microsoft news
24 stories
Microsoft: AI Cuts Post-Compromise Attack Time to Minutes
Microsoft's Digital Defense Report 2026, released October 1, 2026, warns that artificial intelligence (AI) has dramatically accelerated portions of the cyber-attack lifecycle, compressing post-compromise activities from days to mere minutes. This rapid evolution, driven by threat actors' early adoption of AI, presents a significant challenge for cybersecurity defenders.
Windows 11 2026 Update released, here's everything you need to know
Microsoft has commenced the rollout of the Windows 11 2026 Update, designated as version 26H2, to all users. This annual feature update is not expected to introduce a significant number of new features for most users, as many enhancements have already been delivered through monthly Windows Updates for those running recent versions.
Microsoft Patches Record 973 Vulnerabilities Amidst Active Exploitation
Microsoft has released patches for an unprecedented 973 vulnerabilities as part of its latest Patch Tuesday update, a new record for the company. Among these, two specific vulnerabilities, identified as CVE-2026-81963 and CVE-2026-85880, are confirmed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to be actively exploited in the wild.
Attackers conceal phishing lures using invisible Unicode characters
Threat actors have been observed employing an advanced phishing technique known as ASCII smuggling, which leverages invisible Unicode characters to bypass email security filters. This method, previously noted in AI prompt injection attacks, involves embedding Unicode characters from the Tags block (U+E0000 to U+E007F) to obscure malicious instructions or keywords.
In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation
Recent reports indicate that Microsoft has issued patches for its cloud services, addressing potential vulnerabilities within its extensive infrastructure. This development is part of ongoing efforts by major cloud providers to maintain the security and integrity of their platforms against evolving threats.
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
A large-scale phishing campaign has been identified that leverages invisible Unicode tag characters to bypass email security filters. The campaign, which has been active for several months and involved millions of emails, was reported by Microsoft. The primary goal of the attackers appears to be the distribution of phishing lures, often disguised as business loan or funding opportunities.
Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
A remote code execution (RCE) vulnerability, identified as CVE-2026-63520, has been disclosed in Microsoft SharePoint, allowing an authenticated attacker to execute arbitrary code on a vulnerable server. When chained with an authentication bypass vulnerability, CVE-2026-55040, the exploit becomes unauthenticated.
Fake Microsoft security scans trick victims into uninstalling their antivirus
A new refund scam is leveraging fake Microsoft-branded security scans to trick users into uninstalling their legitimate antivirus software, ultimately aiming to steal personal, banking, and remote-access information. Multiple websites, operating under names like SysScan, present convincing but fraudulent security scans that invariably conclude the user's computer has severe issues, falsely…
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address them promptly. The newly cataloged flaws include a critical SQL injection vulnerability in Metabase, a use-after-free flaw in Microsoft Windows' Ancillary Function Driver for WinSock, and a heap…
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability, identified as CVE-2026-55040, according to recent reports. This exploitation campaign began shortly after a proof-of-concept (PoC) exploit for the flaw was publicly released. The vulnerability is described as a security feature bypass, enabling unauthenticated attackers to impersonate legitimate users within…
Microsoft Named Leader in Enterprise MDR/MXDR Report
Microsoft has been identified as a leader in the 2026 IDC MarketScape report focusing on Managed Detection and Response (MDR) and Managed Extended Detection and Response (MXDR) services tailored for enterprise clients. The report underscores the evolving landscape of cyber threats, particularly noting the emergence of AI-driven attack methodologies, and emphasizes the critical role of…
CISA Adds Fortinet and Microsoft Flaws to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to address them by July 19, 2026. The newly listed flaws include one affecting Microsoft SharePoint and two impacting Fortinet FortiSandbox products.
Microsoft SharePoint Server RCE Vulnerability Exploited in the Wild
Microsoft has confirmed active exploitation of a critical remote code execution (RCE) vulnerability, CVE-2026-58644, affecting on-premises deployments of its SharePoint Server. The vulnerability, which stems from the deserialization of untrusted data (CWE-502), allows an unauthenticated attacker to execute arbitrary code with a CVSS v3.1 score of 9.8 (Critical).
Microsoft Discusses AI and Supply Chain Threats at Black Hat
Microsoft Security is scheduled to present at Black Hat USA 2026, where the company will discuss how threat actors are increasingly targeting trusted systems to scale their attacks. The presentations will focus on threats to software, services, and artificial intelligence (AI) systems. Microsoft plans to share insights into earlier identification of these threats and emphasize the…
AI to Drive More Windows Security Updates, Microsoft Says
Microsoft has indicated that users of its Windows operating system should anticipate an increase in the volume of security updates. This projected rise is attributed to the company's expanding reliance on artificial intelligence (AI) to identify vulnerabilities within its codebase.
Microsoft to Retire OWA Light Client in Exchange Server
Microsoft has announced its intention to disable and ultimately remove the Outlook Web Access (OWA) Light client from Exchange Server in an upcoming update, projected for August 2026. The company stated that the decision aims to reduce legacy surface area, streamline engineering efforts, and allow for continued improvements to the standard Outlook on the web experience.
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
Microsoft has developed an internal artificial intelligence system designed to proactively assess and enhance the security of its cloud infrastructure. This AI-driven approach operates at a speed commensurate with the vast scale and intricate nature of Microsoft's hyper-scale cloud environments.
Microsoft to enable Windows settings backup by default for orgs
Microsoft will enable its Windows settings backup and restore tool by default for enterprise systems that are joined to Microsoft Entra or are Microsoft Entra hybrid-joined, beginning with the Windows 11 26H2 update. This change will apply to eligible devices where administrators have not explicitly configured the backup and restore policy.
Microsoft testing new Cloud Rebuild Windows 11 recovery feature
Microsoft is currently testing a new recovery feature for Windows 11 called Cloud Rebuild. This functionality is available in the latest Insider Preview builds for users in the Experimental channel. Cloud Rebuild is designed to remotely initiate a complete reinstallation of the operating system from the cloud, targeting devices that are experiencing persistent issues or have become inoperable.
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
Researchers have identified a sophisticated phishing campaign that bypasses traditional URL-checking defenses by exploiting a legitimate Microsoft authentication feature. The attack leverages the Microsoft Identity Platform's Device Authorization Grant, a protocol designed for devices with limited input capabilities, such as smart TVs or IoT devices, to authenticate users.
Improving security posture across the Microsoft partner ecosystem
Microsoft is implementing a new strategy to bolster security across its extensive partner ecosystem, with a particular emphasis on Cloud Solution Providers (CSPs). These partners play a vital role in the deployment and ongoing management of Microsoft's cloud services, including Azure and Microsoft 365. The company's initiative aims to ensure the partner network maintains a high standard of…
Microsoft named a leader in the Frost Radar for cloud and application runtime security
Microsoft has been recognized as a leader in the cloud and application runtime security market by Frost & Sullivan. The research firm's latest Frost Radar report places Microsoft at the forefront of this rapidly evolving security domain.
Accelerating the quantum-safe timeline
Microsoft is expediting its schedule for adopting post-quantum cryptography (PQC), now targeting 2029 as the year its products and services will be ready for the transition. This accelerated timeline reflects recent progress in quantum computing research and updated guidance from government entities.
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap
Azure AD Graph activity logs are now accessible within Elastic, enabling threat detection capabilities for security teams. Previously, this specific stream of telemetry was largely unavailable to customers for nearly a decade. Microsoft Graph Activity Logs, the newer interface, became generally available in April 2024, but the legacy graph.windows.net surface, frequently targeted by adversary…