Cyber Brief: Azure credential attacks, GitLab flaw, AI scanning errors and modem vulnerabilities

Today's stories highlight how security challenges continue to emerge across cloud infrastructure, open-source platforms, operational technology and emerging AI systems. From compromised credentials enabling access to corporate Azure tenants, to a critical vulnerability in widely-used GitLab repositories, a false shoplifting accusation caused by AI facial recognition at a UK supermarket, and a modem vulnerability affecting millions of Android devices, the common thread is the importance of understanding where risk sits in systems organisations rely on every day. Each of these developments offers practical lessons about credential hygiene, patch management discipline, the operational limits of automated decision-making, and supply chain visibility.

Compromised credentials used to access corporate Azure tenants

The Register reports that a threat actor is advertising millions of records allegedly stolen from corporate Microsoft Azure tenants belonging to organisations including McDonald's, Vodafone, Tata Consultancy Services (TCS) and Kyndryl. Security researchers investigating the claims have pointed to compromised credentials as the likely access method, with the attacker appearing to have gained entry to Azure environments through stolen or reused authentication details. The data being advertised includes email addresses, internal documents, configuration details and other corporate information that could be used for further targeting or social engineering. The scope of the compromise suggests the attacker may have systematically targeted Azure tenants where credential security was weak or where multi-factor authentication was not enforced across administrative accounts.

For UK businesses using Azure or any cloud platform, this is a reminder that perimeter security increasingly depends on identity and access management. Compromised credentials remain one of the most common initial access methods for attackers, and cloud environments are particularly attractive targets because a single set of credentials can provide access to large volumes of sensitive data, configuration settings and connected services. Organisations that have not enforced multi-factor authentication across all administrative and privileged accounts, or that allow legacy authentication protocols to remain active, are at significantly higher risk. The operational impact of a credential-based compromise can extend well beyond data theft, potentially allowing attackers to modify configurations, create backdoor accounts, or move laterally into connected on-premises systems.

Why it matters

For UK businesses, this is a prompt to review whether multi-factor authentication is enforced across all Azure administrative accounts, whether legacy authentication protocols have been disabled, and whether conditional access policies are being used to restrict access based on location, device compliance and risk signals. It is also worth checking whether privileged accounts are being monitored for unusual sign-in activity and whether access reviews are being conducted regularly to remove stale or unnecessary permissions.

Source: The Register

Critical GitLab vulnerability allows unauthenticated deletion of public projects

The Hacker News reports that GitLab has released security updates to address a critical vulnerability, tracked as CVE-2026-19478, that could allow an unauthenticated attacker to remotely modify or delete public projects and user data under certain conditions. The flaw, which has been assigned a CVSS score of 9.4, affects both GitLab Community Edition and Enterprise Edition. The vulnerability exists in GitLab's GraphQL API and could be exploited without requiring authentication, meaning any attacker with network access to a vulnerable GitLab instance could potentially target public repositories. GitLab has released patches for affected versions and is urging organisations to apply the updates immediately. The flaw highlights the risks associated with API security in widely-used development platforms, where a single vulnerability can expose critical code repositories and development workflows.

For UK organisations using GitLab, whether self-hosted or cloud-based, this vulnerability represents a significant risk to code integrity, intellectual property and development continuity. Public repositories are often used for open-source projects, documentation, internal tools and shared libraries, and the ability for an unauthenticated attacker to modify or delete these projects could disrupt development pipelines, introduce malicious code, or cause permanent data loss. Even organisations that primarily use private repositories may have public projects for community engagement, API documentation or open-source contributions. The operational impact of such an attack could include loss of version history, disruption to CI/CD pipelines, reputational damage and the need for time-consuming recovery efforts from backups.

Why it matters

For many organisations, this is a prompt to review whether GitLab instances have been updated to the latest patched versions, whether public repositories contain sensitive or business-critical code that should be moved to private repositories, and whether backup and recovery processes for GitLab data are tested and reliable. It is also worth checking whether API access is being monitored for unusual activity and whether rate limiting and access controls are configured appropriately.

Source: The Hacker News

Sainsbury's pauses AI facial recognition after false shoplifting accusation

The Guardian reports that Sainsbury's has paused the use of AI-powered facial recognition technology in one of its stores after a customer was wrongly identified as a shoplifter and ejected from the shop. The customer, Matt Arnold, described feeling embarrassed, mortified and humiliated by the experience. Sainsbury's uses Facewatch, a facial recognition system designed to identify known shoplifters and alert store staff when they enter a premises. The supermarket chain has stated that the incident was caused by human error rather than a failure of the technology itself, but has paused the system at the affected store while it reviews what happened. The incident highlights the operational and reputational risks associated with automated decision-making systems, particularly when they are used in customer-facing environments where errors can cause significant harm and distress.

