https://securitynews.ms/news/Microsoft Security announcements from the Security Blog, Tech Community and Azure Updates.enThu, 12 Nov 2026 17:00:00 +0000https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/Thu, 12 Nov 2026 17:00:00 +0000Microsoft Threat IntelligenceMicrosoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities.https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/Wed, 11 Nov 2026 19:49:57 +0000Microsoft Threat IntelligenceThreat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect, investigate, and remediate this activity.https://azure.microsoft.com/updates?id=580155https://azure.microsoft.com/updates?id=580155Wed, 11 Nov 2026 18:18:27 +0000Azure UpdatesAnnouncing the public preview of rate limit grouping for Azure Web Application Firewall (WAF) on Azure Front Door Premium. By default, a rate limit rule counts requests separately for each client IP address. Distributed attacks get around this by spreadinhttps://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/https://www.microsoft.com/en-us/security/blog/2026/11/11/lessons-from-59-linux-kernel-bug-reports/Wed, 11 Nov 2026 16:55:00 +0000Microsoft Security BlogMicrosoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. The research includes eight demonstrated local root privilege-escalation exploits and examines the challenges of turning AI-generated findings…https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/Tue, 10 Nov 2026 23:00:00 +0000Microsoft Threat IntelligenceMicrosoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload; Microsoft Research has also found that this threat is detectable by…https://www.microsoft.com/en-us/security/blog/2026/11/09/forge-lab-uses-agentic-tools-to-identify-memory-safety-issues-in-rust/https://www.microsoft.com/en-us/security/blog/2026/11/09/forge-lab-uses-agentic-tools-to-identify-memory-safety-issues-in-rust/Mon, 09 Nov 2026 20:17:31 +0000Microsoft Security BlogMicrosoft FORGE Lab researchers found memory-safety bugs in Rust's core and std libraries, including cases where safe Rust code can trigger undefined behavior. Using Hyenas, FORGE's frontier research version of codename MDASH, the team investigated three patterns of misplaced trust in unsafe…https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sectorhttps://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sectorSat, 07 Nov 2026 02:44:34 +0000Microsoft Security BlogIn October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.https://techcommunity.microsoft.com/t5/microsoft-entra-blog/what-s-new-in-microsoft-entra-november-2026/ba-p/4556457https://techcommunity.microsoft.com/t5/microsoft-entra-blog/what-s-new-in-microsoft-entra-november-2026/ba-p/4556457Fri, 06 Nov 2026 21:04:04 +0000Microsoft Entra BlogDon't miss our Microsoft Ignite announcements. Tune in or join us in person for AI is changing access: See how Microsoft Entra helps you stay ahead on November 18, 2026, at 10:15 AM Pacific for secure access news and demos from our…https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/enhancements-to-the-protection-and-posture-insights-report/ba-p/4568163https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/enhancements-to-the-protection-and-posture-insights-report/ba-p/4568163Fri, 06 Nov 2026 13:48:48 +0000Microsoft Defender for Office 365 BlogEarlier this year, we introduced the Protection & Posture Insights report: an on-demand, tenant-specific view of the email & collaboration threats targeting your organization, how well Microsoft Defender is stopping them, and where your configuration can be strengthened. Today, we're announcing the…https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secretshttps://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secretsThu, 05 Nov 2026 23:46:50 +0000Microsoft Security BlogMicrosoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application’s tenant. Agents…https://azure.microsoft.com/updates?id=577668https://azure.microsoft.com/updates?id=577668Thu, 05 Nov 2026 23:19:48 +0000Azure UpdatesAzure Front Door now supports configurable TLS key exchange policies, including hybrid post-quantum key exchange, to help you prepare for evolving cryptographic threats while meeting your security and client compatibility requirements. Choose a predefinedhttps://azure.microsoft.com/updates?id=579280https://azure.microsoft.com/updates?id=579280Thu, 05 Nov 2026 17:11:31 +0000Azure UpdatesWAF