#Microsoft
All CosmicBytez Labs articles tagged #Microsoft, across news, security advisories, how-to guides, and projects.
- News
Microsoft: October Windows Update May Break Smart App Control
KB5127648 can grey out Smart App Control on Windows 11 24H2+, blocking users from turning it on. No fix yet — only workarounds.
- News
Microsoft Patches Two Dozen RCE Flaws in Office, Including Zero-Click Outlook Bugs
Microsoft's October Office update fixes 24 critical RCE flaws, including five zero-click Outlook Reading Pane bugs rated CVSS 9.8.
- News
Microsoft Drops an Actively Exploited Zero-Day Among Record High of 1,413 Vulnerabilities
Microsoft patched a record 1,413 flaws in October, including an actively exploited Windows Shell zero-day that bypasses Mark of the Web warnings.
- News
Global Takedown Hits Network Behind 1 Billion Phishing Messages
Microsoft, Japan's NPA, and partners dismantled YAM Store, a phishing-kit marketplace tied to over 1 billion malicious messages in 150 countries.
- News
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's largest Patch Tuesday ever fixes 1,414 flaws, 78 critical, including an exploited Windows Shell zero-day and unauthenticated RCEs.
- News
Microsoft: Windows 11 23H2 Reaches End of Support in 30 Days
Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions stop getting security updates after November 10, 2026, Microsoft warns.
- News
Norway Fines Microsoft Ad Unit Xandr $9.6 Million Over Grindr Data Sharing
Norway's Datatilsynet fined Microsoft ad unit Xandr $9.6M (NOK 92M) for unlawfully sharing Grindr users' sexual orientation data with advertisers.
- Security
CVE-2026-105793: Command Injection in Microsoft UFO's Mobile MCP Server via Unsanitized ADB Key Codes
A flaw in Microsoft UFO's mobile MCP server lets attackers inject arbitrary ADB shell commands on connected Android devices.
- News
JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
JadePuffer (Storm-3168), an agentic AI actor, used exposed credentials to wipe 100+ Azure storage accounts and other resources in minutes.
- News
Microsoft Says Threat Actors Are Ahead in the Early AI Race
Microsoft's 2026 Digital Defense Report warns attackers are weaponizing AI faster than defenders, cutting exploit timelines to under 24 hours.
- News
Crypto Scammers Hijack Microsoft's Official X Account
Hackers briefly took over Microsoft's 13-million-follower X account to push a fake $Clippy crypto token before the company regained control.
- News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
China-nexus group Longlegs is still abusing SharePoint ToolShell flaws and a BYOVD EDR killer to deploy Warlock ransomware on critical infrastructure.
- News
'Warlock' Ransomware Hits Critical Infrastructure in Portuguese- and Spanish-Speaking Countries
A China-nexus threat actor is exploiting Microsoft SharePoint flaws, including ToolShell, to deploy Warlock ransomware against critical infrastructure.
- News
Microsoft's X Account Hacked in Crypto Pump-and-Dump Scheme
Hackers hijacked Microsoft's 13M-follower X account on Oct. 1 to push a fake $Clippy token tied to $MSFT before Microsoft regained control.
- News
WSL Containers Reaches General Availability, Bringing Native Linux Containers to Windows
Microsoft's WSL Containers feature exits preview with a new wslc.exe CLI, a Windows API, and enterprise controls — no Docker Desktop required.
- News
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft links its NeedyMantis implant to Storm-3069, found via DLL sideloading against telecoms, universities, and nonprofits since October 2025.
- News
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
Microsoft ties Storm-3168 to JADEPUFFER after two hijacked Azure service principals wiped 100+ storage accounts in a 7-minute burst.
- News
Microsoft Pauses KB5002907 Update After Office License Deactivations
Microsoft paused KB5002907 after the optional update deactivated or removed perpetual Office 2016 and 2019 installs on some devices.
- News
Microsoft Confirms Recent Windows Updates Cause Desktop Loading Failures
August and September 2026 Windows updates can leave users stuck on a black screen after sign-in, mainly hitting Azure Virtual Desktop hosts.
- News
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA added CVE-2026-65660 (SharePoint RCE, CVSS 8.8) and CVE-2026-67279 (MikroTik RouterOS, CVSS 6.9) to its KEV catalog citing active exploitation.
- News
Microsoft Plans to Deprecate Windows Deployment Services
Microsoft will deprecate the WDS server role starting with the next Windows Server release, pointing admins toward Configuration Manager instead.
- News
Microsoft Fixes Bug That Broke Windows File History Backup Feature
Microsoft fixed the File History backup bug from September 2026 updates via optional KB5124006/KB5124010 for Windows 11; Windows 10 fix still pending.
- News
New Windows Defender Zero-Day Blocks Microsoft Antivirus Updates
Researcher Abdelhamid Naceri released BigDiskBuster, a zero-day that freezes Windows Defender signature and platform updates indefinitely.
