Security - 3

2026 (7)

January (7)

security: How Microsoft builds privacy and security to work hand-in-hand

Microsoft Security Blog

2026-01-13

The article describes how Microsoft aligns privacy and security initiatives, using advanced tools and adherence to global compliance standards to protect customer data and foster trust.

github: Selectively showing "act on your behalf" warning for GitHub Apps is in public preview

GitHub

2026-01-12

GitHub updated the consent page to selectively show the "act on your behalf" warning for GitHub Apps. When an app is used only as a sign-in method, the warning is reduced or omitted; the change is available in public preview.

github: Controlling who can request apps for your organization is now generally available

GitHub

2026-01-12

GitHub announced general availability of a feature that gives organizations more granular control over who can request GitHub Apps and OAuth apps, enabling stricter governance while preserving flexibility in security posture.

k8s: Kubernetes v1.35: Restricting executables invoked by kubeconfigs via exec plugin allowList added to kuberc

Kubernetes Official Blog

2026-01-09

Kubernetes v1.35 introduces a beta credential plugin policy and allowlist to give users control over executables invoked by kubeconfig exec plugins. You can set policy via the client-go ExecProvider.PluginPolicy or by configuring kubectl's kuberc with credentialPluginPolicy (AllowAll, DenyAll, Allowlist) and credentialPluginAllowlist entries to restrict which plugins may run.

aks: Release 2026-01-04

Release notes from AKS

2026-01-09

AKS release 2026-01-04: Ubuntu 24.04 becomes the default OS SKU starting Kubernetes v1.35; multiple OS/node image updates and security/component upgrades; deprecations and retirements announced (Ubuntu 18.04 removed, Azure Linux 2.0 end-of-support and removal, Basic Load Balancer retired, Kubernetes 1.31 deprecated); several new previews and behavioral changes; important dates and migration actions required.

k8s: Kubernetes v1.35: A Better Way to Pass Service Account Tokens to CSI Drivers

Kubernetes Official Blog

2026-01-07

Kubernetes v1.35 introduces a beta opt-in for delivering CSI-requested service account tokens in the NodePublishVolumeRequest secrets field rather than volume_context. This change (controlled by serviceAccountTokenInSecrets in the CSIDriver spec) fixes accidental token exposure in logs, is opt-in to preserve compatibility, and includes guidance and a safe rollout sequence for CSI driver authors.

dotnet: Secure and Intelligent: Queryable Encryption and Vector Search in MongoDB EF Core Provider

.NET

2026-01-07

The MongoDB EF Core provider adds support for Queryable Encryption and Vector Search, letting .NET developers encrypt sensitive data while still running queries against it and build AI-powered semantic search applications directly using EF Core.

2025 (5)

December (5)

k8s: Kubernetes 1.35: Enhanced Debugging with Versioned z-pages APIs

Kubernetes Official Blog

2025-12-31

Kubernetes 1.35 adds opt-in, versioned, machine-parseable JSON responses for the existing /statusz and /flagz z-pages used by control plane components. The endpoints remain backward compatible (plain text by default); consumers request structured output by sending an Accept header with a versioned media type. Structured responses enable easier automation for health checks, config validation, and debugging tools. The feature is alpha, requires feature gates and proper RBAC/authentication, and is intended for debugging rather than production-critical automation.

k8s: Kubernetes v1.35: Fine-grained Supplemental Groups Control Graduates to GA

Kubernetes Official Blog

2025-12-23

Kubernetes v1.35 graduates fine-grained supplemental groups control to GA via a new Pod field, supplementalGroupsPolicy, letting clusters choose whether to merge group memberships from the container image (/etc/group) or enforce only groups declared in the Pod (Strict) to reduce implicit, hard-to-audit GIDs and improve security (especially for volume access).

github: Control who can request apps for your organization now in public preview

GitHub

2025-12-22

GitHub has launched a public preview that gives organizations more granular control over who can request GitHub Apps and OAuth apps, enabling stricter governance while preserving flexibility in security posture.

github: You can now require reviews before closing Dependabot alerts with delegated alert dismissal

GitHub

2025-12-19

GitHub announced Delegated alert dismissal, a feature that requires a review process before Dependabot alerts can be closed. It is available to GitHub Code Security customers and was reported on the GitHub Blog (changelog entry dated 2025-12-19).

github: CodeQL 2.23.7 and 2.23.8 add security queries for Go and Rust

GitHub

2025-12-18

GitHub released CodeQL versions 2.23.7 and 2.23.8, adding new security queries for Go and Rust. CodeQL is the static analysis engine used by GitHub Code Scanning and Code Quality to detect and help remediate code-quality and security issues.