In today’s cybersecurity news…
Microsoft to block unauthorized scripts in Entra ID logins with 2026 CSP update
Microsoft plans to strengthen Entra ID security by blocking unauthorized script injection attacks starting in late 2026. The update, part of its Secure Future Initiative, applies a stricter Content Security Policy to browser-based sign-ins at login.microsoftonline.com, allowing scripts only from trusted Microsoft domains. This aims to prevent cross-site scripting (XSS) attacks and stop any injected or unauthorized code from running during authentication. External ID sign-ins won’t be affected. Microsoft urges organizations to test their sign-in flows early and avoid browser extensions or tools that inject scripts, recommending they switch to alternatives that do not modify the Entra sign-in experience.
New legislation targets scammers that use AI to deceive
This new bipartisan bill is called The AI Fraud Deterrence Act. Introduced by Reps. Ted Lieu, D-Calif., and Neal Dunn, R-Md., it would increase the criminal penalties for committing fraud and impersonation with the assistance of AI tools such as convincing fake audio, video or texts. The total potential fines incurred for mail fraud, wire fraud, bank fraud, and money laundering would all be increased to between $1-2 million, with new language specifying that using AI-assisted tools carries a maximum prison sentence of 20-30 years. Meanwhile, scammers who use AI to impersonate government officials can be fined up to $1 million and spend 3 years in prison.
ASUS firmware patches critical AiCloud vulnerability
ASUS has released firmware to address nine security vulnerabilities, all of which have CVE numbers, with one, a critical authentication bypass, having a CVSS score of 9.2. The nine numbers are available in the shownotes to this episode. They affect routers with AiCloud enabled, which is a remote access feature built into many ASUS routers to allow devices to function as personal cloud servers for remote media streaming and cloud storage. According to the company’s advisory, the 9.2 vulnerability “can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.”
OpenAI cuts off Mixpanel after analytics leak exposes API users
OpenAI announced that a data breach at its former analytics provider, Mixpanel, may have affected users of its API platform, though regular ChatGPT users are generally not impacted. Mixpanel discovered the breach on November 9 and shared details with OpenAI on November 25. Exposed data includes profile information such as names, email addresses, approximate locations, system details, and account IDs. OpenAI has since removed Mixpanel from its systems, begun notifying affected users, and launched broader security reviews of all vendors. The company reports no evidence of impact beyond Mixpanel’s environment and emphasizes its commitment to transparency and strong security standards.
Huge thanks to our episode sponsor, KnowBe4
That’s why KnowBe4’s Human Risk Management platform allows you to measure, quantify and actually reduce human risk across your organization.
With AI-powered risk scoring, automated coaching and reporting, HRM+ helps you surface your highest risk users and reduce the risk of data breaches and cyberattacks proactively.
Ready to move from awareness to action? Request a demo of HRM+ today at knowbe4.com.
Cyber issue hits three London councils with shared IT services
The impacted incidents are the Royal Borough of Kensington and Chelsea, Westminster City Council, and the Borough of Hammersmith and Fulham, which house some of London’s wealthiest districts. Some of the services used by these councils share the same IT system, which has now been taken down as a precaution. In relation to it is still too early to attribute the incident to any threat actor or to confirm whether any data has been compromised.
Dartmouth College suffers breach through Oracle EBS campaign
The Ivy League school located in New Hampshire has suffered a breach that has impacted more than 35,000 people across multiple states as a result of a campaign involving Oracle E-Business Suite (EBS). Dartmouth officials determined that “an unauthorized actor took certain files between August 9 and August 12 of this year, with the leaked data consisting of Social Security numbers, financial account data and names.
Exchange Online outage blocks access to Outlook mailboxes
If you have had trouble accessing your Outlook mail recently, you’re not alone. Microsoft is looking into an Exchange Online service outage that is preventing customers from accessing their mailboxes using the classic Outlook desktop client. This outage started on Tuesday and, according to user reports on DownDetector, it also caused server connection and login issues. The outage affected users in the Asia Pacific and North America regions who were attempting to connect to their Exchange Online mailbox using the classic Outlook experience.” Microsoft has not yet said how many users had been affected.
Security keys may prompt for PIN after recent updates
Also on Tuesday, Microsoft warned users that FIDO2 security keys “may prompt them to enter a PIN when signing in after installing Windows updates released since the September 2025 preview update. This is an intentional change, Microsoft says, to comply with WebAuthn specifications, which “dictate how authentication methods such as PINs, biometrics, and hardware security keys should handle user verification requests.” They added, “after installing the Windows update of September 29, you might be required to create a PIN to sign in with a security key, even if a PIN was not required or set during your initial registration.”