- News
SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE
CVE-2026-65660 was labeled a low-impact spoofing bug, but full technical details show it enables authenticated remote code execution.
- News
Two Arrested in UK After Microsoft Takedown of 'EvilTokens' AI Chatbot
Microsoft's DCU and UK police dismantled EvilTokens, an AI chatbot that automated account takeover and fraud for a $1,500 fee on Telegram.
- News
Microsoft to Retire Microsoft 365 Companion Apps in December
Calendar, People, and Files taskbar apps stop working December 16, 2026; admins must remove them from managed devices.
- News
Microsoft Reminds Admins to Migrate Entra ID Users to Passkeys Before SMS Retirement
Microsoft is retiring SMS first-factor sign-in for Entra ID on February 1, 2027, and is urging admins to move users to passkeys now.
- News
Microsoft: September 2026 Updates Break Windows File History Backup
September's cumulative updates broke File History across Windows 10 and 11, with backups failing silently and no fix yet available.
- News
Microsoft Fixes Broken Copy-and-Paste for Excel 2016 Users
KB5002914 broke copy-paste, autofill, and formula dragging in Excel; Microsoft's KB5002655 fixes it for MSI-based Office 2016, other versions still pending.
- News
Microsoft Shares Workaround for Windows Domain Login Issues
Microsoft confirms KB5124008 breaks AD domain login on some Windows 11 PCs and shares a registry workaround while a permanent fix is prepared.
- News
Microsoft: September Updates Break Audio on Some Windows PCs
KB5124008 and KB5124012 can break USB Audio Class 1.0 devices on Windows 11 24H2+, with no official fix yet — only a channel-mode workaround.
- News
Microsoft: September Updates Cause RDS Failures on Windows Server
Microsoft confirms September 2026 updates cause RDS/RDP failures on Windows Server 2019, 2022, and 2025, and has published workarounds for admins.
- News
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft details passkey-themed social engineering that hijacks Microsoft 365 accounts, plus a 1M-email AI-driven CEO invoice fraud campaign.
- News
Microsoft Fixes Teams and Outlook Launch Failures on ARM Windows PCs
A bug tied to August's security updates broke Teams and new Outlook on ARM devices like Surface Pro 11; September's Patch Tuesday fixes it.
- News
New 'BlueMoon' Exploit Kit Chains Chrome and Windows Zero-Days for Espionage
At least four espionage-linked threat clusters adopted the BlueMoon exploit kit within days, chaining Chrome and Windows zero-days for backdoor access.
- News
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
September's Patch Tuesday breaks records with 974 CVEs fixed, including two actively exploited Windows zero-days now on CISA's KEV catalog.
- Security
CVE-2026-81963: Windows Link Following Flaw Lets Local Attackers Reach SYSTEM
CISA added an actively exploited Windows Update Stack privilege escalation flaw to its KEV catalog, giving federal agencies until Sep 22 to patch.
- News
In Other News: Microsoft's Cloud Patches, Hacked Dropbox Accounts, Guardio's $1.1B Valuation
SecurityWeek's roundup: Microsoft patches 9 cloud service flaws, ~5,000 Dropbox accounts hit via a Lenovo ID flaw, and Guardio hits $1.1B valuation.
- News
Phishing Campaign Used Invisible Unicode Tag Characters to Slip Past Filters
Microsoft found a high-volume phishing operation hiding invisible Unicode tag characters inside words like 'funding' to dodge keyword-matching filters.
- News
Microsoft Asks Users to Ignore False 'Antivirus Is Turned Off' Errors
Microsoft confirms a Defender bug shows false "antivirus is off" alerts on Windows 11 26H1 and Server 2025 — protection is unaffected, fix pending.
- News
Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels
A new ClickFix variant tricks victims into running PowerShell in Windows Terminal, sideloading a DLL that opens a persistent reverse-tunnel backdoor.
- News
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
- News
Hackers Target Microsoft SharePoint RCE Chain With PoC Exploit
Attackers are probing a two-bug SharePoint chain — a JWT auth bypass plus a BCS flaw — after public PoCs made unauthenticated RCE reachable.
- News
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
A $320/month AitM phishing kit rides real Docusign notification emails to relay Microsoft 365 logins and steal live session cookies.
- Security
CISA Adds 2019 Microsoft SQL Server RCE Flaw to KEV Catalog
CISA added CVE-2019-1068, a seven-year-old Microsoft SQL Server RCE flaw, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
- News
Microsoft Rolls Out Classic Outlook Theme for New Outlook Users
Microsoft is rolling out a Classic Outlook theme for Outlook on the web and New Outlook for Windows, giving users familiar visual styling from legacy Outlook.
- News
Microsoft Blames August 2026 Windows Gaming Crashes on RGB Lighting Devices
Microsoft says August 2026 Patch Tuesday updates are causing games to crash or fail to launch due to conflicts with RGB lighting peripheral software.
