Browse All News (665)

Microsoft Security Research analyzes a malicious Claude Code-branded extension distributed through Cursor’s marketplace, detailing its attempted SSH backdoor and cross-platform persistence. The article provides Microsoft Defender detections, hunting queries, and remediation steps, explaining why removing the extension alone does not eliminate unauthorized keys and startup artifacts.

Kristen Womack reviews October’s Azure Developer CLI releases, covering deployment previews, Container Apps express support, environment value removal, and extension-aware pipelines. The recap also explains stable extension APIs, breaking Go API changes, reliability fixes, and new templates for deploying semantic search and streaming AI applications to Azure.

Microsoft Security Research, Sagar Patil, Jesse Birch and Tal Tzhori examine two intrusions that escalated from help desk impersonation to AD CS certificate abuse. Their analysis explains ESC1 and ESC8 attack paths, contrasting containment outcomes, and practical Microsoft Defender hunting queries and hardening measures for certificate-backed identity compromise.

Waldek Mastykarz examines whether naming a workspace folder ‘eval’ changes GitHub Copilot CLI behavior. Across about 900 runs with four models, the name increased agents’ suspicion that they were being tested without producing statistically significant behavioral differences. The analysis explains the experiment’s controls, limitations, and practical guidance for evaluation harnesses.

spurthikommajos explains how Microsoft Fabric Eventstream’s preview support for workspace-level private connectivity lets custom applications publish events without public internet access. The article covers Azure private endpoints, workspace-scoped network restrictions, setup prerequisites, and supported analytics destinations, including important capacity requirements and ingestion limitations.

yaelbiss explains how Microsoft Fabric’s preview Allow workspace settings editing policy restricts sensitive encryption and networking changes without removing workspace administrator responsibilities. The article covers security-group-based rules, development and production boundaries, audit logging, and allow-list behavior that administrators should test before activating policies across a tenant.

spurthikommajos introduces preview support for variable libraries in Microsoft Fabric Eventstream. Connection and item references let teams reuse eventstream definitions across development, staging, and production, while each workspace supplies its own resource values. The article explains configuration steps, deployment prerequisites, and how references remain intact through Git integration and deployment pipelines.

amitch and Shehab Amin explain how Sail connects Spark-compatible workloads to Microsoft OneLake without copying data. They demonstrate lakehouse transformations, Python-based embedding generation, and scoped access through LakeSail Cloud Sessions, while outlining compatibility checks and limitations of the reported performance and cost comparisons.

Allison details three additional IP ranges for GitHub webhook deliveries, now included in the Meta API. Teams using static network allowlists need to add the prefixes to avoid rejecting deliveries. Allowlists kept current through the Meta API require no changes, and the additions apply across all github.com plans.

amitch and coauthor Iddo Avneri explain how Microsoft OneLake shortcuts expose lakeFS-managed data in Microsoft Fabric without copying datasets. Branch-following shortcuts provide current data, while commit-pinned shortcuts preserve reproducible snapshots. The article covers connection configuration, Delta table queries, validation results, and the tested configuration’s read-only limitation.

Microsoft Threat Intelligence examines how North Korean threat actors use AI to accelerate reconnaissance, identity deception, malware development, and operational scaling. The report distinguishes observed activity from suspected AI use, explains why operations remain human-directed, and provides Microsoft Defender detections and practical guidance for protecting identities, endpoints, and software repositories.

Salim Chawro introduces Hardware Audit Logging for Azure Cloud HSM, which records supported management operations directly from the hardware. Signed audit data and certificates enable independent verification, while Azure Monitor Log Analytics delivery supports investigations and monitoring. The feature is rolling out across public regions and is automatically enabled on new resources where available.

nareshvenkat introduces Project Osmos, a data engineering agent for Microsoft Fabric that investigates datasets, executes PySpark, and validates results. Persistent, shared tasks retain project context while teams define operating boundaries, review evidence, and guide changes. Tasks can be initiated through GitHub Copilot CLI, Claude Code, or Codex.

Daniel Roth outlines Microsoft’s collaboration with Syncfusion on Blazor, including a free, MIT-licensed component toolkit and merged framework and scaffolding fixes. He also covers testing contributions for .NET 11 and proposed setup tooling and AI assistant skills, distinguishing available improvements from contributions still under review.

LeeBenjamin introduces the generally available Govern experience in Microsoft Fabric’s OneLake catalog and the new Govern Skills collection. Together, they provide centralized estate insights, policy controls, and AI-assisted governance checks, with evidence-based recommendations and confirmation before sensitive changes through tools such as GitHub Copilot.

The Visual Studio Code Team outlines changes in VS Code 1.145 Insiders, including improved worktree cleanup, experimental previews of web apps on remote agent hosts, and new agent-session controls. The updates also address keyboard accessibility for MCP authentication prompts and add symbol breadcrumbs for unsaved files.

Satya Nadella outlines GitHub updates announced at Universe, including Copilot Fusion performance and cost claims, a unified Copilot harness in Foundry, and Copilot Projects for coordinating multiple agents across repositories. The post also notes plans to expand GitHub capacity and strengthen its architecture.

SMATIN explains preview improvements to scalar user-defined functions in Microsoft Fabric Data Warehouse, including broader loop control and query support. Existing functions gain supported capabilities automatically, while new inlineability checks provide diagnostics and an explicit override for functions intentionally used without inlining.

Lynn Dai introduces Trusted Publishing for Visual Studio Marketplace, enabling extension releases from GitHub Actions and Azure Pipelines without long-lived personal access tokens. The article explains federated identity setup, GitHub policy activation, Azure Pipelines service connections, and how to migrate existing publishing workflows while verifying access before removing stored secrets.

