Blog

Insights on cybersecurity, managed IT, cloud strategy, and technology leadership from the Infonaligy team.

Bifrost CVE-2026-90898 path from an exposed management API through MCP stdio registration to operating-system command execution

Bifrost CVE-2026-90898: An MCP Endpoint Became a Command Interface

Oct 7, 2026

Bifrost CVE-2026-90898 enables command execution on exposed gateways without management authentication. Learn how to patch and investigate.

Read article

Oct 7, 2026AI Services

Microsoft Copilot Autopilot Is Coming to Your M365 Tenant

Copilot Autopilot gives AI agents their own identity, memory, and workspace inside M365. Three things to prepare before private preview starts this month.

Supabase security audit covering Data API grants, row-level policies, public client keys, secret keys, and cross-tenant testing

Oct 6, 2026CybersecuritySecurity Alerts

16,326 Exposed Supabase Databases: Audit RLS Before Production

UpGuard found 16,326 Supabase databases with readable tables. Learn how to audit RLS, grants, public keys, and historical data exposure.

Oct 6, 2026Security AlertsCybersecurity

Brevo Supply-Chain Attack: Clean Files, Malicious Delivery

Brevo's CDN served malicious JavaScript to 100K+ sites while origin files stayed clean. How the attack worked and what businesses should verify now.

Oct 1, 2026IT Services

Windows 10 ESU Year 2 Doubles to $122: 4 Ways to Respond

Windows 10 ESU Year 2 jumps to $122 per device. Compare paying, upgrading to Windows 11, replacing hardware, or switching to Windows 365 Cloud PCs.

Sep 25, 2026AI Services

Copilot Cowork Billing: How to Control Usage Costs Before They Spiral

Copilot Cowork bills by the task, and uncapped usage can quietly hit $200/user/month. How the credit system works and which admin controls to set now.

Sep 22, 2026Security AlertsCybersecurity

Cisco ISE CVE-2026-76460: Patch ISE, Then Verify Access

Cisco ISE CVE-2026-76460 is under active attack. See fixed releases, investigation steps, and how to verify access after root compromise.

Sep 22, 2026AI ServicesCybersecurity

Google Gemini Workspace Connectors: Govern Access Before Users Connect

Gemini Workspace connectors can retrieve data from seven SaaS platforms. Learn what is enabled by default and how administrators should govern access.

Sep 22, 2026CybersecuritySecurity Alerts

OpenAI Forum Vulnerability: Community Site Reached Internal Tools

A researcher chained six vulnerabilities from OpenAI's community forum to internal dev tools. What the disclosure means for your business.

Sep 16, 2026Cloud Infrastructure

Databricks Workspace Entitlements Changed: Audit Provisioning Now

Databricks now requires explicit entitlements for new workspace principals. Audit SCIM, Terraform, clone groups, and service-principal access.