- Security
CVE-2026-62316: Microsoft UFO MCP Server DNS Rebinding and SSRF via Missing Host Validation
CVSS 8.8: Microsoft's UFO framework MCP server binds to localhost but skips Host/Origin header checks, enabling DNS rebinding and SSRF attacks. Fixed in 3.0.8.
- News
Microsoft Entra ID CVSS 10.0 Flaw Exploited in Wild, Allows Remote Code Execution
Microsoft warns of a CVSS 10.0 RCE flaw in Entra ID (CVE-2026-69836) exploited in the wild. No customer action required — Microsoft patched it server-side.
- News
New SynkLoader Malware Pushed in Microsoft Teams Phishing Campaign
SynkLoader is a new modular loader spread via Teams vishing that steals credentials, tunnels network traffic, and gives attackers persistent remote access.
- Security
Microsoft IKE Service Extensions Double Free RCE (CVE-2026-33824)
CISA-flagged double free vulnerability in Microsoft IKE Service Extensions enables unauthenticated remote code execution. Patch immediately.
- News
Hacker Claims 3.6 Million Azure Account Records Stolen from Major Companies
A threat actor is selling employee databases allegedly taken from Microsoft Azure infrastructure of multiple Fortune 500 firms via compromised credentials.
- News
Microsoft's Patch Tuesday Deluge Continues With August 2026 Updates
Microsoft's August 2026 Patch Tuesday drops critical fixes including a CVSS 9.8 Windows DNS RCE requiring no user interaction.
- Security
CVE-2026-50523: Microsoft PowerShell Local Command Injection Vulnerability
A command injection flaw in Microsoft PowerShell allows authorized local attackers to execute arbitrary code via improper input neutralization.
- News
Microsoft Patches LegacyHive Windows Zero-Day That Grants Admin Privileges
CVE-2026-62832 in Windows User Profile Service lets local users hijack registry hives and escalate to admin. Patch now via August Patch Tuesday.
- News
Microsoft Plugs Nearly 400 Security Holes in August 2026 Patch Tuesday
Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including a WinSock zero-day actively exploited in the wild and two publicly disclosed flaws.
- News
China-Linked Storm-1175 Deploys StormEncryptor Ransomware via Critical N-central Flaw
Microsoft tracks Storm-1175 pivoting from Medusa ransomware to a new strain — StormEncryptor — exploiting an N-able N-central authentication bypass that...
- News
Swiss Government SharePoint Breach Compromised 200 Accounts
Switzerland's Federal IT Office confirms hackers exploited Microsoft SharePoint vulnerabilities to breach federal servers and compromise approximately 200...
- News
Hijacked Hotel Wi-Fi Pushes Fake Browser Updates to Deliver CornFlake RAT
Microsoft tracks CaptiveCrunch, a Storm-2 operation that hijacks hotel captive portals to serve fake browser updates and install CornFlake — a...
- News
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Attackers are modifying DNS settings on Wi-Fi devices at hotels and conference centers to redirect users attempting to reach Microsoft 365 to convincing...
- News
Microsoft Blames Massive Microsoft 365 Outage on Automated Maintenance Bug
Microsoft has revealed that a bug in its automated network maintenance request system caused Thursday's major global outage by mistakenly removing IP...
- Security
CVE-2026-57989: Microsoft Edge Origin Validation Error Allows Remote Information Disclosure
A high-severity origin validation error in Microsoft Edge (Chromium-based) enables an unauthenticated remote attacker to disclose sensitive information...
- Security
CVE-2026-57990: Microsoft Edge Exposes Local Files and Directories to Remote Attackers
A high-severity access control flaw in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to access files or directories that should...
- News
Microsoft, Tech Companies Throw Weight Behind Spread of Open-Source AI
Microsoft, Meta, NVIDIA, IBM, Palantir, Perplexity, Mistral, Mozilla, The Linux Foundation, Hugging Face, and Dell Technologies have co-signed a letter...
- Security
CVE-2026-56163: Critical Auth Bypass in Azure Kubernetes Service Allows Privilege Escalation
A CVSS 10.0 vulnerability in Microsoft Azure Kubernetes Service allows unauthenticated attackers to escalate privileges over the network due to missing...
- Security
CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a critical deserialization of untrusted data vulnerability allowing unauthenticated attackers to execute arbitrary code over...
- News
Records Are Made to Be Broken: Patch Tuesday July 2026 Raises Triage Stakes
Microsoft's July 2026 Patch Tuesday set a new record with 622 CVEs addressed in a single release, including three actively exploited zero-days and more...
- News
Microsoft Warns of Surge in ACR Stealer Attacks on Enterprise Customers
Microsoft's threat intelligence team has flagged a significant spike in ACR Stealer campaigns targeting enterprise environments — harvesting...
- News
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit for a Windows User Profile Service privilege escalation vulnerability,...
- News
Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
Microsoft has detailed three distinct attack paths used by actors aligned with ShinyHunters to infiltrate corporate Salesforce environments over the past...
