Security - 2

2026 (12)

September (12)

github: SHA-1 in HTTPS on GitHub sunset

GitHub

2026-09-15

GitHub has completed the scheduled sunset of SHA-1 for HTTPS on github.com and partner services. SHA-1 is now disabled for HTTPS connections.

security: Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft Security Blog

2026-09-10

Microsoft describes an AI-assisted business email compromise campaign that impersonated executives and used fake invoices to target finance teams for ACH payment fraud. The post focuses on the attack pattern and how organizations can protect against it.

security: Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Security Blog

2026-09-10

Microsoft Defender is described as detecting and disrupting AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post is a Microsoft Security Blog entry dated 2026-09-10.

azure: [Launched] Generally Available: User-bound user delegation SAS for Azure Storage

Azure Updates

2026-09-09

Azure Storage now generally available with user-bound user delegation SAS, combining user delegation SAS flexibility with Entra ID user-bound access for stronger authentication. The update adds enhanced secure authentication for Azure Storage.

github: npm extends recovery-code security holds to all accounts

GitHub

2026-09-09

npm now applies a 72-hour security hold to any account after a successful recovery-code sign-in. The hold was previously limited to high-impact accounts.

github: CodeQL 2.27.0 adds support for Linux ARM64

GitHub

2026-09-09

CodeQL 2.27.0 is available on Linux ARM64. The release also adds a new Rust security query, expands framework coverage for Java/Kotlin and C#, and includes analysis accuracy improvements across multiple languages.

security: Threat matrix: Mapping threats across cloud web applications

Microsoft Security Blog

2026-09-09

Microsoft introduced the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework for understanding and prioritizing threats against cloud-hosted web applications and serverless platforms. It is intended to help defenders map attacks and identify mitigations.

github: Block pull requests with exposed secrets from merging

GitHub

2026-09-09

GitHub added a repository ruleset capability to prevent pull requests from merging when they introduce exposed secrets. This extends rulesets as a repository-wide protection mechanism.

security: How to secure edge AI in customer-owned environments

Microsoft Security Blog

2026-09-04

Microsoft says edge AI deployments in customer-owned environments require stronger verification of systems, software, and AI assets before sharing sensitive data, credentials, or models. The post frames secure edge AI as a trust and validation problem for third-party environments.

k8s: Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta

Kubernetes Official Blog

2026-09-04

Kubernetes v1.37 moves KubeletInUserNamespace to beta and enables the feature gate by default. It allows node components to run as a non-root user in a Linux user namespace, reducing host impact from node-component exploits, while leaving existing rootful clusters unchanged unless explicitly configured.

security: ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft Security Blog

2026-09-03

Microsoft reports that invisible Unicode characters, previously used in AI prompt injection, are now being used to hide words from email filters as part of phishing evasion. The technique relies on obfuscating text before parsers process it.

azure: [In preview] Public Preview: Azure Front Door profile and route level WAF policies

Azure Updates

2026-09-02

Azure Front Door Web Application Firewall (WAF) now supports associating WAF policies at the profile and route levels in public preview. This lets you apply baseline protection across a profile and more targeted policies on specific routes.