Back to updates

Security - 1

2026 (12)

February (12)

security: 80% of Fortune 500 use active AI Agents: Observability, governance, and security shape the new frontier

Microsoft Security Blog

2026-02-10

A Microsoft Security Blog post promoting its Cyber Pulse report on cybersecurity risks related to AI agents, emphasizing observability, governance, and security. The provided excerpt contains no specific findings or recommendations beyond pointing readers to the report.

security: Manipulating AI memory for profit: The rise of AI Recommendation Poisoning

Microsoft Security Blog

2026-02-10

Microsoft security researchers describe a growing pattern of “AI Recommendation Poisoning,” where attackers poison an AI system’s memory to manipulate future recommendations for promotional gain.

github: Track additional Dependabot configuration changes in audit logs

GitHub

2026-02-10

GitHub added two new audit log event types to track additional Dependabot settings changes at the organization and enterprise levels.

security: Analysis of active exploitation of SolarWinds Web Help Desk

Microsoft Security Blog

2026-02-07

Microsoft reports active exploitation of SolarWinds Web Help Desk using CVE-2025-40551 and CVE-2025-40536 that can lead to domain compromise, and provides guidance to patch, hunt, and mitigate.

github: CodeQL 2.24.1 improves Maven private registry support and improves query accuracy

GitHub

2026-02-07

CodeQL 2.24.1 was released with improved support for Maven private registries and enhancements to query accuracy.

security: New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan

Microsoft Security Blog

2026-02-05

Microsoft reports a new ClickFix variant, “CrashFix,” that intentionally crashes browsers to trick users into running commands that install a Python-based remote access trojan (RAT). The campaign abuses built-in utilities (finger.exe) and a portable Python runtime to reduce detection and maintain persistence on targeted systems.

github: GitHub Actions: Early February 2026 updates

GitHub

2026-02-05

GitHub Actions’ early February 2026 update adds custom runner autoscaling, broadens security controls to all users, and provides early access to new Windows and macOS runner images.

security: Detecting backdoored language models at scale

Microsoft Security Blog

2026-02-04

Microsoft published research on detecting backdoors in open-weight language models and described a scanner intended to identify backdoored models at scale.

github: Dependabot now supports OIDC authentication

GitHub

2026-02-03

GitHub Dependabot can now authenticate to private registries using OpenID Connect (OIDC), removing the need to store long-lived registry credentials as repository secrets for Dependabot update jobs.

github: The Dependabot Proxy is now open source with an MIT license

GitHub

2026-02-03

GitHub has open-sourced the Dependabot Proxy and released it under the permissive MIT license, allowing developers to review the implementation (including how authentication is handled for different package ecosystems), reuse it, and contribute.

azure: Retirement: Azure Front Door and Azure CDN profiles will end support for DHE cipher suites on April 1, 2026

Azure Updates

2026-02-02

Microsoft will end support on April 1, 2026 for weak DHE TLS cipher suites used by Azure Front Door (Standard, Premium, Classic) and Azure CDN from Microsoft (Classic) to improve security.

azure: [Launched] Generally Available: Default Ruleset 2.2 in WAF for Azure Application Gateway

Azure Updates

2026-02-02

Microsoft announced the general availability of Default Rule Set (DRS) 2.2 for Web Application Firewall (WAF) on Azure Application Gateway. The Azure-managed rule set provides active protection against common web vulnerabilities and exploits and includes Microsoft Threat Intelligence.