Weekly Security Roundup: Runtime Fixes and Supply Chain Threats

by TechHub

Welcome to this week's Security roundup, where .NET out-of-band patches and the LiteLLM and ConnectWise supply chain investigations put deployment checks, environment rebuilding, and application identity reviews first. GitHub adds package filtering, credential lifecycle options, and secret exposure response tools, while upcoming agent-assisted fixes and CodeQL compatibility changes require planning. We then look at Microsoft's AI agent containment controls and Azure's sovereign and confidential computing updates, distinguishing available protections from preview capabilities.

This Week's Overview

Runtime security fixes and support deadlines

Runtime maintenance brought both immediate patching work and a longer-term migration deadline: .NET received out-of-band fixes, while Azure Java users received guidance on support ending in 2027.

.NET fixes require deployment-specific action

The .NET security updates cover .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3. CVE-2026-111497 affects Brotli decompression on all platforms and may let unauthenticated attackers read or corrupt process memory, though .NET Framework is unaffected. CVE-2026-114148 affects Linux source-build tarballs in .NET 8-11 and ASP.NET Core runtime tarballs in .NET 8 and 9.

These releases also complete fixes for CVE-2026-70197 and CVE-2026-102870 that the October 13, 2026 release did not fully address. Teams should therefore review deployments even if they applied that release. Framework-dependent applications need the updated runtime installed and a restart, self-contained applications need rebuilding and republishing, and containers need rebuilding and redeployment.

Azure Java support ends in September 2027

Azure App Service and Azure Functions support for Java 8, 11, and 17 ends on September 1, 2027. Existing applications will keep running, but those Java versions will stop receiving security updates, improvements, and related customer support. This is a maintenance deadline rather than an application shutdown date.

Microsoft Build of OpenJDK separately lists September 2027 as the earliest end-of-support date for Java 11 and 17, with possible extensions. Java 8 support on Azure uses Eclipse Temurin builds, not a Microsoft Build of OpenJDK 8. Teams can use Modernize CLI to assess applications, plan upgrades, and apply changes for review.

Supply chain compromises target credentials and cloud identities

Two investigations showed different ways trusted software distribution and application connections can become attack paths. The response guidance focuses on rebuilding compromised environments and investigating application identities, not only changing user passwords.

LiteLLM startup hooks can execute without an import

Compromised LiteLLM 1.107.0 reached PyPI and official container images on October 21, 2026. Malicious Python startup files could execute a credential collector without an application importing LiteLLM, making interpreter initialization itself a risk in suspect environments.

Investigators should avoid starting Python or pip inside those environments because doing so could activate the payload. Recovery requires rebuilding affected environments, addressing surviving processes, and rotating reachable credentials from a known-clean machine. Microsoft provides Defender detections and KQL hunting queries, and Defender Vulnerability Management identifies exposure as TVM-2026-0003.

ARTEX campaign exploited compromised application identities

Microsoft assesses that Storm-0940 used ARTEX in the ConnectWise supply chain compromise and reached more than 2,250 tenants through compromised application identities. Some ARTEX-driven attacks achieved privileged cloud access less than three hours after initial targeting. In affected environments, Microsoft observed reconnaissance, application credential modifications, and identity or privilege changes through Microsoft Graph.

The investigation also recorded more than 151,000 failed password-spraying logons against 327 accounts across eight organizations, with no successful authentication observed in that activity. Customers should keep affected ConnectWise connections disabled, preserve evidence, and investigate service-principal sign-ins alongside unauthorized credential and permission changes. The distinction matters: unsuccessful password spraying does not rule out access through a compromised application identity.

Vulnerability prevention, scanning, and remediation

Dependency controls expanded at both ends of the workflow, from blocking packages before download to proposing vulnerability fixes. Scanning teams also have compatibility changes to address before upgrading build environments.

