Back to updates

Security - 2

2026 (12)

October (12)

security: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Microsoft Security Blog

2026-10-31

Microsoft describes a malicious extension branded as Claude Code that installs a persistent SSH backdoor, and provides detection and remediation guidance. The post focuses on how the extension behaves and how to identify affected systems.

github: Security extension for the GitHub Copilot app

GitHub

2026-10-28

A new GitHub security extension is available in public preview for the GitHub Copilot app. It lets you review and work through repository code scanning alerts without leaving the app.

azure: [Launched] Generally Available: Azure Front Door profile and route level WAF policies

Azure Updates

2026-10-27

Azure Front Door Premium now supports generally available WAF policies at the profile and route level, instead of only at individual domains. This allows broader baseline protection across an entire Front Door profile or selected routes.

dotnet: .NET October 2026 Out-of-Band Security Updates

.NET

2026-10-25

Microsoft released out-of-band .NET security updates in October 2026 to address vulnerabilities in the Brotli decoder and tarball ownership handling. The post is a security notice, not a feature release.

github: GitHub Copilot in Visual Studio — September update

GitHub

2026-10-23

GitHub’s September 2026 Visual Studio Copilot update adds pull request exploration in chat, support for choosing the AI model your team uses, and package vulnerability fixes surfaced directly from Visual Studio.

azure: [Launched] Generally Available: Azure Cosmos DB Safe Key Rotation

Azure Updates

2026-10-21

Azure Cosmos DB Safe Key Rotation is now generally available. It adds timestamp metadata for when each account key was last used, which helps identify active keys before rotating or retiring credentials.

github: Updates to GitHub secret scanning

GitHub

2026-10-20

GitHub announced updates to secret scanning, including changes to audit log events and bug fixes. The notice specifically mentions a November 12, 2026 change to the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events.

azure: [Launched] Generally Available: Service tag match condition for Azure Front Door Premium WAF

Azure Updates

2026-10-20

Service tag match conditions for Azure Front Door Premium WAF custom rules are now generally available. This lets rules match on Azure service tag IP prefix groups.

azure: [Launched] Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM

Azure Updates

2026-10-20

Azure Application Gateway now supports keyless TLS termination with certificates stored in Azure Key Vault Managed HSM. During TLS handshakes, signatures are performed inside the HSM and the private key is not exported to the gateway.

github: GitHub package firewall in public preview

GitHub

2026-10-20

GitHub package firewall is now in public preview. It is intended to reduce malware risks during package installation by blocking package-install-time attacks that can steal credentials from CI/CD hosts or developer workstations.

security: Agents are your newest insiders. Security must move at their speed.

Microsoft Security Blog

2026-10-19

Microsoft announced new capabilities in Microsoft 365 E7 and Project Perception aimed at helping organizations contain AI agent risk and continuously adapt protection. The post frames agents as insider-like risks and focuses on security controls that keep pace with their behavior.

azure: [Launched] Generally Available: External key management for Azure Key Vault Managed HSM

Azure Updates

2026-10-16

External key management for Azure Key Vault Managed HSM is now generally available in all Azure public regions. It allows organizations with regulatory or sovereignty requirements to keep physical control of key-encryption keys while using Azure services that support this capability.