Jeff Hollan, Viswajeeet Balaji, and Anthony Chu introduce the Microsoft Copilot harness public preview in Foundry Agent Service and generally available resilience for hosted agents. They demonstrate reusable skills and declarative deployment, explain recovery responsibilities and preview limitations, and outline consumption-based runtime billing beginning December 1, 2026.

Jay Parikh outlines GitHub’s Universe 2026 announcements, including multi-repository Copilot projects, model orchestration, deeper code review, and enterprise access billed through AI credits. He also describes GitHub’s infrastructure expansion, redesigned Git architecture, and ongoing migration to a multi-region Azure deployment.

GitHub Staff examines the 2026 Octoverse findings on repository activity, agent-started pull requests, and changing model choices. The report connects growing use of coding agents with shifts in review workflows, GitHub Actions usage, and language participation, while explaining the telemetry’s limitations and announcing general availability of GitHub Copilot Fusion.

Allison announces the general availability of GitHub Copilot Fusion, which selects and orchestrates models for coding tasks. Developers choose between three effort levels, while administrators control eligible models and defaults. The announcement also covers supported clients, per-model billing, and a temporary discount for paid Copilot plans.

Allison introduces updates to the GitHub Copilot app, including Projects for coordinating work across repositories and connected tools, and computer use in public preview on macOS and Windows. The app can return pull requests for review, work with design context, and control desktop apps with user approval.

Allison outlines a new GitHub Enterprise licensing model that includes GitHub Copilot access for licensed users, with AI usage charged against an enterprise budget. The announcement explains which features remain available without budget, the $10 monthly standalone option, and initial availability for enterprises working with GitHub or Microsoft account teams.

Allison introduces the GitHub security extension, now in public preview for the GitHub Copilot app. Developers can browse code scanning alerts, ask Copilot to explain or fix them locally, and review changes before opening pull requests. The announcement also covers permissions, AI credit usage, and supported GitHub environments.

Allison introduces GitHub intelligence, a context layer combining persistent Copilot memories, opt-in dreaming, and cross-repository code search. Copilot Memory is generally available on paid plans, while dreaming enters public preview with controls for personal and repository context, pull-request review of instruction changes, and AI-credit costs.

Allison introduces shared Copilot Automations, which let teams maintain repository-owned AI workflows for bug reproduction, pull request screenshots, and incident investigation. The rollout adds shared visibility, editing permissions, repository-owner billing, and workflows that keep running when their creator leaves, with an administrator policy required for organization-owned repositories.

Allison outlines GitHub Copilot updates in VS Code, including cloud session continuity, persistent local and remote agents, and mobile controls. The releases also cover parallel model comparisons, experimental desktop interaction, custom clients through Agent Host Protocol, and preview marketplaces and connectors with enterprise policy controls.

Allison announces general availability of repository plugin defaults and enterprise-managed plugin controls for GitHub Copilot. Maintainers can configure default plugins, while enterprise administrators can require or block plugins and restrict marketplaces. The controls work across VS Code, Copilot CLI, and the GitHub Copilot app, with managed settings overriding personal choices.

Allison introduces image generation and editing in GitHub Copilot, powered by GPT Image 2.5 Flare. The public preview lets developers request images conversationally, preview them inline, and save them to their workspace. Image tokens are billed separately from chat, while administrators can disable the feature through model policies.

Allison announces an opt-in experimental preview of GitHub Copilot Fusion routing between supported local and cloud models. The update covers managed Windows setup and manually configured CLI models across Windows, macOS, and Linux, with important limits: routing still requires the cloud, and local models may offer different safety protections.

Allison announces general availability of GitHub Agentic Workflows, which compiles natural-language Markdown into GitHub Actions workflows powered by coding agents. The release adds runner support, model routing, and stronger isolation, with read-only defaults and validated outputs. The default GitHub Copilot CLI engine requires a Copilot license.

Allison introduces Dependabot reachability analysis, now in public preview for JavaScript and TypeScript on GitHub Enterprise Cloud. Using CodeQL and managed GitHub Actions workflows, it identifies call paths to vulnerable dependency functions and adds verdicts to alerts, helping teams prioritize remediation without automatically dismissing vulnerabilities.

Sandeep Sen summarizes October's Azure SDK releases, including authentication changes in Azure Core for .NET, managed identity improvements for Python and Java, and the first stable Cosmos DB libraries for Rust. The update also lists new stable management libraries and initial previews for AI and provisioning libraries.

Hailey Victory reviews how VS Code has evolved since GitHub Universe 2025, covering parallel agent sessions, shared cloud workflows, multiple harnesses and models, and project customization. The overview explains how developers can coordinate agent work across tools while retaining control over editing, debugging, access policies, and reviewing changes.

Allison announces public preview support for server-to-server authentication in GitHub Copilot. GitHub Apps can use short-lived installation tokens to make SDK requests on behalf of an organization without user credentials. Usage is billed to the organization, with its model policies, budgets, spending controls, and app access controls applied.

Gloridel Morales announces Azure DevOps Server 26H2 RC, bringing an updated Azure Boards interface, pipeline debugging improvements, and a new Test Run Hub. The release supports direct upgrades and a later upgrade to RTW, while Team Foundation Server 2017 extended support ends on January 12, 2027.

Naorbt introduces generally available authoring capabilities for Microsoft Fabric Real-Time Dashboards. Design Tiles provide context and structure, multi-KPI displays related metrics from one query, and configurable KPI styles show values against thresholds and targets. The article explains how to combine these features into readable operational dashboards.

Mark Downie outlines the October Visual Studio 2026 update, including comparisons between historical commits and working trees, bulk merge conflict resolution, and a refreshed GitHub Copilot Chat experience. The update also adds opt-in preservation of unsaved work, keyboard-based tab reordering, and searchable Fonts and Colors settings with inline previews.