One Key Unlocked All of Azure — Plus a Sneaky Mac Escape 🔓🍎

Two stories from this week show how a single hidden flaw can quietly hand attackers the keys to the kingdom — whether that kingdom is a giant cloud platform or the Mac sitting on your desk. Here's what happened and why it matters.

🌌 One Master Key to Rule Every Database in Azure

Researchers at Wiz found a way to break out of a locked-down corner of Microsoft's Azure Cosmos DB — one of the world's biggest cloud databases — and walk away with a platform-wide “master key.” That single key could unlock any customer's database, including Microsoft's own internal systems powering things like Entra ID, Teams, and Copilot.

What makes this scary is that even private, network-isolated databases were exposed, because the very component meant to keep everyone separated was the part that got compromised. The good news: there's no sign anyone but the researchers ever used it, and Microsoft pushed a fix within 48 hours and rebuilt the system to remove the master key entirely. The bigger lesson for any business living in the cloud — you're trusting your provider's walls to hold, and it pays to know how they're tested.

Read more →

🍎 A Clever Trick to Slip Out of Apple's Sandbox

Macs run risky apps inside a “sandbox” — a padded room that stops a misbehaving program from touching the rest of your computer. A researcher discovered that an app could ask the system for a slightly friendlier set of rules, use that opening to reach your home folder, tweak a settings file, and quietly launch Terminal to break free of the sandbox completely.

In plain terms: a malicious or hijacked app could escape its safety cage and start poking around your files and system. Apple has patched the hole in macOS 26.3, so the fix here is refreshingly simple — make sure your Mac is updated to 26.3 or later, and don't sit on those update reminders.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.