Browse All Security Content (445)

Allison announces an update to GitHub Advanced Security that lets enterprise admins enforce security configurations across organizations, preventing org and repo admins from overriding enterprise-level settings and helping security and compliance teams apply consistent policies at scale.

Nivas Narayanasamy lays out a practical architecture for making private Azure VMware Solution workloads reachable by Azure AI Foundry agents without moving data. The post shows how to use MCP “bridge” servers on VNet-integrated Azure Container Apps, with ExpressRoute, private endpoints, Entra managed identity, and Key Vault-backed secrets to keep access private and read-only.

Mayuri Gupta announces the public preview of Azure Red Hat OpenShift hosted control planes, explaining how the control plane can run as a Microsoft-managed service while worker nodes stay in the customer subscription. The post covers operational benefits, Azure integrations (identity, monitoring, IaC), security controls, supported regions, and preview pricing.

Allison announces that GitHub has completed the planned shutdown of SHA-1 support in HTTPS for github.com and partner CDNs, with notes on which GitHub Enterprise offerings are affected and where to find the earlier deprecation details.

Pamela_Fox shares the full set of MCP Live session recordings and resources, covering the Model Context Protocol’s latest spec updates, MCP server/client development in VS Code and GitHub Copilot, enterprise governance with Microsoft Foundry Toolboxes, and evolving MCP authentication patterns.

Andrew Lock introduces Device Bound Session Credentials (DBSC), a browser/server protocol that makes stolen authentication cookies much harder to reuse on another machine. He explains the threat model (cookie theft and session hijacking), how DBSC uses TPM-backed keys and signed challenges, and what endpoints a server needs to add to support it.

nzthiago explains the new GA support for site-scoped certificates and end-to-end TLS in Azure Functions Flex Consumption, including certificate sources (Key Vault, managed certs, uploads), how to expose certs to code on Linux workers, and how to implement inbound and outbound mutual TLS safely.

Gaurav Bhardwaj walks through a practical “refund agent” example to show why AI agent observability needs more than green HTTP checks, and how to use Microsoft Foundry plus Azure Monitor (Application Insights and Log Analytics) to trace runs, evaluate tool-call correctness, set alerts, and bake in security and privacy controls.

GitHub introduces CVE Lite CLI, a local dependency vulnerability scanner for JavaScript and TypeScript projects, highlighting how it classifies direct vs transitive issues, validates fix versions with OSV, and outputs exact upgrade commands across npm, pnpm, Yarn, and Bun.

Rick Strahl explains why files under ASP.NET Core’s wwwroot are public by default, and how to protect dynamically generated “static” files (like admin logs) so they still respect authentication and authorization rules.

This week's Security roundup focuses on identity-first cloud defense and the controls that stop attacks at the first chokepoints: authentication, messaging, and the cloud control plane. Microsoft published a Cloud Web Applications Threat Matrix that turns ATT&CK techniques into concrete hardening priorities for App Service and serverless workloads, while new incident writeups show how passkey-themed lures, AI-assisted impersonation, and AiTM patterns translate into real Entra ID and M365 compromise paths. On the DevSecOps side, GitHub shipped enforceable guardrails (blocking PR merges with unresolved secrets, least-privilege cache access, and API-managed AI Scan rollout) alongside CodeQL updates, and the agent story matured with Citadel architecture guidance plus enterprise policies that constrain Copilot agent actions. Rounding it out are platform updates like user-bound delegation SAS in Azure Storage, managed-identity triggers for App Service integrations, network-aware migration pl

kedikala lays out a practical security framework for agentic apps on Azure, focusing on how to keep tool calls safe when untrusted content can steer an agent toward sensitive reads or risky writes. The post breaks controls down across identity, retrieval, request validation, execution constraints, and outcome verification.

Wiliam_Rosa breaks down how Spark Structured Streaming’s Real-time mode (as implemented in Azure Databricks) can cut anomaly-detection latency from seconds to sub-millisecond, using an Ethereum transaction pipeline that classifies events as ALLOW or QUARANTINE based on protocol invariants and sensitive-payload checks.

jordanselig explains a new public preview capability in Azure Managed Connectors: sending trigger events directly to Azure App Service apps. The post covers how the App Service destination is configured, how managed-identity callbacks are authenticated with App Service built-in auth (Easy Auth), and includes an end-to-end sample with Bicep and Azure Developer CLI.

Tomoko Tanaka shows how her team turned event marketing runbooks into “ops as code” using GitHub Issues, GitHub Actions, and GitHub Copilot. The post breaks down the repo patterns (issue forms, labels, skills in Markdown, and a DRY_RUN switch) that automate setup, daily screening, and post-event reporting with guardrails.

Rohon Mohapatra explains how the Citadel reference architecture builds on AI landing zones and Microsoft Foundry to standardize enterprise AI operations—covering shared access controls, observability, identity, and security governance across multiple teams and workloads.

Allison announces a public preview that adds GitHub REST API endpoints for enabling and managing GitHub code scanning’s AI Scan for pull requests at both the organization and repository level, making it easier to roll out AI-powered security detections across selected repos without manual UI configuration.

