Security - 4

2026 (12)

April (10)

github: Dependabot alerts are now assignable to AI agents for remediation

GitHub

2026-04-07

Dependabot alerts can now be assigned to AI coding agents for remediation, including Copilot, Claude, and Codex. This is intended for vulnerabilities that require code changes beyond a simple dependency version update.

security: SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

Microsoft Security Blog

2026-04-07

Microsoft says Forest Blizzard, a threat actor linked to the Russian military, is compromising insecure home and small-office routers and changing their settings to support malicious infrastructure. The activity includes DNS hijacking and adversary-in-the-middle attacks.

azure: [Launched] Generally Available: Network Security Perimeter for Azure Service Bus

Azure Updates

2026-04-06

Network Security Perimeter support for Azure Service Bus is now generally available. It lets you define a logical network boundary around Service Bus namespaces and other Azure PaaS resources to block unauthorized public access.

security: Inside an AI‑enabled device code phishing campaign

Microsoft Security Blog

2026-04-06

Microsoft describes a new device code phishing campaign that uses AI and end-to-end automation to generate live authentication codes on demand. The result is more scalable account compromise, higher success rates, and longer post-compromise access.

github: Organization firewall settings for Copilot cloud agent

GitHub

2026-04-03

GitHub added organization-level firewall settings for Copilot cloud agent. The built-in agent firewall can now be configured centrally to control internet access and help reduce prompt injection and data exfiltration risk.

github: GitHub Actions: Early April 2026 updates

GitHub

2026-04-02

GitHub Actions added entrypoint and command overrides for service containers. The update also includes new security features: OIDC custom properties and VNET failover.

security: Threat actor abuse of AI accelerates from tool to cyberattack surface

Microsoft Security Blog

2026-04-02

Microsoft says threat actors are increasingly using generative AI to improve cyberattacks, including much higher phishing click-through rates and industrialized MFA bypass. The post frames AI as part of the attack surface, not just a tool attackers use.

github: The Security tab is now Security & quality

GitHub

2026-04-02

GitHub has renamed the top-level Security tab to Security & quality across repositories, organizations, and enterprises on github.com. The navigation now groups code quality findings together with security-related information.

security: Mitigating the Axios npm supply chain compromise

Microsoft Security Blog

2026-04-01

Microsoft reports that Axios was compromised in a March 31, 2026 npm supply chain attack. Two newly published version-update packages were used to download from command-and-control infrastructure, which Microsoft Threat Intelligence attributes to the North Korean actor Sapphire Sleet.

azure: [Launched] Generally Available: Azure Data Box enhances compliance with automatic Secure Erasure Certificates

Azure Updates

2026-04-01

Azure Data Box now automatically provides a downloadable Secure Erasure Certificate for each completed order. The certificate verifies the device data was securely erased according to NIST 800-88 Revision 2.

March (2)

azure: [Launched] Generally Available: Azure DevOps March 2026 updates

Azure Updates

2026-03-31

Azure DevOps March 2026 updates include the Remote MCP Server entering public preview. The release also mentions security improvements.

azure: [Launched] Generally Available: User delegation SAS for Azure Tables, Azure Files, and Azure Queues

Azure Updates

2026-03-31

User delegation SAS is now generally available for Azure Tables, Azure Files, and Azure Queues. It provides a more secure SAS option than account or service SAS by binding the token to the delegator.