GitHub package firewall adds pre-download checks

GitHub package firewall is in public preview for all GitHub Enterprise Cloud customers, including enterprises with data residency. It inspects metadata requests and package downloads before dependencies reach developer workstations or continuous integration and delivery hosts. Enterprise controls include configurable cooldown periods, GitHub Advisory Database checks, and attestation downgrade checks.

Endpoints must route package traffic through the firewall for those checks to apply, and users can request exceptions for incorrectly blocked packages. The preview supports npm packages only and is free. Billing at general availability is planned to use metered usage, so both ecosystem coverage and future consumption costs belong in an evaluation.

Agent-assisted fixes expand beyond CodeQL

Agentic Autofix for GitHub Advanced Security for Azure DevOps uses the Copilot coding agent to explore repository context and review proposed changes, with support for custom instructions and skills. Its scope expands beyond previous CodeQL support to dependency vulnerabilities and code scanning alerts from third-party tools. Dependency alerts gain EPSS percentiles for exploit-probability context and development-versus-runtime scope to help teams prioritize work.

Generating fixes consumes AI credits, enabling Autofix does not automatically generate them, and a request does not guarantee a fix. The rollout is planned over two to three weeks, with public preview availability in November. Teams should treat this as an upcoming remediation option rather than assume it is already available everywhere.

Visual Studio's Copilot update provides another entry point: NuGet Audit warnings now offer a fixer action that invokes Copilot agent mode through the NuGet Model Context Protocol (MCP) server. The update is available across all GitHub Copilot plans. Its bring-your-own-model workflow now requires Agent (Preview), previous Ask and Agent modes no longer support that workflow, and users must re-add previously configured Ollama models after updating.

CodeQL users should pin compatible build environments

Installing Xcode 27 prevents CodeQL traced extraction for C/C++, C#, Go, Java, Kotlin, and Swift, and traced extraction may also be unavailable on macOS 27. CodeQL does not support Swift 6.4 on any platform. These restrictions make toolchain upgrades a scanning-coverage decision, not only a build-compatibility decision.

Affected workflows should pin macOS and Xcode to version 26 or earlier. C/C++, C#, and Java workflows can instead use build mode none where appropriate. CodeQL support for Intel-based Macs will be deprecated in mid-December 2026, adding a separate runner-planning deadline.

Dependabot adds version context and package-manager support

Dependabot alert responses and dependabot_alert webhooks now include dependency.version_requirement, containing the version or constraint last recorded for the alert. Lockfiles and the Dependency Submission API provide resolved versions, while manifests without lockfiles provide declared versions or constraints. Consumers must handle null values, truncated constraints, and cases where the field represents only one of multiple vulnerable versions.

Dependabot also supports npm 12, pnpm 11 and 12, and Bun 1.4 for all GitHub.com users. Both updates are scheduled for GitHub Enterprise Server 3.24.

Automation identity and credential lifecycle

GitHub's identity updates give teams more options for replacing long-lived credentials and binding access to stable identifiers. An Enterprise Managed User incident report also clarifies the outcome of an earlier deprovisioning fault.

Enterprise GitHub Apps can replace more classic tokens

Enterprise-level installations for GitHub Apps are generally available, with expanded API support for workflows that previously required classic personal access tokens. New permissions cover repository policies, bypass requests, enterprise settings, two-factor authentication, verifiable domains, IP allowlists, access restrictions, and repository rulesets.

Read permission for enterprise settings is required to access enterprise organization and repository policies, a dependency to account for when defining app permissions. Teams can review enterprise automation for opportunities to move from classic tokens to GitHub Apps. These updates will be available in GitHub Enterprise Server 3.24.

Immutable Actions claims reduce repository-name reuse risk

Name-based OpenID Connect (OIDC) subject claims can leave dangling Azure federated credentials when repositories or organizations are deleted, renamed, or transferred. Immutable claims include owner and repository IDs to help prevent access through reused names.

