Security - 4

2026 (12)

August (6)

github: Secret scanning coverage updates

GitHub

2026-08-07

GitHub updated secret scanning coverage by adding more secrets to push protection, onboarding a new secret scanning partner, and including richer metadata in alerts. The post also notes the Secret Scanning Partnership Program now includes Lovable Labs.

github: MCP allowlists in enterprise managed settings

GitHub

2026-08-07

GitHub added enterprise-managed settings to centrally control which MCP servers GitHub Copilot clients can run. Enterprise owners can now use `allowedMcpServers` and `deniedMcpServers` to allowlist or block specific MCP servers.

security: ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Security Blog

2026-08-04

Microsoft describes ChainDrop, a credential-stealing worm embedded in 400+ compromised npm packages that spread by republishing malicious updates across software ecosystems. The post outlines the attack chain, affected environments, and guidance for detection, hunting, and remediation.

github: Customize code scanning default setup at scale

GitHub

2026-08-04

GitHub added a new repository property, `github-codeql-config-file`, that lets you apply a custom configuration file to code scanning default setup. This gives you control over how CodeQL runs on repositories at scale.

azure: [Launched] Generally Available: Trusted Launch as Default

Azure Updates

2026-08-03

Trusted Launch as Default is now generally available for new Azure Gen2 virtual machines and virtual machine scale sets. It automatically enables Secure Boot and vTPM for supported deployments.

dotnet: Strengthening NuGet Supply Chain Security: Reducing API Key Lifetime

.NET

2026-08-03

NuGet API key lifetimes will be reduced to 30 days starting August 17, with the goal of improving supply chain security.

July (6)

github: Restricting npm bypass-2FA granular access tokens

GitHub

2026-07-31

npm granular access tokens configured to bypass 2FA can no longer be used for sensitive account, organization, and package management actions. Those operations now require an interactive 2FA challenge.

github: CodeQL 2.26.1 improves analysis accuracy and framework coverage

GitHub

2026-07-29

CodeQL 2.26.1 has been released with improvements to analysis accuracy and broader framework coverage, including Go. The changelog item is brief and does not list additional specific fixes or language/framework details.

github: npm publish-time malware scanning and dual-use metadata

GitHub

2026-07-28

npm is adding automatic malware scanning when packages are published, along with a new metadata requirement for packages that may be used for both benign and malicious purposes. The changelog says this is part of ongoing supply-chain security work and explains what publishers should expect.

azure: [In preview] Public Preview: Azure Enclave

Azure Updates

2026-07-28

Azure Enclave is now in public preview for Microsoft Azure, Azure Government, Azure Government Secret, and Azure Government Top Secret. It is intended to simplify deployment and management of isolated cloud environments for sensitive workloads.

github: GitHub Actions holds potentially malicious workflows for approval

GitHub

2026-07-28

GitHub Actions now detects potentially malicious workflow changes in public repositories and requires approval before they run. The change is intended to reduce supply-chain abuse from compromised credentials used to add workflows that steal CI/CD secrets or perform follow-on attacks.

security: Rethinking security for the age of AI

Microsoft Security Blog

2026-07-27

Microsoft says cybersecurity is changing in the AI era and introduces a new security cyber stack called Project Perception. The post frames this as a rethink of security architecture rather than a specific product release.