on managed databases, revisit blast-radius assumptions and make sure your own detection and backup plans don’t assume the provider is infallible.
READ THE SOURCE
MORE FROM THE WIRE
Deep & Emerging TechAmazon researchers link the compromises of four npm packages, including axios, over the past 18 months to the North Korea-linked group tracked as Sapphire Sleet
Four compromised npm packages over 18 months—via social engineering of maintainers—reinforces that your software supply chain risk now includes upstream humans, not just code. Lock down dependency policies, pin and mirror critical packages, and assume popular OSS components are active targets for state-linked actors.
Deep & Emerging TechNIST’s Andrew Regenscheid Explains the Transition to Post-Quantum Cryptography
NIST is now in public education mode on post-quantum crypto, which usually precedes harder timelines and procurement requirements. Inventory where you use public-key crypto—especially in long-lived devices and data—and get a migration plan on paper before your largest customers or regulators force one on you.
Deep & Emerging TechNRL Expands Quantum Research Efforts Across Sensing, Computing and Networking
The US Naval Research Laboratory expanding quantum work across sensing, computing, and networking is a signal that defense is treating quantum as a full-stack capability, not a lab curiosity. Expect more dual-use demand and export sensitivity—if you’re in quantum, align roadmaps with defense-relevant use cases early.
Deep & Emerging TechNHS England admits its paperwork hid that Palantir staff can see identifiable patient data
NHS England’s admission that documentation obscured Palantir staff access to identifiable patient data is a governance failure, not just a PR issue. If you handle sensitive data with external platforms, assume every undisclosed access path will surface—tighten contracts, logs, and comms before regulators or the press do it for you.