Browse All Security Content (446)

sbaynes outlines how “physical AI” shifts factory automation from pre-programmed instructions to systems that perceive, reason, and act in the real world. The article focuses on agent-assisted operations, scaling patterns across plants and fleets, and the governance and security controls needed when AI decisions have physical consequences.

Alex Weininger introduces the Canvas authoring plugin, which guides GitHub Copilot through the native create-canvas workflow to generate an Azure canvas app based on Microsoft Canvas Toolkit, including a read-only starter and patterns for safe, explicitly scoped Azure operations.

Freddy Dezeure and Sesha Mani explain how frontier AI models are changing vulnerability management, and what CISOs can do to keep patching both fast and correct. The post highlights Microsoft’s use of AI “harnesses” for scanning and triage, and points to Baseline Security Mode and secure-by-default controls to reduce blast radius when patches can’t land in time.

Emanuele Bartolesi shares a practical fix for high CPU/disk usage on Windows 11 when running Claude, Codex, and GitHub Copilot tooling: adding targeted Microsoft Defender Antivirus folder exclusions. The post also calls out the security tradeoff and walks through the exact Windows Security steps to apply exclusions safely.

Allison announces an update to GitHub code scanning that adds visibility into AI Scan for pull requests enablement in the Security Overview coverage view, including enabled/not-enabled counts, per-repo effective status, filter queries, and a new CSV export column for tracking adoption across orgs and enterprises.

Allison announces new GitHub Secret Scanning detectors and a new partner integration, expanding the set of credentials GitHub can identify and help remediate when they’re committed to repositories.

Alex-wdy explains how the Azure AD Graph (graph.windows.net) retirement impacts older Azure CLI and Azure PowerShell versions, and what to check in developer machines, CI/CD agents, runbooks, and container images to avoid identity automation breaking during the phased shutdown after October 6, 2026.

shobhitgarg announces the public preview of Azure Backup v2 for Azure Database for PostgreSQL flexible servers and elastic clusters, outlining the move to snapshot-based physical backups, daily incremental scheduling, long-term retention options, and a new “Restore as Server” flow for faster, more consistent recovery.

Kerim Hanif announces the general availability of Azure Site Recovery for Azure Local, highlighting a new one-page Azure portal wizard for preparing infrastructure, plus key GA improvements like WDAC enforcement-mode support and built-in proxy configuration for regulated and locked-down network environments.

Michelle Zhou introduces ReviewBench, an open benchmark for evaluating AI code review agents using a representative set of GitHub pull requests, a multi-source ground truth process, and calibrated scoring. The post explains how to interpret grounded vs augmented metrics and how teams can submit their own agents to the public leaderboard.

John Edward covers Microsoft’s new self-service onboarding flow for publishing new applications to the Microsoft Entra App Gallery, including built-in validation for SSO and provisioning integrations, submission tracking, and the rollout timeline from public preview to general availability in late 2026.

This week's Security roundup focuses on turning guidance into enforceable defaults across GitHub and Microsoft platforms. On the GitHub side, maintainers get practical hardening with gh-secure, a shift to stateless GitHub App installation tokens (plus a header deprecation deadline), and tighter vulnerability reporting and advisory collaboration APIs, alongside CI controls for Dependabot and quieter scheduled code scanning. We also look at real-world threat tradecraft (Zimbra command injection, RMM abuse, Azure DevOps pipeline pivots, and targeted malware) and the parallel push to secure action-taking AI agents with clear identity, policy enforcement, runtime isolation, and telemetry.

GitHub introduces gh-secure, a one-command tool from the GitHub Security Lab aimed at improving basic repository security hygiene by helping prevent secrets from being leaked into public code, with usage via the Copilot app, Copilot CLI, or GitHub CLI.

Allison announces that GitHub App installation tokens are now issued in a new stateless format by default, and outlines what developers should verify in their integrations to avoid breakages when handling longer tokens and updated validation behavior.

Allison announces changes to npm trusted publishing that reduce supply-chain risk: unvalidated trusted publishing configurations now expire after 48 hours, and GitHub Actions tokens from certain events are rejected for publishing.

Allison announces that npm staged publishing can now create brand-new packages via `npm stage publish`, enabling automated workflows to publish an initial version into a staged queue that must be promoted by a maintainer before it becomes installable.

John Edward explains Microsoft’s 2026 retirement of SharePoint Online’s one-time passcode (SPO OTP) flow and the shift to Microsoft Entra B2B guest accounts for external sharing in SharePoint Online and OneDrive, including what breaks, what stays, and what admins should do before the October–November rollout completes.

Allison announces new read-only fields and filters for the GitHub GraphQL SecurityAdvisory API, making it easier to query advisory metadata (like CVE and NVD timestamps) and filter results server-side for security and compliance integrations.

Allison announces a GitHub Security Advisories update that lets maintainers add confidential comments to repository security advisories, keeping sensitive investigation and coordination notes visible only to users with write access.

Allison announces a public preview REST API that lets you read, add, and edit comments on GitHub repository security advisories, making it easier to automate vulnerability triage notes, export advisory discussions for audits or migrations, and build workflows around advisory discussion activity.

kinfey breaks down what changes when an AI agent can run tools and create side effects, then shows how to put real execution boundaries around those tools using OpenSandbox on AKS with Kata pod VMs, plus a comparison to Azure Container Apps Sandboxes and Dynamic Sessions.