Insights for Azure Application Gateway Web Application Firewall (WAF) is now generally available. WAF Insights is a built-in experience in the WAF policy that brings WAF logs and metrics together in interactive dashboards, so you can investigate blockhttps://techcommunity.microsoft.com/blog/microsoft-security-blog/new-investments-to-reduce-on-premises-security-risk/4570381https://techcommunity.microsoft.com/blog/microsoft-security-blog/new-investments-to-reduce-on-premises-security-risk/4570381Thu, 05 Nov 2026 17:10:14 +0000Microsoft Security BlogWe’re announcing a new on-premises security initiative, bringing together guidance, migration, and product investments.https://www.microsoft.com/en-us/security/blog/2026/11/05/whats-new-in-microsoft-security-november-2026/https://www.microsoft.com/en-us/security/blog/2026/11/05/whats-new-in-microsoft-security-november-2026/Thu, 05 Nov 2026 17:00:00 +0000Microsoft Security BlogMicrosoft Security’s November 2026 updates strengthen AI agent security, least privilege, threat protection, and exposure management.https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/Thu, 05 Nov 2026 16:00:00 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security…https://azure.microsoft.com/updates?id=579507https://azure.microsoft.com/updates?id=579507Wed, 04 Nov 2026 18:09:43 +0000Azure UpdatesAzure Firewall now supports application rules in IPv6 Public Preview, enabling layer 7 filtering for IPv6 HTTP and HTTPS traffic. The enhancement extends application-level controls to IPv6 and dual-stack deployments, helping customers maintain consistenthttps://techcommunity.microsoft.com/t5/microsoft-entra-blog/scale-access-controls-with-microsoft-entra-conditional-access/ba-p/4569647https://techcommunity.microsoft.com/t5/microsoft-entra-blog/scale-access-controls-with-microsoft-entra-conditional-access/ba-p/4569647Wed, 04 Nov 2026 17:00:00 +0000Microsoft Entra BlogToday we’re announcing the public preview of Microsoft Entra Conditional Access policy plans —a new framework for enterprise-scale access control. Instead of managing dozens of individual policies, policy plans let you define your access intent once and enforce it consistently across every…https://techcommunity.microsoft.com/t5/azure-network-security-blog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade/ba-p/4566623https://techcommunity.microsoft.com/t5/azure-network-security-blog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade/ba-p/4566623Wed, 04 Nov 2026 15:56:30 +0000Azure Network Security BlogWritten in collaboration with yuvalpery and Gunjan Jain Introduction Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP. We strongly recommend that customers upgrade to a patched version of PHP as soon as possible. Upgrading is the only way…https://techcommunity.microsoft.com/t5/microsoft-security-community/the-ciso-cheat-sheet-to-microsoft-digital-defense-report-2026/ba-p/4566642https://techcommunity.microsoft.com/t5/microsoft-security-community/the-ciso-cheat-sheet-to-microsoft-digital-defense-report-2026/ba-p/4566642Tue, 03 Nov 2026 22:55:05 +0000Microsoft Security Community BlogI know we’re all busy, so I’ve pulled the most important data from this year’s Microsoft Digital Defense Report into one short read. The full report is well worth exploring, but this article focuses on the numbers and trends most relevant to…https://techcommunity.microsoft.com/t5/microsoft-purview-blog/what-stops-a-service-side-auto-labeling-rollout-from-being/ba-p/4567706https://techcommunity.microsoft.com/t5/microsoft-purview-blog/what-stops-a-service-side-auto-labeling-rollout-from-being/ba-p/4567706Tue, 03 Nov 2026 22:21:54 +0000Microsoft Purview BlogThe four questions every approver asks Access Proof Reversibility Scale “Will labeling change who can open our files?” “Can we prove what gets labeled — and why?” “Can we undo it if something goes wrong?” “Will it finish at our size?” Scenarios…https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-news-you-can-use-october-2026/ba-p/4552396https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-news-you-can-use-october-2026/ba-p/4552396Tue, 03 Nov 2026 22:00:00 +0000Windows IT Pro Blog (security posts)October brought plenty to keep on your radar, from new Windows 11 features and accessibility improvements to security changes that might require some planning. We've pulled together the highlights, hardening