Browse Security News (131)
stclarke summarizes Microsoft's latest email security benchmark, revealing detailed statistics on threat detection and the benefits of integrating Defender with partner solutions for layered protection.
Microsoft Threat Intelligence and Microsoft Defender Experts detail how Storm-2561 uses SEO poisoning to distribute fake, signed VPN clients, stealing user credentials through technical deception and advanced evasion techniques.
Allison reports on a significant update to GitHub Actions OIDC token functionality: repository custom properties can now be added as claims, supporting stronger and more flexible policy controls across major cloud providers.
Microsoft Incident Response presents a comprehensive analysis of prompt abuse in AI tools, offering practical mitigation strategies and demonstrating how to leverage Microsoft’s security stack to detect, investigate, and respond to such incidents.
Laura Jiang details a temporary rollback in Azure DevOps allowing build identities to access Advanced Security APIs again. The post outlines the required actions for teams before the restrictions return in April 2026.
Microsoft Defender Experts and the Microsoft Defender Security Research Team expose the Contagious Interview campaign, detailing how fake technical interviews target developers with malware. Their research highlights attack methods, malware payloads, and practical protection strategies.
Allison summarizes the March 2026 updates to GitHub's secret scanning, focusing on new detectors—including Azure and major third-party tokens—expanded push protection, and added validation for various providers.
Rahul Bhandari (MSFT) and Tara Overfield summarize important security fixes and servicing information for .NET and .NET Framework with the March 2026 update, including CVE resolutions and detailed changelogs.
Allison provides an overview of CodeQL 2.24.3's new features, with an emphasis on Java 26 support, improved multi-language coverage, and static security enhancements for GitHub code scanning users.
Landon Cox provides an in-depth look at the security model of GitHub Agentic Workflows, highlighting isolation strategies, secret management, and auditable execution of AI-driven automation using GitHub Copilot and Actions.
Vasu Jakkal details how Microsoft Agent 365 and Microsoft 365 E7 support organizations with secure, observable, and governable agentic AI, focusing on modern identity, compliance, and AI risk defense.
Man Yue Mo presents a deep dive into leveraging the GitHub Security Lab Taskflow Agent—an open-source AI-assisted framework—for automating the discovery of high-impact vulnerabilities, such as auth bypasses and IDORs, across open source repositories.
Microsoft Threat Intelligence analyzes how North Korean groups and other threat actors leverage AI to accelerate the entire cyberattack lifecycle. The report, authored by Microsoft Threat Intelligence, explores attack methods, operational trends, and defense strategies powered by Microsoft's security ecosystem.
Vasu Jakkal discusses the importance of championing women at every stage of their cybersecurity careers, emphasizing diversity, educational resources, and the evolving intersection of security and AI.
The Microsoft Defender Security Research Team analyzes how malicious AI-themed browser extensions harvest LLM chat histories and enterprise data, highlighting significant security risks.
Microsoft Fabric Blog presents a step-by-step guide to configuring secure, private network data streaming to Fabric using Eventstream connectors. The article walks through prerequisites, Azure integration, security considerations, and best practices for technical implementation.
Arnaud Lheureux and David Wright discuss the evolving role of AI agents, Copilot, and Defender in platform engineering for Azure, outlining how intent-driven workflows and automated compliance are reshaping modern DevOps.
Allison highlights a GitHub update enabling repository administrators to lock or unlock draft security advisories, restricting editing to admins and strengthening vulnerability management workflows.
Maria Bledsoe presents an overview of Azure IaaS, highlighting resources and guidance for building secure, scalable, and resilient infrastructure ready for AI and modern workloads.
stclarke reports on the coordinated international disruption of Tycoon 2FA, highlighting Microsoft's security leadership and the technical, legal, and operational methods used to weaken one of the world’s fastest-growing phishing platforms.