Allison announces daily rate limits for GitHub private vulnerability reports, aimed at reducing bulk and automated submissions while keeping legitimate researcher reports flowing. The update adds per-account caps, repository-level customization, and an allow list for trusted reporters, configured via GitHub Advanced Security settings.

Allison announces structured forms for GitHub private vulnerability reports, adding required fields and optional enforcement (like CWE selection) to improve report quality while keeping existing REST API integrations working unless a custom form is enforced.

Allison announces a change to GitHub code scanning default setup and GitHub Code Quality: weekly scheduled scans now start only after a push or pull request triggers an analysis, reducing unexpected scans on dormant repositories when rolling out security configurations at scale.

Andrea Griffiths shares 10 GitHub Universe 2026 sessions she’s building her agenda around, spanning Copilot agent memory and evals, MCP context and authorization, npm dependency provenance, and supply-chain defenses for GitHub Actions—plus a few talks on JavaScript tooling and building for low-connectivity environments.

Rebekah Midkiff lays out a reference architecture for governing AI agents across multiple Microsoft Entra tenants, combining Agent 365, Entra Agent ID, Microsoft Foundry, Copilot Studio, Purview, and an Azure API Management AI gateway to enforce identity, policy, tool access, and observability at runtime without collapsing tenant boundaries.

Terrell Cox highlights themes from the 2026 Microsoft Digital Defense Report, focusing on how an increasingly interconnected environment changes both attacker workflows and defender practices, including the growing role of AI in social engineering, vulnerability discovery, and enterprise security operations.

Matthew Thomas summarizes findings from the 2026 Microsoft Digital Defense Report for government organizations, highlighting faster attacker timelines, increased phishing and identity compromise, and why resilience now depends on planning for incidents that spread across interconnected partners and essential services.

rickliev outlines Microsoft’s message for TM Forum Innovate Americas 2026: scaling agentic AI in telecom depends on trusted, governed data plus shared operational context. The post connects “agent-ready” data concepts (meaning, provenance, permissions) with Microsoft Fabric capabilities like OneLake, Fabric IQ, and Real-Time Intelligence.

Allison announces an update to npm trusted publishing that lets maintainers opt in to managing dist-tags using short-lived OIDC credentials, reducing reliance on long-lived access tokens for post-release tag changes like promoting versions to latest or updating next and beta.

shashankamalladi announces the general availability of Network Security Perimeter (NSP) metrics and explains how to use Azure Monitor to track allowed/denied access, spot unexpected traffic, and validate access rule changes with dashboards, workbooks, and metric alerts.

Lindsay Myers outlines what to expect from the Microsoft Security track at Microsoft Ignite 2026, including the Security Pre-Day, key session formats, and four themes focused on agentic SOC operations, securing AI and agents, Zero Trust foundations, and data protection with Microsoft Defender and Microsoft Purview.

Kristen Womack recaps the September 2026 Azure Developer CLI (azd) releases, covering extension dependency handling, versioned gRPC extension contracts, new azure.yaml project layering, per-phase concurrency controls for provisioning and deployment, and authentication host connectivity via local socket transports.

Allison announces that GitHub Team organizations can now start self-serve trials of GitHub Advanced Security, making it easier to evaluate GitHub Code Security and GitHub Secret Protection from common org admin entry points.

Mason Torres explains how Hotpatch works for Azure Arc-enabled Windows Server 2025 to reduce restart-driven maintenance windows while still keeping servers current with security updates. The post covers eligibility prerequisites (VBS/VSM, Secure Boot, Hyper-V Gen2), enrollment steps in the Azure portal, and how to manage updates after enrollment.

Microsoft Security Research, Mahesh Mandava and Rajesh Kumar Natarajan break down real-world exploitation of CVE-2026-73570 in Zimbra, including the SNMP command-injection path, post-exploitation tradecraft (web shells, persistence, privilege escalation), and concrete hunting and mitigation guidance using Microsoft Defender and Defender XDR.

Allison announces a TLS compatibility change for GitHub Enterprise Cloud with data residency: starting October 7, 2026, clients that only offer X25519 for key agreement will no longer be able to connect over HTTPS. The post explains what’s changing, who might be impacted, and what to update or reconfigure.

Microsoft Security Research, Parasharan Raghavan, Deva Kanna Kannan and Sai Chakri break down a July 2026 phishing campaign that delivered a legitimate MSP360 RMM installer under deceptive filenames, then used it to deploy ScreenConnect for redundant remote access. The post includes detection coverage, mitigations, and KQL hunting queries.

Justin Bettencourt rounds up the September 2026 Azure SDK releases across .NET, Java, JavaScript/TypeScript, Python, Go, Rust, and C++, calling out notable updates like Azure AI Search preview API support, a stable Rust SAS crate, and new Entra ID authentication libraries for PostgreSQL.

Allison announces new repository-level controls for where Dependabot version and security update jobs run, including runner type selection plus optional custom labels and runner groups for self-hosted or larger GitHub-hosted runners.