changes, resources, and upcoming lifecycle milestones to help you stay ready for…https://azure.microsoft.com/updates?id=576382https://azure.microsoft.com/updates?id=576382Tue, 03 Nov 2026 21:17:08 +0000Azure UpdatesApplication Gateway for Containers now supports centralized JSON Web Token validation through the AuthPolicy custom resource. Teams can validate a token signature, issuer, lifetime, and configured audience by using signing keys retrieved from a trusted HThttps://azure.microsoft.com/updates?id=576388https://azure.microsoft.com/updates?id=576388Tue, 03 Nov 2026 21:16:36 +0000Azure UpdatesApplication Gateway for Containers now supports Model Context Protocol routing through the new MCPRoute custom resource. Platform teams can publish MCP servers behind a stable hostname and path while centralizing TLS, JWT validation, Web Application Firewhttps://azure.microsoft.com/updates?id=576393https://azure.microsoft.com/updates?id=576393Tue, 03 Nov 2026 21:15:46 +0000Azure UpdatesApplication Gateway for Containers now supports private frontends that are reachable only through approved Azure Private Link private endpoints. This enables organizations to keep internal applications, shared services, and cross-cluster traffic on privathttps://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/Tue, 03 Nov 2026 17:32:47 +0000Microsoft Threat IntelligenceMicrosoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.https://techcommunity.microsoft.com/t5/microsoft-entra-blog/global-secure-access-private-access-and-internet-access-in-one/ba-p/4569098https://techcommunity.microsoft.com/t5/microsoft-entra-blog/global-secure-access-private-access-and-internet-access-in-one/ba-p/4569098Mon, 02 Nov 2026 22:05:34 +0000Microsoft Entra BlogEmployees, and now AI agents, need secure access to resources wherever they live: the internet, Microsoft 365 and SaaS, cloud and datacenter workloads, on-premises apps, and AI services. Zero Trust means evaluating every one of those connections against full context, including identity…https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/Mon, 02 Nov 2026 20:20:59 +0000Microsoft Threat IntelligenceReal-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation likelihood, exposure, and potential blast radius.https://azure.microsoft.com/updates?id=576255https://azure.microsoft.com/updates?id=576255Mon, 02 Nov 2026 19:22:28 +0000Azure UpdatesThis is the formal notice that Microsoft plans to deprecate the operational technology (OT) security component of Microsoft Defender for IoT. The service will be fully deprecated in October 2029, following a three-year transition period.This change appliehttps://techcommunity.microsoft.com/t5/azure-network-security-blog/protect-against-brotli-cve-2026-111497-with-azure-web/ba-p/4567288https://techcommunity.microsoft.com/t5/azure-network-security-blog/protect-against-brotli-cve-2026-111497-with-azure-web/ba-p/4567288Mon, 02 Nov 2026 18:53:26 +0000Azure Network Security BlogGoogle Brotli versions 1.0.3 through 1.2.0 contain a buffer overflow vulnerability in the Brotli decoder, according to the recently published CVE-2026-111497 . A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory, expose sensitive memory contents, cause a…https://techcommunity.microsoft.com/t5/microsoft-purview-blog/scaling-classification-and-labeling-an-interactive-reference/ba-p/4560925https://techcommunity.microsoft.com/t5/microsoft-purview-blog/scaling-classification-and-labeling-an-interactive-reference/ba-p/4560925Mon, 02 Nov 2026 18:31:43 +0000Microsoft Purview BlogIn April, I published a set of referential architecture diagrams for Microsoft Purview — Microsoft Purview Referential Architecture Diagrams . They have been useful in workshops and training sessions for a simple reason: one picture is worth a thousand words - attempting…https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/Sat, 31 Oct 2026 01:02:57 +0000Microsoft Threat IntelligenceMicrosoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.https://techcommunity.microsoft.com/t5/microsoft-entra-blog/ai-agents-are-coming-are-your-identity-controls-prepared/ba-p/4515964https://techcommunity.microsoft.com/t5/microsoft-entra-blog/ai-agents-are-coming-are-your-identity-controls-prepared/ba-p/4515964Fri, 30 Oct 2026 19:54:24 +0000Microsoft Entra BlogAI is reshaping identity risk. Attackers now use AI to automate phishing, social engineering, and