For UK businesses considering or already using AI-powered surveillance, access control or fraud detection systems, this incident is a reminder that automation does not remove the need for human oversight, clear escalation processes and the ability to quickly correct mistakes. Facial recognition and similar biometric systems are increasingly being deployed in retail, hospitality, transport and corporate environments, but they carry significant risks if they are not implemented with appropriate safeguards. A false positive in a security system can cause reputational damage, legal liability, customer complaints and loss of trust. The operational challenge is ensuring that staff understand how the system works, know how to handle alerts appropriately, and have clear processes for verifying automated decisions before taking action that affects individuals.

Why it matters

For UK businesses, this is a prompt to review whether AI-powered decision-making systems are being used in ways that could affect individuals, whether there are clear processes for human review and override of automated decisions, and whether staff are trained to handle alerts appropriately. It is also worth checking whether there are clear complaints processes, whether data protection impact assessments have been completed, and whether the use of biometric data complies with UK GDPR and Information Commissioner's Office guidance.

Source: The Guardian

UNISOC modem vulnerability enables remote code execution via video calls

Infosecurity Magazine and Dark Reading report that security researchers have discovered a vulnerability in UNISOC modems that could allow an attacker to achieve kernel-level code execution on Android devices by exploiting a flaw during video call handling. The vulnerability requires the attacker to deliver a specially crafted payload and persuade the victim to answer a video call. UNISOC is a Chinese semiconductor company whose modems are used in millions of Android devices, particularly in budget and mid-range smartphones sold globally. The flaw affects the modem firmware, which operates at a privileged level within the device and is responsible for handling cellular communications. Successful exploitation could allow an attacker to gain deep access to the device, potentially enabling surveillance, data theft or further compromise of connected networks.

For UK organisations that issue mobile devices to staff, or that allow personal devices to connect to corporate networks and services, this vulnerability highlights the importance of understanding the supply chain and component-level security of the devices being used. Modem vulnerabilities are particularly concerning because they operate below the main operating system and can be difficult to detect or remediate. Devices using affected UNISOC modems may not receive timely security updates, particularly if they are older models or from manufacturers with poor patch management track records. The operational risk is that compromised devices could be used to access corporate email, cloud services, VPNs or internal applications, potentially providing attackers with a foothold into the wider organisation.

Why it matters

For many organisations, this is a prompt to review whether mobile device management policies include requirements for devices to receive regular security updates, whether older or unsupported devices are being phased out, and whether network access controls limit what compromised devices could reach. It is also worth checking whether staff are aware of the risks of answering unexpected video calls from unknown numbers, and whether there are clear processes for reporting suspicious activity on corporate or personal devices used for work.

Source: Infosecurity Magazine

Today's Key Actions

• Review whether multi-factor authentication is enforced across all Azure administrative accounts, whether legacy authentication protocols have been disabled, and whether conditional access policies are being used to restrict access based on location, device compliance and risk signals.
• Check whether GitLab instances have been updated to the latest patched versions, whether public repositories contain sensitive or business-critical code that should be moved to private repositories, and whether backup and recovery processes for GitLab data are tested and reliable.
• Review whether AI-powered decision-making systems are being used in ways that could affect individuals, whether there are clear processes for human review and override of automated decisions, and whether staff are trained to handle alerts appropriately.
• Check whether mobile device management policies include requirements for devices to receive regular security updates, whether older or unsupported devices are being phased out, and whether network access controls limit what compromised devices could reach.
• Ensure that ownership of identity management, patch management, AI governance and mobile device security is clearly assigned and that these areas are being reviewed regularly as part of routine security operations.

Secarma Insight

Good security practice does not depend on reacting to every new vulnerability or incident with urgency, but on having the disciplines already in place that reduce the likelihood and impact of compromise. Multi-factor authentication, regular patching, clear governance of automated systems, and visibility into the devices connecting to your network are not emergency measures, they are the foundations of resilient security. The organisations that manage these areas well are the ones that can respond calmly and effectively when new risks emerge, because they already know where their controls are, who owns them, and how to verify they are working. That confidence comes from treating security as a continuous operational discipline rather than a series of reactive responses.