- Security
CVE-2026-56155: Microsoft AD FS Access Control Flaw Enables Golden SAML Attacks
Microsoft's July 2026 Patch Tuesday fixes CVE-2026-56155, an actively exploited privilege escalation flaw in Active Directory Federation Services....
- News
Breach at the Beach: Play the Ultimate Entra ID CTF
Varonis has launched Breach at the Beach, a free hands-on Capture the Flag competition designed to teach defenders how attackers abuse Microsoft Entra ID...
- News
Microsoft Reins in RoguePlanet Zero-Day After Public PoC Release
Researcher 'Nightmare-Eclipse' published a proof-of-concept exploit for a Windows Defender vulnerability in early June after dropping several other...
- News
'GodDamn' Ransomware Uses BYOVD Technique to Kill Security Software at US Companies
A new ransomware strain dubbed 'GodDamn' is leveraging a Microsoft-signed malicious kernel driver through the Bring Your Own Vulnerable Driver technique...
- News
Microsoft Patches RoguePlanet Zero-Day in Windows Defender After Public PoC
Microsoft has patched a Windows Defender zero-day vulnerability dubbed RoguePlanet after researcher 'Nightmare-Eclipse' released a working...
- News
GigaWiper: New Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Microsoft has dissected GigaWiper, a destructive Windows backdoor that combines three distinct destructive capabilities — full disk wiping, fake...
- News
ARToken PhaaS Exposes EvilTokens' Microsoft 365 Phishing Toolkit with AI-Powered BEC
Cisco Talos has uncovered ARToken, a Phishing-as-a-Service platform affiliated with EvilTokens that weaponizes Microsoft's OAuth device code flow to...
- Security
CVE-2026-41106: M365 Copilot Open Redirect Allows Unauthenticated Privilege Escalation
A critical open redirect vulnerability in Microsoft 365 Copilot rated CVSS 9.3 enables unauthenticated attackers to perform privilege escalation over the...
- News
CISA: Microsoft SharePoint RCE Flaw Now Actively Exploited
CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation of a high-severity SharePoint...
- News
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA has added a high-severity Microsoft SharePoint Server remote code execution vulnerability to its Known Exploited Vulnerabilities catalog following...
- News
BlueHammer Vulnerability Exploited in Ransomware Attacks Before Microsoft Patch
The Microsoft Defender vulnerability CVE-2026-33825 was actively exploited as a zero-day by ransomware groups before Microsoft had the chance to release a...
- News
CISA: Windows BlueHammer Flaw Now Exploited by Ransomware Gangs
CISA has confirmed that ransomware gangs are actively exploiting BlueHammer, a Microsoft Defender privilege escalation vulnerability previously used in...
- News
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input
Microsoft uncovered a fake Perplexity AI Chrome extension that silently captured every search query and address bar keystroke, routing the data to an...
- News
In a First, a Court Takedown Goes After Two Cybercrime Tools at Once
Microsoft and Europol dismantled both StealC and Amadey simultaneously in a single RICO filing — the first time a court-authorized takedown has targeted...
- News
Malicious Edge Extension "Edgecution" Abuses Native Messaging to Deploy Ransomware Backdoor
Zscaler researchers exposed 'Edgecution', a rogue Microsoft Edge extension that exploits Chrome's Native Messaging protocol to escape the browser sandbox...
- News
Three 'Cybercrime-as-a-Service' Operations Undercut by Microsoft and Law Enforcement
A two-week joint operation by Microsoft and Europol dismantled three major malware-as-a-service platforms — StealC, Amadey, and SocGholish — seizing 326...
- News
Amadey and StealC Malware Networks Disrupted, 27 Million Stolen Credentials Recovered
A coordinated law enforcement operation backed by Bitdefender, Bitsight, ESET, and Microsoft has dismantled the infrastructure powering Amadey and StealC,...
- News
Amadey and StealC Malware Operations Disrupted in Operation Endgame Action
Microsoft, Europol, and international law enforcement partners have dismantled infrastructure supporting the Amadey malware loader and StealC infostealer...
- News
Edgecution: Malicious Edge Extension Escapes Browser Sandbox via Native Messaging
A malicious Microsoft Edge extension dubbed 'Edgecution' abused the Native Messaging API to escape the browser sandbox and deliver a Python backdoor used...
- News
Microsoft and Europol Dismantle Three Cybercrime-as-a-Service Operations
Microsoft and Europol jointly targeted the full CaaS supply chain, seizing 300+ servers and disrupting SocGholish, Amadey, and StealC malware infrastructure.
- News
Microsoft Fixes AutoGen Studio Flaw That Enabled Code Execution
Microsoft has patched the AutoJack vulnerability chain in AutoGen Studio, its AI agent prototyping interface, which allowed attackers to manipulate agents...