privilege escalation, making credential theft faster and more convincing than ever. SMS codes and push approvals can be intercepted, while standing privileges give attackers reach far beyond…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-october-2026/ba-p/4568804https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-october-2026/ba-p/4568804Fri, 30 Oct 2026 16:44:57 +0000Microsoft Sentinel BlogWelcome back to What's new in Microsoft Sentinel. In October, cross-tenant delegated access reaches general availability so you can run security operations across tenants with least privilege, the Advanced Security Information Model (ASIM) EmailEvent schema gives you one consistent structure for email…https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/Fri, 30 Oct 2026 16:11:44 +0000Microsoft Threat IntelligenceTeams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.https://techcommunity.microsoft.com/blog/dstblog/interim-guidance-for-cuba-dst-2026/4568608https://techcommunity.microsoft.com/blog/dstblog/interim-guidance-for-cuba-dst-2026/4568608Fri, 30 Oct 2026 02:30:06 +0000Microsoft Tech CommunityOn October 27, 2026, the Republic of Cuba made an official announcement about a Daylight-Saving Time (DST) time zone change. Cuba has canceled 2026 year’s...https://techcommunity.microsoft.com/blog/intunecustomersuccess/new-policy-implementation-and-web-enrollment-for-android-personally-owned-work-p/4370417https://techcommunity.microsoft.com/blog/intunecustomersuccess/new-policy-implementation-and-web-enrollment-for-android-personally-owned-work-p/4370417Thu, 29 Oct 2026 21:49:46 +0000Microsoft Tech CommunityWe’re happy to announce two improvements for the management of Android personally owned work profile devices with Microsoft Intune, which is now generally...https://techcommunity.microsoft.com/t5/microsoft-intune-blog/what-s-new-in-microsoft-intune-october/ba-p/4537396https://techcommunity.microsoft.com/t5/microsoft-intune-blog/what-s-new-in-microsoft-intune-october/ba-p/4537396Thu, 29 Oct 2026 18:00:00 +0000Microsoft Intune BlogMost changes to a device happen without the admin watching. A user turns off BitLocker to troubleshoot something. Patch Tuesday arrives. An agent starts working on a Cloud PC from an admin-configured pool. October’s new capabilities give admins more say over who…https://azure.microsoft.com/updates?id=578681https://azure.microsoft.com/updates?id=578681Thu, 29 Oct 2026 17:09:49 +0000Azure UpdatesAnnouncing the general availability of the HTTP DDoS ruleset for Azure Web Application Firewall (WAF) on Azure Front Door Premium. HTTP-layer DDoS attacks remain a leading cause of application downtime, and static controls such as IP filters and fixed rathttps://techcommunity.microsoft.com/t5/microsoft-defender-blog/defending-linux-in-the-age-of-ai-operated-attacks/ba-p/4557210https://techcommunity.microsoft.com/t5/microsoft-defender-blog/defending-linux-in-the-age-of-ai-operated-attacks/ba-p/4557210Thu, 29 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogLinux supports cloud services, containers, developer environments, business-critical applications, and a growing share of AI infrastructure. That makes Linux both essential to modern enterprises and increasingly attractive to attackers. AI is compressing the time required to research targets, vary payloads, and adapt…https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/Thu, 29 Oct 2026 16:00:00 +0000Microsoft Threat IntelligenceAs Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption. This blog breaks down how North…https://techcommunity.microsoft.com/t5/microsoft-defender-blog/now-generally-available-discover-local-ai-agents-with-microsoft/ba-p/4568216https://techcommunity.microsoft.com/t5/microsoft-defender-blog/now-generally-available-discover-local-ai-agents-with-microsoft/ba-p/4568216Thu, 29 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogAs local agents have moved from experimentation into everyday work, traditional security visibility is no longer enough. Unlike static software, local agents such as coding assistants, command-line agents, desktop applications, and agentic development environments can operate on endpoints with access to a…https://techcommunity.microsoft.com/t5/intune-customer-success/establish-a-macos-security-baseline-with-mscp-and-microsoft/ba-p/4568222https://techcommunity.microsoft.com/t5/intune-customer-success/establish-a-macos-security-baseline-with-mscp-and-microsoft/ba-p/4568222Wed, 