Security - 7

2026 (11)

April (7)

security: Inside an AI‑enabled device code phishing campaign

Microsoft Security Blog

2026-04-06

Microsoft describes a new device code phishing campaign that uses AI and end-to-end automation to generate live authentication codes on demand. The result is more scalable account compromise, higher success rates, and longer post-compromise access.

github: Organization firewall settings for Copilot cloud agent

GitHub

2026-04-03

GitHub added organization-level firewall settings for Copilot cloud agent. The built-in agent firewall can now be configured centrally to control internet access and help reduce prompt injection and data exfiltration risk.

github: GitHub Actions: Early April 2026 updates

GitHub

2026-04-02

GitHub Actions added entrypoint and command overrides for service containers. The update also includes new security features: OIDC custom properties and VNET failover.

security: Threat actor abuse of AI accelerates from tool to cyberattack surface

Microsoft Security Blog

2026-04-02

Microsoft says threat actors are increasingly using generative AI to improve cyberattacks, including much higher phishing click-through rates and industrialized MFA bypass. The post frames AI as part of the attack surface, not just a tool attackers use.

github: The Security tab is now Security & quality

GitHub

2026-04-02

GitHub has renamed the top-level Security tab to Security & quality across repositories, organizations, and enterprises on github.com. The navigation now groups code quality findings together with security-related information.

security: Mitigating the Axios npm supply chain compromise

Microsoft Security Blog

2026-04-01

Microsoft reports that Axios was compromised in a March 31, 2026 npm supply chain attack. Two newly published version-update packages were used to download from command-and-control infrastructure, which Microsoft Threat Intelligence attributes to the North Korean actor Sapphire Sleet.

azure: [Launched] Generally Available: Azure Data Box enhances compliance with automatic Secure Erasure Certificates

Azure Updates

2026-04-01

Azure Data Box now automatically provides a downloadable Secure Erasure Certificate for each completed order. The certificate verifies the device data was securely erased according to NIST 800-88 Revision 2.

March (4)

azure: [Launched] Generally Available: Azure DevOps March 2026 updates

Azure Updates

2026-03-31

Azure DevOps March 2026 updates include the Remote MCP Server entering public preview. The release also mentions security improvements.

azure: [Launched] Generally Available: User delegation SAS for Azure Tables, Azure Files, and Azure Queues

Azure Updates

2026-03-31

User delegation SAS is now generally available for Azure Tables, Azure Files, and Azure Queues. It provides a more secure SAS option than account or service SAS by binding the token to the delegator.

github: GitHub secret scanning — coverage update

GitHub

2026-03-31

GitHub secret scanning added nine new secret detectors from seven providers as part of a coverage update. The update includes detectors for providers such as Langchain, Salesforce, and Figma, along with additional secret types from Figma, Google, and OpenVSX.

security: Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio

Microsoft Security Blog

2026-03-30

Microsoft published a security blog post mapping OWASP’s Top 10 risks for agentic applications to mitigations in Microsoft Copilot Studio. The article frames agentic AI as introducing new security risks and presents Copilot Studio as a way to address them.