- News
Microsoft Says Windows 11 26H2 Is Coming Soon, Details Upgrade Process
Microsoft has confirmed Windows 11 version 26H2 as the next feature update, with devices running 24H2 and 25H2 able to upgrade via a lightweight...
- News
A Record-Breaking Patch Tuesday for June 2026
Microsoft's June 2026 Patch Tuesday addressed nearly 200 security vulnerabilities — the highest single-month patch count in the company's history —...
- News
Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers
Microsoft has attributed a 88-minute automated supply chain attack against 142 Mastra AI npm packages — with over 1.1 million combined weekly downloads —...
- News
Microsoft June 2026 Updates Break Recycle Bin Confirmation Prompts on All Windows Versions
A bug introduced by June 2026 security updates causes Windows to display internal $R filenames instead of original filenames in the Recycle Bin deletion...
- News
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers have detailed AutoJack, a novel exploit chain that turns AI browsing agents into delivery vehicles for remote code execution by...
- News
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
Microsoft Threat Intelligence has exposed a cryptocurrency clipboard-hijacking campaign active since February 2026 that spreads via malicious USB LNK...
- News
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack
Security researchers have uncovered a DragonForce ransomware attack deploying a new Go-based backdoor that uses Microsoft Teams relay infrastructure for...
- News
Microsoft Working on Defender Patch for RoguePlanet Zero-Day
Microsoft has confirmed it is developing a security patch for the RoguePlanet zero-day vulnerability in Windows Defender, disclosed publicly last week,...
- News
Fake Microsoft Security Alerts Used to Deploy North Korean NarwhalRAT Malware
North Korean state-sponsored group APT37 (ScarCruft) is conducting spear-phishing campaigns impersonating Microsoft Account security notifications to...
- News
DragonForce Ransomware Hides C2 Traffic Inside Microsoft Teams Relays
DragonForce ransomware operators deployed a custom implant called Backdoor.Turn to camouflage command-and-control communications inside legitimate...
- News
SearchLeak: New Attack Turned Microsoft 365 Copilot into 1-Click Data Theft Tool
Researchers disclosed SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that allows attackers to steal sensitive data from a...
- News
In Other News: Google Security Layoffs, AudiA6 Takedown, $400M Coupang Fine
This week's security roundup covers Google's controversial security team layoffs, Europol's dismantling of the AudiA6 ransomware crypto laundering...
- News
Microsoft Patches Exploited Exchange Server Vulnerability CVE-2026-42897
Microsoft has released a patch for CVE-2026-42897, an Exchange Server zero-day that has been under active exploitation since at least May 14, 2026. The...
- News
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
Anonymous researcher Chaotic Eclipse released a PoC exploit for a new Microsoft Defender zero-day named RoguePlanet. The race condition flaw grants SYSTEM...
- News
Microsoft Patches Record 206 Flaws Including Three Zero-Days and Critical RCE Bugs
Microsoft's June 2026 Patch Tuesday is the largest single release on record, fixing 206 vulnerabilities across its software portfolio — including three...
- News
Microsoft Patches YellowKey, GreenPlasma, and MiniPlasma Zero-Days
Microsoft's June 2026 Patch Tuesday fixes three actively exploited Windows zero-days: two SYSTEM privilege escalation flaws and a BitLocker bypass...
- Security
CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
A critical out-of-bounds read and write vulnerability in the Chromium V8 engine allows remote attackers to execute arbitrary code inside a sandbox via a...
- News
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Microsoft's GitHub presence has become the latest target of the self-replicating Miasma supply chain worm, with 73 repositories across Azure, Azure-Samples…
- News
Chinese APT UNC5221 Deploys Three New Malware Families to Maintain M365 Access
Chinese espionage group UNC5221 is actively using the Brickstorm backdoor alongside two newly discovered malware families — Plenet and AgentPSD — to maintain…
- News
One Line of Code Put Billions of Microsoft Android App Downloads at Risk
A single development-mode setting left in production code bypassed Android protections designed to prevent unauthorized apps from accessing Microsoft account…
- News
Microsoft's Coreutils Project Brings Linux Commands to Windows
Microsoft announced Coreutils for Windows at Build 2026, bringing widely used Linux command-line utilities — ls, grep, cat, awk, and more — to Windows as…
- News
Microsoft Says It Will Not Pursue Security Researchers After Zero-Day Backlash
Following intense backlash from the security research community over Microsoft's removal of GitHub researcher accounts and statements labeling zero-day…
- News
Microsoft's Zero-Day Legal Threats Spark Backlash
After a disgruntled security researcher published several unpatched zero-day exploits in recent weeks, Microsoft seemingly indicated that criminal charges…
- News
Microsoft Says Zero-Day Public Releases Are 'Never Justifiable' as Researcher Threatens More Drops
Microsoft publicly condemned unauthorized zero-day disclosures as 'never justifiable' after a security researcher published working proof-of-concept...
- News
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft condemns uncoordinated public zero-day disclosure, urging the security community to adopt CVD after removing a researcher's GitHub account.
