Leaked Screenshots Reignite Questions Over Who Can Access U.S. Government Data in Microsoft’s Cloud
Screenshots shared by an anonymous whistleblower appear to show a Microsoft engineer based outside the United States being approved to view logs from a U.S. government cloud environment...
Microsoft Tells Enterprises to Treat AI Agents Like Potential Insider Threats
Microsoft is urging organizations to stop assuming AI agents will always behave as intended, warning that agents with broad access to company systems can act unpredictably or be...
Three Active Directory Flaws Can Bypass Windows Security Controls
Microsoft has patched three remotely reachable Active Directory security-feature bypass vulnerabilities. Although no active exploitation has been reported, defenders should prioritize domain controllers because identity infrastructure sits at...
Microsoft Patches Windows Shell Zero-Day Used to Evade Download Warnings
Microsoft has fixed CVE-2026-96951, an actively exploited Windows Shell flaw that can bypass Mark of the Web protections. Organizations should prioritize the October 2026 update while reinforcing controls...
Microsoft’s October Patch Tuesday Fixes Over 1,100 Flaws and Debuts a New Way to Triage Them
Microsoft's October 2026 Patch Tuesday addressed 1,118 vulnerabilities, one of its largest releases yet, and introduced an experimental 'risk cohort' framework that groups flaws by the shared exposure...
Unsigned JWT Flaw Opened Microsoft Analytics Service to Administrator Access
A missing signature check in Microsoft’s internal Titan analytics service allowed a forged token to obtain administrator privileges and query connected databases. Microsoft closed the public endpoint after...
N0va Phishing Kit Hijacks Real Microsoft Logins to Steal Session Tokens
A new phishing kit called N0va abuses legitimate device-code authentication flows for Microsoft, Google, and other trusted services to steal access and refresh tokens rather than passwords. The...
Microsoft’s September Patch Wave Fixes 973 Flaws and Two Exploited Zero-Days
Microsoft’s September 2026 security release addresses 973 vulnerabilities across Windows, Office, SQL Server and other enterprise products. Two privilege-escalation zero-days are already being exploited, making rapid testing and...