Back to updates

Security - 2

2026 (12)

April (12)

dotnet: Governing MCP tool calls in .NET with the Agent Governance Toolkit

.NET

2026-04-29

The post describes how to govern MCP tool calls in .NET using the Agent Governance Toolkit. It focuses on policy-based access control, security scanning, and response sanitization to reduce risk in AI agent systems.

k8s: Kubernetes v1.36: Fine-Grained Kubelet API Authorization Graduates to GA

Kubernetes Official Blog

2026-04-24

Kubernetes v1.36 makes fine-grained kubelet API authorization GA. KubeletFineGrainedAuthz is now always enabled, allowing RBAC to target specific kubelet subresources like nodes/metrics and nodes/stats instead of the broad nodes/proxy permission.

azure: [In preview] Public Preview: Hosted Agents in Foundry Agent Service

Azure Updates

2026-04-24

Azure Foundry Agent Service now offers hosted agents in public preview. Each agent session runs in an isolated sandbox with a clean environment, no shared state, and strong compute boundaries.

k8s: Kubernetes v1.36: User Namespaces in Kubernetes are finally GA

Kubernetes Official Blog

2026-04-23

Kubernetes v1.36 makes User Namespaces GA on Linux, allowing Pods to run with hostUsers: false so container root is isolated from host root. The release also relies on ID-mapped mounts to avoid recursive chown on volumes, improving startup performance and preserving on-disk ownership.

k8s: SELinux Volume Label Changes goes GA (and likely implications in v1.37)

Kubernetes Official Blog

2026-04-22

Kubernetes v1.36 introduces stable Pod field `spec.securityContext.seLinuxChangePolicy` and a new optional `selinux-warning-controller` to help prepare for a likely v1.37 default-on `SELinuxMount` change. When SELinux is enabled, mounts can switch from recursive relabeling to mount-time labeling, which improves performance but can break some shared-volume patterns; clusters should audit for conflicts and opt out per Pod with `Recursive` if needed.

azure: [Launched] Generally Available: Dynamic data masking with Azure Cosmos DB

Azure Updates

2026-04-22

Azure Cosmos DB now generally supports dynamic data masking, a server-side policy feature that hides sensitive data from nonprivileged users. It is intended to help protect sensitive information from unauthorized access.

security: AI-powered defense for an AI-accelerated threat landscape

Microsoft Security Blog

2026-04-22

Microsoft says it is partnering with Anthropic and other industry players to apply leading AI models, along with its platforms and expertise, to convert AI-driven threat discovery into scalable protection.

k8s: Kubernetes v1.36: ハル (Haru)

Kubernetes Official Blog

2026-04-22

Kubernetes v1.36 (Haru) ships 70 enhancements: 18 stable, 25 beta, and 25 alpha. Highlights include GA for fine-grained kubelet API authorization, user namespaces in pods, external ServiceAccount token signing, SELinux volume label changes, and removal of the gitRepo volume driver; Service.spec.externalIPs is deprecated for removal in v1.43.

dotnet: .NET 10.0.7 Out-of-Band Security Update

.NET

2026-04-21

Microsoft released .NET 10.0.7 as an out-of-band security update to address CVE-2026-40372. The update is security-focused and published outside the regular release cycle.

azure: [In preview] Generally Available: Azure NetApp Files advanced ransomware protection

Azure Updates

2026-04-21

Azure NetApp Files advanced ransomware protection (ANF ARP) is now generally available. It is intended to help detect, respond to, and recover from ransomware threats on cloud volumes.

github: CodeQL now supports sanitizers and validators in models-as-data

GitHub

2026-04-21

CodeQL data extensions now support defining custom sanitizers and validators in models-as-data. This adds new ways to model how data is cleaned or checked in code scanning rules.

security: Making opportunistic cyberattacks harder by design

Microsoft Security Blog

2026-04-20

Microsoft describes changes to Dynamics 365 and Power Platform aimed at reducing opportunistic attacks by removing credentials, shrinking attack surfaces, and applying platform engineering controls. The post focuses on design choices that make common attack paths harder to exploit.