- News
Microsoft: Domain Controller Lookup May Fail on Windows
Microsoft has confirmed a new known issue affecting Windows Server 2016 systems where domain controller lookups fail after installing the KB5087537 May 2026.
- News
Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across
Microsoft has released updates fixing CVE-2026-45659, a CVSS 8.8 remote code execution vulnerability in SharePoint Server that requires no specialized.
- News
FBI Warns of Kali365 Phishing-as-a-Service Targeting
The FBI has published an advisory on Kali365, a Telegram-based phishing-as-a-service platform that captures legitimate OAuth tokens to gain persistent...
- News
Microsoft Warns of Two Actively Exploited Defender
Microsoft has disclosed two Windows Defender vulnerabilities under active exploitation in the wild, including CVE-2026-41091 — a privilege escalation flaw...
- News
Microsoft Warns of New Defender Zero-Days Exploited in Attacks
Microsoft has issued emergency patches for two Windows Defender vulnerabilities that were actively exploited as zero-days before fixes were available....
- News
Cybercrime Service Disrupted for Abusing Microsoft Platform
Microsoft has disrupted a malware-signing-as-a-service operation that exploited the company's Artifact Signing service to produce fraudulent code-signing...
- News
Microsoft Exchange Zero-Day Under Attack, No Patch Available
A zero-day XSS vulnerability in Microsoft Exchange Server (CVE-2026-42897) is being actively exploited in the wild, allowing attackers to compromise...
- News
MiniPlasma Windows 0-Day Enables SYSTEM Privilege
A new Windows kernel privilege escalation zero-day dubbed MiniPlasma, released by researcher Chaotic Eclipse, grants SYSTEM-level access on fully patched...
- News
Microsoft Backpedals: Edge to Stop Loading Cleartext
Microsoft is reversing course on a controversial Edge browser behavior that loaded all saved passwords into process memory in cleartext at startup — a...
- News
New Windows ''MiniPlasma'' Zero-Day Exploit Gives SYSTEM
A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed MiniPlasma that lets attackers gain...
- News
Tycoon2FA Hijacks Microsoft 365 Accounts via Device-Code
The Tycoon2FA phishing-as-a-service platform has added device-code phishing to its arsenal and abuses Trustifi click-tracking URLs to bypass Microsoft 365...
- News
Microsoft Rejects Critical Azure Vulnerability Report, No
A security researcher claims Microsoft silently patched an Azure Backup for AKS vulnerability after rejecting his disclosure report — issuing no CVE and...
- News
Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
Microsoft has shared mitigations for CVE-2026-42897 until a permanent patch can be released for affected Exchange Server versions actively being targeted...
- News
Microsoft Exchange, Windows 11 Hacked on Second Day of Pwn2Own
On day two of Pwn2Own Berlin 2026, competitors demonstrated 15 unique zero-day vulnerabilities and collected $385,750 in awards, successfully exploiting...
- News
Microsoft Warns of Exchange Zero-Day Flaw Exploited in Attacks
Microsoft shared mitigations for a high-severity Exchange Server vulnerability being actively exploited that allows threat actors to execute arbitrary...
- News
Windows Zero-Days Expose BitLocker Bypasses and CTFMON
An anonymous researcher has publicly disclosed two new unpatched Windows zero-days — YellowKey enabling BitLocker bypass and GreenPlasma targeting CTFMON...
- News
Microsoft May 2026 Patch Tuesday: 137 Flaws Fixed, Zero
Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities including nine critical flaws — but for the first time in two years, not a single...
- News
Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No
Microsoft's May 2026 Patch Tuesday delivers security updates for 120 vulnerabilities across Windows, Edge, Office, Azure, and more — with no zero-days...
- News
Microsoft Patches 138 Vulnerabilities Including DNS and Netlogon RCE Flaws
Microsoft's May 2026 Patch Tuesday addresses 138 security vulnerabilities across its product portfolio, including 30 rated Critical — with notable DNS...
- News
Windows BitLocker Zero-Day Gives Access to Protected
A cybersecurity researcher has published proof-of-concept exploits for two unpatched Windows vulnerabilities — YellowKey (BitLocker bypass) and...
- News
Microsoft Tests Modern Windows Run Dialog With Dark Mode
Microsoft is testing a redesigned Run dialog for Windows 11 that brings dark mode support and improved performance over the legacy Win+R dialog that has...
- News
CISA Adds Actively Exploited ConnectWise and Windows Flaws
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2024-1708 affecting ConnectWise ScreenConnect...
- News
Microsoft Now Lets Admins Uninstall Copilot on Enterprise
Following the April 2026 Patch Tuesday, Microsoft has made broadly available a new MDM policy setting that enables IT administrators to fully uninstall...
- News
Microsoft Patch Tuesday, March 2026 Edition
Microsoft patched 77 security vulnerabilities in March 2026 with no actively exploited zero-days, a welcome reprieve following February's five-zero-day...