28 Oct 2026 17:43:02 +0000Intune Customer SuccessBy: Iris Yuning Ye, Product Manager | Microsoft Intune Organizations that manage Mac devices need a reliable way to evaluate their security posture against a recognized baseline. Microsoft Intune custom compliance provides the device compliance evaluation policy, and the National Institute of…https://www.microsoft.com/en-us/security/blog/2026/10/28/the-cisos-evolving-role-protecting-and-defending-in-the-agentic-era/https://www.microsoft.com/en-us/security/blog/2026/10/28/the-cisos-evolving-role-protecting-and-defending-in-the-agentic-era/Wed, 28 Oct 2026 16:00:00 +0000Microsoft Security BlogAs AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how security leaders can approach both.https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/growing-our-connector-ecosystem-with-500-microsoft-sentinel/ba-p/4567832https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/growing-our-connector-ecosystem-with-500-microsoft-sentinel/ba-p/4567832Wed, 28 Oct 2026 16:00:00 +0000Microsoft Sentinel BlogConnecting the modern security environment Having spent years working across Microsoft's cloud, AI, and customer-facing organizations. I have seen that technology delivers the greatest value when it works with the environments customers already operate. That's especially true in cybersecurity. Most organizations rely…https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-26h2-security-baseline/ba-p/4560382https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-26h2-security-baseline/ba-p/4560382Tue, 27 Oct 2026 19:54:36 +0000Microsoft Security Baselines BlogUpdate : The Windows 11, version 26H2 security baseline has been updated to reflect the general availability of Administrator protection. An updated v2 package is now available, and organizations should review and test the existing Administrator protection configuration as appropriate for their…https://techcommunity.microsoft.com/t5/microsoft-security-community/large-os-disk-encryption-is-now-generally-available-for-azure/ba-p/4564613https://techcommunity.microsoft.com/t5/microsoft-security-community/large-os-disk-encryption-is-now-generally-available-for-azure/ba-p/4564613Tue, 27 Oct 2026 17:15:28 +0000Microsoft Security Community BlogToday, we are excited to announce the General Availability of Large OS Disk Encryption (LOSDE) for Azure Confidential VM migration scenarios. This capability removes a key adoption barrier for customers migrating sensitive workloads to Azure Confidential Virtual Machines by enabling encryption for…https://azure.microsoft.com/updates?id=578153https://azure.microsoft.com/updates?id=578153Tue, 27 Oct 2026 16:58:04 +0000Azure UpdatesAnnouncing the general availability of profile and route level policies for Azure Web Application Firewall (WAF) on Azure Front Door Premium. WAF policies are no longer limited to individual domains: you can now apply broad baseline protection across an ehttps://techcommunity.microsoft.com/t5/microsoft-defender-blog/part-4-see-investigate-and-measure-email-and-collaboration/ba-p/4562274https://techcommunity.microsoft.com/t5/microsoft-defender-blog/part-4-see-investigate-and-measure-email-and-collaboration/ba-p/4562274Tue, 27 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogAttacks rarely stay in one channel. A flood of spam email, a Teams chat from an unfamiliar organization, and a call from "the helpdesk" can all be part of the same attempt. Security teams need a unified way to see where attacks…https://techcommunity.microsoft.com/t5/microsoft-entra-blog/why-identity-needs-network-insight-to-make-zero-trust-work/ba-p/4566630https://techcommunity.microsoft.com/t5/microsoft-entra-blog/why-identity-needs-network-insight-to-make-zero-trust-work/ba-p/4566630Tue, 27 Oct 2026 15:00:00 +0000Microsoft Entra BlogYour users sign in successfully—and then what? The session can be hijacked, device posture can degrade, and traffic to non-federated SaaS and AI apps can slip past the identity controls you trust to protect them. That’s the gap admins see every day…https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-waf-custom-rules-for-php2shell-mitigation/ba-p/4566684https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-waf-custom-rules-for-php2shell-mitigation/ba-p/4566684Mon, 26 Oct 2026 19:00:38 +0000Azure