The guidance recommends retrieving those IDs through the GitHub CLI and API, then configuring Owner ID and Repository ID in Azure before enabling immutable subject claims. Enterprise claims and custom repository properties require manual edits to the Azure Subject Identifier.

GitHub CLI previews expiring credentials

GitHub CLI v2.103.0 adds an opt-in public preview of expiring access tokens paired with rotating refresh tokens. Users can sign in with gh auth login --expiring or set expiring_credentials to enabled for future sign-ins. The feature is available on github.com and ghe.com, with GitHub Enterprise Server support starting in version 3.23.

GitHub recommends Git 2.46 or later and using GitHub CLI as the credential helper for Git over HTTPS. Scripts that consume tokens outside the CLI should retrieve them fresh rather than cache them for later reuse.

GitHub restores incorrectly deleted managed-user records

Between June 1 and June 13, 2026, SCIM deprovisioning incorrectly deleted approximately 12,285 Enterprise Managed User accounts instead of suspending and obfuscating them, including 76 accounts active at deletion. GitHub disabled the affected path on June 13 and restored affected records in October 2026, with no action required from enterprise owners.

Owners can identify impact through user.delete audit-log events during the incident window. Hard-deprovisioned accounts remain non-reprovisionable by design, and GitHub says the incident does not affect the reprovisioning workflow.

Secret detection and exposure response

GitHub updated both repository secret scanning and public credential monitoring. Integrations need to account for an upcoming audit-field change, while responders gain more ways to triage exposed credentials without confusing alert closure with remediation.

Secret scanning changes audit fields and revocation coverage

On November 12, 2026, affected secret scanning audit events will start using enterprise slugs instead of display names in the business field. Integrations that filter by display name should accept both formats or use business_id, whose numeric values remain unchanged. Event names are unchanged.

Token revocation now supports Base64-encoded GitHub tokens in private and internal repositories with secret scanning enabled. Dismissal-request webhooks include exemption_request.number, the repository-scoped request number available through the REST API. Custom pattern API requests rejected for invalid arguments now return HTTP 422 instead of 500, so clients should update error handling where needed.

Public monitoring adds residency support and response tooling

Public monitoring is in public preview for GitHub Enterprise Cloud customers with data residency. It scans public commits across github.com and uses verified domain matching to attribute exposed credentials without sharing enterprise membership rosters with github.com. Alerts are encrypted, delivered directly to the enterprise dashboard, and retained within the designated geography.

Enterprise dashboards now support dismissing, reopening, filtering, and sorting alerts, with an activity timeline and ongoing validity checks that classify supported credentials as Active, Inactive, or Unknown. Enterprise admins and security managers can query attributed findings through a REST API and receive newly attributed leak notifications through enterprise webhooks. Closing an alert neither revokes the credential nor removes it from the public repository.

Public monitoring remains in public preview and requires an active GitHub Advanced Security or GitHub Secret Protection license. It incurs no additional cost under those licenses.

Sovereign infrastructure and confidential AI

The sovereign-cloud announcements address where workloads run, who controls encryption keys, and how data stays protected during processing. Availability varies by component, with generally available isolation features alongside preview migration and governance capabilities.

Azure Local adds confidential isolation and disconnected migration

Confidential virtual machines on Azure Local are generally available, providing hardware-encrypted memory, hardware-based isolation, attestation, and guest operating-system integrity protection. These controls protect data from host environments and infrastructure administrators. Hardware-backed attestation gives teams evidence to check an environment's security properties against workload requirements.

Azure Local also introduces public-preview rehoming from Azure-connected infrastructure to disconnected environments, using phased execution, user approvals, and secure backups. This provides a controlled migration path for organizations changing their connectivity requirements rather than treating disconnected operation as only an initial deployment choice.

The related infrastructure guidance describes Azure Local on Intel Xeon 6 for customer-controlled environments and supported Azure Confidential VM configurations using Intel TDX to isolate workloads in use. Its practical emphasis is on verifying the supported hardware and isolation configuration for the workload.