- News
Patch Tuesday, April 2026 Edition
Microsoft released patches for 167 security vulnerabilities in April 2026, including an actively exploited SharePoint Server zero-day and the publicly...
- News
Microsoft Rolls Out Revamped Windows Insider Program
Microsoft is rolling out a revamped Windows Insider Program experience as part of broader plans to address performance and reliability concerns affecting...
- News
Microsoft to Roll Out Entra Passkeys on Windows in Late
Microsoft is rolling out passkey support for phishing-resistant passwordless authentication to Microsoft Entra-protected resources from Windows devices...
- News
Windows Update Gets New Controls to Reduce Forced Restarts
Microsoft is rolling out Windows Update improvements that give users more control over how updates are installed while reducing disruption from frequent...
- Security
CVE-2026-24303: Microsoft Partner Center Privilege
A critical privilege escalation vulnerability in Microsoft Partner Center allows an authorized attacker to elevate their privileges over a network,...
- Security
CVE-2026-32210: Microsoft Dynamics 365 Online SSRF Enables
A critical server-side request forgery vulnerability in Microsoft Dynamics 365 (Online) allows an unauthenticated remote attacker to perform spoofing over...
- News
Microsoft Teams to Get Efficiency Mode for Low-Resource PCs
Microsoft is rolling out a new Efficiency Mode for Microsoft Teams that automatically throttles CPU and memory usage on hardware-constrained devices,...
- News
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Spoofing Attacks
More than 1,300 internet-facing Microsoft SharePoint servers remain unpatched against a spoofing vulnerability exploited as a zero-day, with active...
- News
Microsoft Releases Emergency Updates to Fix Windows Server
Microsoft released out-of-band updates to address critical issues affecting Windows Server systems that emerged after the installation of April 2026 Patch...
- News
Microsoft Drops Its Second-Largest Monthly Patch Batch on Record
Microsoft's April 2026 Patch Tuesday addressed 169 CVEs — the second-largest monthly update in company history — including one actively exploited...
- News
Microsoft Issues Patches for SharePoint Zero-Day and 168
Microsoft's April 2026 Patch Tuesday addresses a record 169 security vulnerabilities including a SharePoint zero-day actively exploited in the wild, 8...
- News
Microsoft, Salesforce Patch AI Agent Data Leak Flaws
Prompt injection vulnerabilities in Salesforce Agentforce and Microsoft Copilot would have allowed unauthenticated attackers to exfiltrate sensitive CRM...
- News
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force
This week's threat roundup covers an unpatched Microsoft Defender zero-day, active SonicWall brute-force campaigns, a 17-year-old Excel RCE vulnerability...
- News
Recently Leaked Windows Zero-Days Now Exploited in Active
Threat actors are actively exploiting three recently disclosed Windows security vulnerabilities that allow attackers to gain SYSTEM or elevated...
- News
Three Microsoft Defender Zero-Days Actively Exploited; Two
Huntress is warning that threat actors are actively exploiting three privilege escalation vulnerabilities in Microsoft Defender — codenamed BlueHammer,...
- News
Microsoft Suspends Dev Accounts for High-Profile Open
Microsoft has suspended developer accounts used to maintain several prominent open-source projects without prior notice or a quick reinstatement path,...
- News
Authorities Disrupt APT28 Router DNS Hijacks Targeting
An international law enforcement operation has dismantled FrostArmada, an APT28 campaign that hijacked DNS on compromised MikroTik and TP-Link routers to...
- News
Medusa Ransomware Exploits Zero-Days to Deploy Ransomware
Microsoft has raised the alarm over Medusa ransomware's unprecedented operational speed, with the group now exploiting zero-day vulnerabilities before...
- News
Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Microsoft says the financially motivated cybercrime group Storm-1175, linked to China, has exploited N-day and zero-day vulnerabilities in high-velocity...
- News
Disgruntled Researcher Leaks BlueHammer Windows Zero-Day
A security researcher operating under the aliases 'Chaotic Eclipse' and 'Nightmare-Eclipse' has publicly released exploit code for an unpatched Windows...
- News
Medusa Ransomware Group Exploits Zero-Days to Strike Within
Microsoft warns that Medusa ransomware operators are exploiting zero-day vulnerabilities approximately one week before public disclosure, enabling the...
- News
Microsoft Links Storm-1175 to Medusa Ransomware Zero-Day
Microsoft has formally attributed Medusa ransomware zero-day attacks to Storm-1175, a China-based financially motivated cybercriminal group that has...
- News
Microsoft Details Cookie-Controlled PHP Web Shells
Microsoft Defender researchers have documented a stealthy PHP web shell technique that uses HTTP cookies as a covert command-and-control channel on Linux...
- News
Microsoft Now Force-Upgrades Unmanaged Windows 11 24H2 PCs
Microsoft has begun automatically upgrading unmanaged Windows 11 Home and Pro devices from 24H2 to 25H2, removing user choice from the update process for...
