Security - 3

2026 (12)

October (12)

github: AI Scan for pull requests generally available

GitHub

2026-10-15

AI Scan for pull requests is now generally available in code scanning. It complements CodeQL by detecting vulnerabilities in pull request changes for languages and frameworks not currently covered by CodeQL.

azure: [Launched] Generally Available: Azure Cloud HSM hardware audit logging

Azure Updates

2026-10-14

Azure Cloud HSM hardware audit logging is now generally available. It adds hardware-generated audit records for supported HSM management operations to aid security monitoring, compliance, governance, and forensic investigations.

github: Audit GitHub Code Quality finding dismissals and reopenings

GitHub

2026-10-13

GitHub audit logs now include manual dismissals and reopenings of GitHub Code Quality findings at the organization or enterprise level. This lets admins review actions on findings that appear in a repository’s default-branch backlog or other Code Quality views.

security: Post-quantum authentication: Why organizations should start testing certificate ecosystems now

Microsoft Security Blog

2026-10-08

Microsoft says organizations should begin testing certificate ecosystems now to prepare for post-quantum authentication. The post highlights Microsoft’s PQC TLS Pilot Program as a way to validate readiness for future post-quantum TLS deployments.

azure: [Launched] Generally Available: Exceptions in WAF for Azure Application Gateway and Azure Front Door

Azure Updates

2026-10-08

Azure Web Application Firewall exceptions are now generally available for Azure Application Gateway and Azure Front Door. The feature lets customers exclude specific parts of a request from WAF inspection to reduce false positives.

github: Purpose-built model for leaked secret detection

GitHub

2026-10-07

GitHub announced a new purpose-built, context-aware model for leaked secret detection as part of Secret Protection. It is intended to improve secret detection in code workflows, including those that involve AI agents.

github: Local sandboxing for GitHub Copilot now generally available

GitHub

2026-10-07

Local sandboxing for GitHub Copilot is now generally available. It is supported in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.

security: CISO perspectives on managing vulnerability risks in the age of AI

Microsoft Security Blog

2026-10-06

The post says CISOs should adapt vulnerability management practices for AI-driven environments to reduce cybersecurity risk and improve resilience. It frames the topic as managing vulnerabilities in the age of AI-powered tooling and threats.

github: Secret scanning adds detectors for Lovable, Supabase, and more

GitHub

2026-10-05

GitHub Secret Scanning added new detectors for secrets from Lovable Labs, Pydantic Services Inc., and Supabase. A new provider also joined the secret scanning partnership program.

github: Unvalidated npm trusted publishing configurations now expire

GitHub

2026-10-02

Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This reduces the risk of a repository or project name changing after the configuration is created.

github: Rate limits for private vulnerability reports

GitHub

2026-10-01

GitHub is adding rate limits for private vulnerability reports to reduce low-quality and automated submissions that can obscure important reports. The change caps how many new reports a single account can submit.

github: Structured forms for private vulnerability reports

GitHub

2026-10-01

Private vulnerability reports now support structured forms to collect the details needed for triage, including a reproducible proof of concept. This replaces reliance on a single free-text field with a more guided intake flow.