Foundry Local brings inference and retrieval into local environments

Foundry Local runs supported models on Azure Local through Azure Arc-enabled Kubernetes, with CPU- and GPU-backed deployments and OpenAI-compatible APIs. The dedicated announcement describes the model catalog and Agentic Retrieval as generally available, including local ingestion, indexing, multi-step retrieval, and citations. Agents, enterprise connectors using MCP, and configurable AI guardrails are described as preview capabilities.

Azure Local disconnected operations uses a local control plane to run supported infrastructure and services without continuous public-cloud connectivity. GitHub Enterprise Local is described as becoming generally available at Ignite, supporting GitHub Actions and self-hosted runners on Azure Local. Teams planning local AI and development workflows should distinguish available components from preview or forthcoming capabilities.

Sovereign Public Cloud expands key custody and access oversight

External Key Management with Azure Managed HSM is generally available, allowing customers to retain root encryption keys in customer-operated hardware. Data Guardian and Production Touch Ledger add oversight and tamper-evident records for qualifying Microsoft engineer access in EU and EFTA regions. Together, these address key custody and visibility into infrastructure access.

Sovereign Control Panel is in private preview, with public preview planned for Microsoft Ignite and delivery timelines subject to change. The updated Sovereign Landing Zone implementation supports Bicep, Terraform, and Azure Verified Modules. Azure Confidential Clean Rooms remains in limited preview for approved Spark SQL analysis in hardware-protected environments.

Confidential inference requires more than GPU attestation

Azure NCCads H100 v5 confidential VMs combine fourth-generation AMD EPYC processors with NVIDIA H100 Tensor Core GPUs, extending the trusted execution environment across AMD SEV-SNP on the CPU and the GPU's confidential mode. Microsoft Azure Attestation assesses VM state, while Azure Key Vault Managed HSM supports policy-controlled key release after successful attestation.

The architecture also uses a Stained Glass Proxy to transform prompts and context inside the data owner's trust boundary before sending protected representations to Azure. GPU attestation alone does not verify how gateways, caches, logs, and traces handle sensitive requests, so teams still need to review the complete inference path.

AI agent containment and operational security

Microsoft's agent-security announcements emphasize controls outside the model, including identities, sandboxes, permissions, and human approval. Related tooling shows how those controls apply to browser sessions, operations agents, and diagnostic data.

Project Perception expands discovery and adaptive containment

Microsoft is expanding local-agent discovery by 35 types, bringing coverage to 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Microsoft Entra Agent ID is being extended with identity types for local agents and previously unknown agents discovered through security sensors. Microsoft Execution Container provides a sandbox with policy-controlled resource access and security controls outside the agent's reach.

Dynamic Permissions supports task-scoped, time-bound access, with verified human approval for higher-impact actions. Dynamic Agent Risk combines identity, data, endpoint, cloud, network, runtime, and activity signals to inform graduated containment through Dynamic Conditional Access. The approach treats deployed agents as insider risks whose permissions may need to change during execution.

The accompanying Project Perception explanations describe red, blue, and green agent teams, with Guardian Agents watching and moderating actions before they happen. Discovery and containment involve assigning an identity, container, policies, and permissions. The stated principle is that greater model transparency can strengthen containment, but cannot replace external controls.

Foundry browser automation adds controlled cloud sessions

Browser Automation Tool in Microsoft Foundry is generally available and uses Playwright Workspaces to provision isolated cloud browser sessions. Agents can access public websites and private applications behind an Azure virtual network, provided private connectivity is configured during workspace provisioning. Foundry toolboxes expose MCP-compatible endpoints for sharing browser tools across Prompt agents and Hosted agents.

Controls include sensitive-action approvals, tool allow lists, managed identities, and Azure role-based access control. Live View lets people observe browser activity, while Take control allows temporary human interaction before returning the session to the agent. Sensitive trace protection is documented as a preview capability, so teams should not assume every security component shares the tool's general-availability status.

