Back to updates

Microsoft Security Blog - 1

2026 (11)

May (1)

security: When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps

Microsoft Security Blog

2026-05-14

Microsoft describes how misconfigured cloud-native AI apps on Kubernetes can expose user interfaces, weaken authentication, and enable risky defaults that lead to remote code execution and data leaks. The post frames these issues as exploitable configuration flaws rather than software bugs.

April (3)

security: 8 best practices for CISOs conducting risk reviews

Microsoft Security Blog

2026-04-29

Microsoft Security Blog published a brief post titled "8 best practices for CISOs conducting risk reviews." The provided excerpt is a short intro that emphasizes proactive security to reduce exposure to threats.

security: The agentic SOC—Rethinking SecOps for the next decade

Microsoft Security Blog

2026-04-09

Microsoft describes a future SOC model where autonomous defense handles machine-speed response, agents provide context and coordination, and human analysts focus on judgment, risk, and outcomes.

security: Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments

Microsoft Security Blog

2026-04-02

Microsoft describes a Linux-hosting intrusion technique where PHP webshells are triggered by specially crafted HTTP cookies. The post covers obfuscation, php-fpm execution, and cron-based persistence used to hide activity and maintain access.

March (7)

security: Applying security fundamentals to AI: Practical advice for CISOs

Microsoft Security Blog

2026-03-31

Microsoft Security published guidance for CISOs on securing AI systems by applying established security fundamentals to AI-powered environments. The post focuses on practical steps for managing AI risk rather than introducing new product features.

security: WhatsApp malware campaign delivers VBScript and MSI backdoors

Microsoft Security Blog

2026-03-31

Microsoft describes a malware campaign delivered through WhatsApp messages that uses VBS scripts to start a multi-stage infection chain. The attackers rely on renamed Windows utilities and cloud-hosted payloads to install MSI backdoors and keep persistent access on compromised systems.

security: Governing AI agent behavior: Aligning user, developer, role, and organizational intent

Microsoft Security Blog

2026-03-24

The report discusses how to govern AI agent behavior by aligning user, developer, role, and organizational intent for secure enterprise AI adoption.

security: Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

Microsoft Security Blog

2026-03-12

Microsoft reports that Storm-2561 has been using SEO poisoning to promote fake VPN client downloads that install signed trojans and steal VPN credentials. The activity has been observed since 2025 and relies on impersonating trusted brands and abusing legitimate services.

security: Detecting and analyzing prompt abuse in AI tools

Microsoft Security Blog

2026-03-12

Microsoft describes how hidden instructions in content can influence AI tool behavior and uses a scenario to illustrate prompt injection. The post emphasizes the need for human oversight and a structured response playbook.

security: AI as tradecraft: How threat actors operationalize AI

Microsoft Security Blog

2026-03-06

Microsoft reports that threat actors are using AI to scale and sustain malicious operations, accelerating tradecraft and increasing defender risk. It cites recent activity involving North Korean groups Jasper Sleet and Coral Sleet (formerly Storm-1877).

security: Women’s History Month: Encouraging women in cybersecurity at every career stage

Microsoft Security Blog

2026-03-05

Microsoft Security Blog post for Women’s History Month focusing on how to support and encourage women in cybersecurity across different career stages.