- Security
CVE-2026-26135: Azure Custom Locations SSRF Enables
A critical server-side request forgery vulnerability in Azure Custom Locations Resource Provider allows an authorized attacker to elevate privileges over...
- News
CISA Adds Zimbra XSS and SharePoint RCE to KEV; Cisco FMC
CISA added actively exploited Zimbra Collaboration Suite and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog on March...
- News
Microsoft Shares Fix for Windows C: Drive Access Issues on Samsung PCs
Microsoft has published a multi-step recovery procedure for Samsung Galaxy Book 4 laptops running Windows 11 24H2/25H2 where the Samsung Galaxy Connect...
- News
Microsoft Halts Forced Global Rollout of Microsoft 365
Microsoft has stopped automatically installing the Microsoft 365 Copilot app on Windows devices outside the European Economic Area, reversing a bundling...
- News
Stryker Cyberattack Wiped Tens of Thousands of Devices — No
A cyberattack on medical technology giant Stryker remotely wiped tens of thousands of employee devices using only legitimate Microsoft tools — no malware...
- News
Windows 11 February Update Breaks C:\ Drive Access on Samsung PCs
Microsoft is investigating a new bug affecting Samsung laptops after the February 2026 security update — some users are unable to access their C: drive...
- News
Microsoft Releases Windows 11 OOB Hotpatch to Fix Three
Microsoft has pushed an out-of-band hotpatch (KB5084597) to Windows 11 Enterprise devices to address three integer-overflow RCE flaws in RRAS, one rated...
- News
Europol-Coordinated Action Dismantles Tycoon2FA — 330
An international coalition led by Europol and Microsoft has taken down Tycoon2FA, a phishing-as-a-service platform responsible for 87.5 million phishing...
- Security
Microsoft MSHTML Framework Security Feature Bypass
An actively exploited protection mechanism failure in the Windows MSHTML (Trident) engine allows attackers to bypass browser security zones and shell...
- Security
Microsoft Office Word OLE Security Feature Bypass
An actively exploited zero-day in Microsoft Word allows attackers to bypass OLE protections and execute malicious Office documents silently, without...
- Security
Microsoft February 2026 Patch Tuesday Fixes Six Actively
Microsoft's February 2026 Patch Tuesday addresses roughly 60 vulnerabilities including six actively exploited zero-days across Windows, Office, and Azure...
- Security
Critical RCE in Microsoft Semantic Kernel Python SDK
A maximum-severity code injection vulnerability in Microsoft's Semantic Kernel Python SDK allows authenticated attackers to execute arbitrary code through...
- News
Adani Pledges $100 Billion for Renewable-Powered AI Data
Indian conglomerate Adani announces a massive $100 billion investment to develop renewable energy-powered AI data centers across India, partnering with...
- News
Microsoft Discovers 'AI Recommendation Poisoning' via Chatbot Prompts
Microsoft's Defender team tracked over 50 unique prompt injection payloads from 31 companies using 'Summarize with AI' buttons to manipulate chatbot...
- Security
GitHub Copilot Command Injection Flaws Enable Remote Code
Multiple high-severity command injection vulnerabilities discovered in GitHub Copilot extensions for VS Code, Visual Studio, and JetBrains could allow...
- Security
Microsoft Patch Tuesday February 2026: 6 Actively Exploited
Microsoft's February 2026 Patch Tuesday addresses 60 vulnerabilities including 6 actively exploited zero-days and 3 publicly disclosed issues, with...
- News
Microsoft Hit by Back-to-Back Outages: M365 Admin Center
Microsoft 365 admin center is experiencing degraded access across North America, just days after a major Azure infrastructure outage knocked out VMs, AKS,...
- Security
Windows SmartScreen Bypass Under Active Exploitation
Actively exploited Windows Shell vulnerability bypasses SmartScreen protection, allowing malicious files to execute without security warnings. Patch...
- Security
Microsoft Exchange Server SSRF to RCE Chain Actively
A server-side request forgery vulnerability in Exchange Server is being chained with deserialization flaws for unauthenticated remote code execution....
- Security
CISA Adds Four Critical Vulnerabilities to KEV Catalog
CISA has updated the Known Exploited Vulnerabilities catalog with four actively exploited flaws including Microsoft Office and SmarterMail vulnerabilities.
- News
Microsoft Announces Major Security Features for Copilot
New AI-powered threat detection and automated incident response capabilities coming to Microsoft 365 E5 subscribers this quarter.
- News
AI-Powered Phishing Achieves 54% Click-Through Rate
Microsoft reveals adversaries using AI for automated vulnerability discovery, phishing campaigns, and malware generation. AI-crafted phishing emails...
- Security
Microsoft January 2026 Patch Tuesday: 114 Flaws Fixed, One
Microsoft's first security update of 2026 addresses 114 vulnerabilities including three zero-days. One flaw is actively exploited in the wild with CISA...