Azure SRE Agent documents private integrations and security boundaries

Updated Azure SRE Agent guidance covers execution isolation, secretless credentials, customer separation, encryption, network controls, logging, and data residency. Two private Splunk MCP samples demonstrate same-region and cross-region connections without opening Splunk to inbound internet traffic.

Azure SRE Agent also supports private Azure DevOps repositories as a marketplace for plugins and skills. Canvas brings operational findings and context into GitHub Copilot Apps and Copilot CLI, while ServiceNow guidance connects incident-type response plans to investigation workflows.

Agent monitoring needs protected diagnostics

Copilot Studio provides analytics and conversation-level troubleshooting, while Azure Application Insights and Azure Monitor add telemetry and alerts for instrumented custom components and supported resources. The monitoring guide recommends tracking task completion, tool-call errors, p95 latency, authentication failures, and cost per successfully completed task.

Consistent correlation identifiers help connect user-facing failures to API requests, workflow executions, and dependency errors. Because conversations can contain confidential information, diagnostic logs need sensitive-value redaction, appropriate retention policies, and restricted access.

Security boundaries for custom model integrations

Custom model routing and user-controlled endpoints create distinct credential-handling decisions. Two implementation guides show where policy checks and authentication boundaries belong in those workflows.

Filter model candidates before routing decisions

The Copilot routing architecture filters candidate models by entitlement, pricing, context capacity, API compatibility, and administrator policy before scoring them. It selects a model once per new user turn and pins that choice across the resulting tool continuations. VS Code discovers available Copilot models through its public Language Model API rather than a hardcoded list.

Microsoft-Decision-1 supplies typed decisions and probabilities through binary, choice, and ordered-score questions. GitHub credentials remain in memory and must not be logged or sent to the Decision API, separating model-selection requests from the credentials used to access Copilot.

Copilot SDK sample isolates user-controlled inference

The .NET 10 bring-your-own-key sample routes inference to a user-controlled OpenAI-compatible endpoint through ProviderConfig and the Responses API while retaining the GitHub Copilot SDK runtime. Without an API key, AzureCliCredential reuses Azure CLI authentication and requires the Cognitive Services OpenAI User role.

Authentication callbacks for this workflow are experimental in the Copilot SDK. The sample disables tools, skills, configuration discovery, and Git operations to isolate the model request, providing a narrower setup for testing endpoint authentication before adding agent capabilities.

Other Security News

Azure App Configuration's Enhanced Feature Flags public preview introduces dedicated resources whose access can be granted independently of configuration key-values, supporting least-privilege permissions. Dedicated APIs validate definitions on creation or update, while existing key-value-based flags remain supported.

Azure Databricks Private Network Gateway is in public preview, using a delegated virtual-network subnet and an account-level Network Connectivity Configuration to provide a managed, encrypted gateway without customer-deployed gateway VMs. Workspace controls and network rules enforce isolation before traffic enters the subnet, with routing for specified fully qualified domain names or all outbound traffic except more specific Private Link or service-endpoint paths.

Fabric Policies are in preview for tenant- and capacity-scoped governance, with advanced policies blocking actions unless all conditions in at least one Allow rule match. Policies do not grant existing roles or permissions, Power BI item creation is not yet enforced, and only one Policy Set can be active per tenant or individual capacity.

The Azure SQL Database Hyperscale session covers independent compute, storage, and read scaling alongside serverless compute, elastic pools, and named replicas. Its security takeaway is to configure and validate controls during modernization rather than treat migration as only a capacity-planning exercise.

The Azure weekly video covers Application Gateway keyless TLS with Key Vault Managed HSM, Front Door web application firewall service-tag matching, and Cosmos DB safe key rotation. It also includes Databricks private network gateways, Project Perception updates, and Copilot Studio agent ID.

Also relevant this week

Dates to know

Deadlines

Coming up