Network Security BlogWritten in collaboration with Gunjan Jain and yuvalpery As described in our earlier blog, Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations , we strongly recommend upgrading to a patched version of PHP as soon as possible. Upgrading PHP…https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/proofpoint-s-core-email-protection-api-solution-joins-the/ba-p/4567264https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/proofpoint-s-core-email-protection-api-solution-joins-the/ba-p/4567264Mon, 26 Oct 2026 16:00:00 +0000Microsoft Defender XDR BlogEmail remains the most exploited gateway for cyberattacks, as the threat landscape continues to get more sophisticated with attackers using AI to scale phishing, malware, and business email compromise. Microsoft Defender is a leading email security solution , helping organizations stay ahead…https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-156/ba-p/4567729https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-156/ba-p/4567729Mon, 26 Oct 2026 12:38:12 +0000Microsoft Security Baselines BlogWe have reviewed the new settings in Microsoft Edge version 156 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 151 security baseline remains our recommended configuration and can be downloaded from the Microsoft Security…https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/Fri, 23 Oct 2026 18:12:19 +0000Microsoft Security BlogMicrosoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing%e2%80%afwindows-driver%e2%80%afsecurity%e2%80%afremoving-trust-for-the-cross-signed-driver%e2%80%afpro/4504818https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing%e2%80%afwindows-driver%e2%80%afsecurity%e2%80%afremoving-trust-for-the-cross-signed-driver%e2%80%afpro/4504818Thu, 22 Oct 2026 23:01:56 +0000Windows IT Pro Blog (security posts)Microsoft announces the removal of trust for all kernel drivers signed by the deprecated cross-signed root program, enhancing Windows security by enforcing...https://techcommunity.microsoft.com/blog/windows-itpro-blog/how-hotpatch-updates-help-keep-windows-secure-by-design/4508188https://techcommunity.microsoft.com/blog/windows-itpro-blog/how-hotpatch-updates-help-keep-windows-secure-by-design/4508188Thu, 22 Oct 2026 22:59:38 +0000Windows IT Pro Blog (security posts)Explore the secure-by-default approach to keeping Windows 11 protected and productive.https://techcommunity.microsoft.com/blog/windows-itpro-blog/hardening-administrative-actions-what-it-pros-need-to-know/4503956https://techcommunity.microsoft.com/blog/windows-itpro-blog/hardening-administrative-actions-what-it-pros-need-to-know/4503956Thu, 22 Oct 2026 22:58:54 +0000Windows IT Pro Blog (security posts)Hardening administrative actions boosts Windows security, but might require updates to imaging, cloning, and auth workflows. Learn more.https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526Thu, 22 Oct 2026 22:57:51 +0000Microsoft Tech CommunityLearn how Windows is moving toward an NTLM-independent future with enhanced auditing, Kerberos enhancements, and a phased roadmap.https://techcommunity.microsoft.com/blog/windows-itpro-blog/building-a-modern-secure-and-seamless-print-experience-for-windows/4499051https://techcommunity.microsoft.com/blog/windows-itpro-blog/building-a-modern-secure-and-seamless-print-experience-for-windows/4499051Thu, 22 Oct 2026 22:42:38 +0000Windows IT Pro Blog (security posts)Windows is rethinking printing with a universal, secure platform designed to work seamlessly across devices and chips.https://techcommunity.microsoft.com/blog/windows-itpro-blog/securing-devices-faster-with-hotpatch-updates-on-by-default/4500066https://techcommunity.microsoft.com/blog/windows-itpro-blog/securing-devices-faster-with-hotpatch-updates-on-by-default/4500066Thu, 22 Oct 2026 22:42:01 +0000Windows IT Pro Blog (security posts)Get Windows devices secure faster with hotpatch updates enabled by default in Microsoft Intune.https://techcommunity.microsoft.com/blog/windows-itpro-blog/unlocking-secure-agentic-productivity-with-windows-365-for-agents/4499149https://techcommunity.microsoft.com/blog/windows-itpro-blog/unlocking-secure-agentic-productivity-with-windows-365-for-agents/4499149Thu, 22 Oct 2026 22:39:38 +0000Windows IT Pro Blog (security posts)Run AI agents securely at scale in legacy and UI-based apps with Windows 365 for Agents and enterprise-grade governance