Back to updates

Security - 3

2026 (12)

October (4)

security: 3 lessons from frontier AI vulnerability research

Microsoft Security Blog

2026-10-07

Microsoft Security says its FORGE Lab is applying frontier AI methods to scale vulnerability research beyond Windows, including work on the Linux kernel. The post highlights three takeaways from that research effort.

security: CISO perspectives on managing vulnerability risks in the age of AI

Microsoft Security Blog

2026-10-06

The post says CISOs should adapt vulnerability management practices for AI-driven environments to reduce cybersecurity risk and improve resilience. It frames the topic as managing vulnerabilities in the age of AI-powered tooling and threats.

security: Preparing governments for an era of interconnected cyber risk

Microsoft Security Blog

2026-10-01

Microsoft says government agencies and services were the most impacted sector in 2026 cyber activity, accounting for 27% of observed activity versus 17% in 2025. The post ties this to Microsoft’s 2026 Digital Defense Report and frames it as interconnected cyber risk for governments.

security: Insights from the 2026 Microsoft Digital Defense Report

Microsoft Security Blog

2026-10-01

Microsoft published a brief post pointing readers to highlights from the 2026 Microsoft Digital Defense Report. The note says the security environment is becoming more interconnected, but provides no detailed findings in the excerpt.

September (8)

security: ​​Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026

Microsoft Security Blog

2026-09-30

Microsoft’s Ignite 2026 security post says the company will highlight an AI-first, end-to-end security platform. The platform is described as covering identities, devices, data, applications, clouds, infrastructure, and AI agents.

security: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

Microsoft Security Blog

2026-09-30

Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570 in Zimbra mail servers. The post covers observed attack paths, ways to detect the activity, and mitigation guidance.

security: Phishing Abuses RMM Tools for Persistent Access

Microsoft Security Blog

2026-09-29

Microsoft reported phishing campaigns that abused MSP360 RMM to deploy ScreenConnect and establish redundant remote-access channels for later malicious activity. The focus is on persistence and follow-on access rather than initial compromise alone.

security: ​​Beyond source code: A path to the keys to the kingdom

Microsoft Security Blog

2026-09-29

Microsoft describes how Storm-3068 used a compromised identity to expand access into cloud environments, moving beyond source code exposure to broader infrastructure compromise. The post focuses on defensive steps for protecting identities, CI/CD pipelines, and cloud infrastructure.

security: Star Blizzard refines phishing and malware delivery with the RedFlick technique

Microsoft Security Blog

2026-09-29

Microsoft says it has observed Russian state actor Star Blizzard since January 2026 using large-scale phishing, compromised website accounts, and a new malware delivery method it tracks as RedFlick. The update focuses on the actor’s improved detection evasion and delivery techniques.

security: NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Security Blog

2026-09-28

Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions. It uses custom loaders, encrypted archives, and extensible components to keep access and support follow-on activity.

security: Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Blog

2026-09-25

Microsoft describes Azure attacks linked to Storm-3168 using compromised service principals, including reconnaissance, resource deletion, and credential access. The post links the activity to JADEPUFFER and includes defender guidance.

security: ​​​​​​​​What’s new in Microsoft Security: September 2026​​

Microsoft Security Blog

2026-09-24

Microsoft Security’s September 2026 update focuses on discovering and controlling local AI agents, extending Zero Trust controls to agent traffic, and improving SOC foundational capabilities.