IT News Roundup: Januscape KVM Escape, Accenture Breach, Google Cloud Growth - July 25, 2026

This week in IT news, a decades-old Linux kernel vulnerability has raised alarms in the virtualization community, a major consulting firm confirmed a significant data breach, and the cloud infrastructure market continues its rapid shift driven by AI demand. Here are the most significant stories from the past few days.

Januscape: 16-Year-Old Linux KVM Bug Enables VM Escape on Intel and AMD

Security researcher Hyunwoo Kim (known as @v4bel) has disclosed CVE-2026-53359, dubbed "Januscape", a use-after-free vulnerability in the Linux kernel's KVM hypervisor that allows code running inside a guest virtual machine to corrupt host kernel memory. The flaw resides in the shadow memory management unit (MMU) code shared by both Intel VMX/EPT and AMD SVM/NPT virtualization extensions and has existed in the kernel for approximately 16 years.

The vulnerability enables guest-to-host VM escape, which means a compromised virtual machine could potentially break out and execute arbitrary code on the underlying host system. This poses a critical risk for cloud providers, multi-tenant hosting environments, and anyone running untrusted workloads in KVM-based virtual machines. Google paid a $250,000 bug bounty for the discovery. The vulnerability is closely related to an earlier, already-patched bug in the same shadow-paging code path (CVE-2026-46113), which was addressed in May 2026.

System administrators running KVM-based virtualization are urged to patch both CVE-2026-53359 and CVE-2026-46113 immediately, or disable nested virtualization features as a temporary mitigation. This is Kim's third Linux kernel exploit disclosure in roughly two months, following Dirty Frag in May 2026.

Source: The Hacker News | Security Affairs

Accenture Confirms Security Incident After Hacker Claims 35 GB Data Breach

IT services and consulting giant Accenture has acknowledged a security incident after a threat actor operating under the alias "888" posted on a cybercrime forum claiming to have stolen approximately 35 GB of data from the company. The forum post, dated July 6, 2026, states that the stolen data includes source code, RSA keys, SSH keys, Azure Personal Access Tokens (PATs), Azure Storage access keys, configuration files, and other sensitive material.

Accenture confirmed the breach to media outlets, describing it as an isolated incident and stating that the company remediated the root cause with no indication that customer data was compromised. The leaked data reportedly includes .env files and credential material that could potentially enable further attacks if the stolen access keys remain valid.

The incident underscores the ongoing risk to large consulting and managed service providers, which often hold access credentials to multiple client environments. Security researchers have warned that leaked configuration files and access tokens from such breaches can cascade into secondary compromises if not rotated promptly.

Source: CyberSecurityNews | CRN

Microsoft Cuts 4,800 Jobs in AI-Driven Restructuring, Overhauls Xbox Division

Microsoft announced approximately 4,800 job cuts, representing roughly 2.1% of its global workforce, as part of a broader restructuring driven by the company's massive investment in AI infrastructure. The cuts come as Microsoft reported record capital expenditure of $190 billion for 2026, with the company seeking to balance efficiency amid slowing cloud growth in non-AI segments.

The layoffs are heavily concentrated in the Xbox gaming division, where 3,200 roles will be eliminated and five game studios are set to be divested. Additional cuts affect commercial sales and other business units. Microsoft has stated that the eliminated roles will not be replaced by AI, framing the reductions as a strategic realignment rather than direct automation.

The announcement adds to growing concerns in the tech industry about the relationship between AI investment and workforce stability. Microsoft's moves follow similar restructuring at other major technology companies that are redirecting resources toward AI infrastructure and services while trimming traditional operations.

Source: Reuters | TechCrunch

Google Cloud Surges 82% Year-Over-Year, $514 Billion Backlog Signals AI Infrastructure Boom

Alphabet reported that Google Cloud revenue reached $24.8 billion in Q2 2026, representing an 82% year-over-year increase that surpassed analyst expectations of 64% growth. The cloud segment's momentum is largely driven by enterprise adoption of AI and machine learning workloads, with Google's custom TPU chips and AI platform attracting significant demand.

More notably, Alphabet disclosed a $514 billion contract backlog for Google Cloud, signaling years of locked-in AI infrastructure demand from enterprise customers. The company also raised its 2026 capital expenditure guidance to $205 billion, reflecting continued heavy investment in data center capacity and networking infrastructure to support AI workloads.

According to Synergy Research Group's cloud infrastructure market share report for Q1 2026, AWS holds 28% of the global cloud infrastructure services market, Microsoft Azure holds 21%, and Google Cloud holds 14%. Google's faster growth rate suggests the competitive landscape is shifting, particularly in the AI infrastructure segment where early movers may gain lasting advantages.

Source: Tech Insider | CNBC Technology

Pentagon Awards Oracle Nearly $7 Billion Software Consolidation Contract

The U.S. Department of Defense announced a nearly $7 billion, up-to-10-year Enterprise Software Agreement with Oracle to consolidate the department's on-premises software licenses into a single contract. The deal, negotiated by the Department of the Navy, covers Oracle products and services used across the DoD, Coast Guard, and Intelligence Community.

The contract includes a five-year base period with a five-year option period and is expected to yield approximately $441 million in savings through consolidated purchasing, according to the DoD CIO. This is the latest move by the Pentagon's technology leadership to reduce costs by eliminating fragmented software procurement across military branches.

The deal marks a significant shift for Oracle, whose business has largely pivoted toward cloud services in recent years. The contract represents one of the largest government software agreements in recent memory and highlights the continued importance of on-premises enterprise software in government and defense IT environments.

Source: CNBC | Defense Scoop

Gartner Forecasts AI Platforms and Models Market to Reach $64 Billion in 2026

Gartner released a forecast projecting that worldwide end-user spending on AI models and platforms will total $64 billion in 2026, up 63.4% from $39 billion in 2025. The research firm notes that spending on generative AI models alone is forecast to grow 117% year-over-year, while AI platform spending will rise 36.9%.

The $64 billion figure covers a relatively narrow slice of total AI spending. Gartner put overall AI spending for 2026 at $2.59 trillion when including AI-optimized infrastructure, semiconductors, and professional services. The rapid growth is being driven by enterprise organizations moving beyond AI experimentation into production deployments.

Gartner advised that buyers are increasingly prioritizing cost efficiency, performance benchmarks, governance capabilities, and measurable business value when selecting AI platforms and models. The forecast underscores the accelerating pace at which AI is becoming a core infrastructure investment for organizations across industries.

Source: Gartner

Debian 13.6 Released with 120 Security Fixes and Secure Boot Updates

The Debian Project announced Debian 13.6 "Trixie", the sixth point release of its stable distribution, on July 11, 2026. The update bundles 120 security patches and 124 miscellaneous bug fixes accumulated since the previous revision, with advisories covering packages including the Linux kernel, Nginx, Redis, FFmpeg, Thunderbird, curl, Apache2, and QEMU.

A notable focus of this release is UEFI Secure Boot certificate management, as the industry navigates a major certificate authority transition. The update addresses an expired Secure Boot certificate that could affect system boot functionality on affected machines. Additionally, Debian 12.15 was announced as the final point release for the "Bookworm" oldstable distribution.

For homelabbers and system administrators running Debian-based systems, this update is recommended as it addresses a significant number of security vulnerabilities across critical infrastructure packages. Users should review the security advisories for details on affected packages and apply the updates through their package managers.

Source: Debian News | Linuxiac