Allison announces GitHub Actions cache-mode, a generally available workflow/job setting that lets teams apply least-privilege access to the Actions cache and reduce cache poisoning risk by controlling whether jobs can restore and/or save caches.

Microsoft Security Research breaks down a large-scale business email compromise campaign that used AI-assisted executive impersonation and fake invoices to push finance teams into fraudulent ACH payments, and maps practical mitigations using Microsoft Defender for Office 365, Defender XDR, and Security Copilot.

Steve Sweetman explains how to govern AI agent spend in Microsoft Foundry by combining request-path token limits, observability (traces, monitoring, evaluations), and finance-grade budgets, then tying those signals to ROI so teams can decide what to optimize, scale, or retire.

Rob Lefferts explains how threat actors are using AI brands (like ChatGPT, Copilot, DeepSeek, and Claude) as social-engineering bait, and how Microsoft Defender helps detect and disrupt these campaigns across email, identity, endpoints, and SaaS signals.

Maria Bledsoe outlines how Azure IaaS resiliency is shifting from one-time DR planning to continuous design-and-operations practices, highlighting new and updated Azure capabilities for assessing resiliency posture, reducing blast radius during failures, and validating recovery readiness.

Thomas Maurer introduces the new digital sovereignty adoption guidance in the Microsoft Cloud Adoption Framework, explaining the sovereign cloud continuum and a practical three-phase path (planning, architecture/governance, and operations) for building and running controlled Azure workloads across public, private, and partner cloud models.

Microsoft Developer explains why Dynamic Client Registration becomes a scaling problem for MCP clients, and how switching to Client ID Metadata Documents turns the client_id into a durable, URL-based identity that servers can fetch on demand.

Den Delimarsky explains how MCP authorization evolved, covering the original OAuth profile, protected resource metadata, changes to client registration, and how enterprise-managed authorization fits into the model.

Allison announces a new npm security protection: after signing in with a recovery code, any npm account is placed under a 72-hour security hold that blocks publishing and other sensitive write actions while still allowing sign-in and package installs.

Allison announces CodeQL 2.27.0, highlighting native Linux ARM64 support, improvements to GitHub code scanning default setup, and multiple query and framework-modeling updates that improve vulnerability detection across C#, Java/Kotlin, C/C++, and Rust projects.

Microsoft Security Research and Lior Leizerovich introduce the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework for understanding and prioritizing threats against cloud-hosted web apps and serverless platforms, with practical examples spanning identities, deployment pipelines, managed runtimes, and connected cloud resources.

Allison announces generally available enterprise managed permissions for GitHub Copilot agent operations, letting admins centrally decide which actions are blocked, require human approval, or run without prompting across supported Copilot clients.

ellievail announces general availability of user-bound user delegation SAS for Azure Storage, which restricts a user delegation SAS token so it can only be used by a specific Microsoft Entra ID identity. The post explains how it works with RBAC, cross-tenant scenarios, and how to generate and share tokens safely.

Sudha Mahajan explains how Azure Migrate Network Planning adds network-aware discovery and assessment to VMware lift-and-shift migrations, helping teams capture dependencies, translate source constructs into Azure networking recommendations, surface readiness issues, and include network costs and security intent in the migration business case.

Microsoft Security Research and co-authors document an intrusion pattern where passkey-themed helpdesk lures lead to identity compromise, MFA persistence, Microsoft Graph reconnaissance, and large-scale data collection from SharePoint, OneDrive, and Exchange Online, with practical hunting queries and mitigation guidance for defenders.

Allison announces expanded self-serve trial eligibility for GitHub Advanced Security on GitHub Enterprise Cloud, allowing more enterprises to evaluate GitHub Code Security and GitHub Secret Protection before purchasing.

Allison announces a new GitHub repository ruleset option that can block pull requests from merging when they introduce unresolved secret scanning alerts, adding an extra enforcement layer beyond push protection.

nschachter announces a Microsoft Fabric preview that adds table-level discovery to OneLake Catalog search, including Global Search and the OneLake Catalog Search API. The post explains how permission trimming works, what object-level security excludes, and which tenant setting admins should review before the late-September rollout.

Allison announces agentic autofix for GitHub Code Quality, letting teams select up to 25 findings and assign them to GitHub Copilot in one action. Copilot applies fixes on a branch, validates the changes, and opens a pull request for review, with usage governed by existing enterprise policy and AI credits.

Allison announces updates to GitHub Copilot for JetBrains, including enterprise-managed sandbox policies, cross-file cursor jumps for next edit suggestions, global project context in chat, and enterprise policy diagnostics. The release also adds a preview integration that connects Copilot CLI terminal sessions to IDE context and improves reliability across MCP and agent sessions.

Allison announces GitHub Enterprise Server (GHES) 3.22 general availability, highlighting updates for enterprise administration and collaboration, including Copilot CLI support for disconnected environments, enterprise teams, improvements to repository rulesets and required reviewers, and UI enhancements for issues and pull requests.

sbaynes announces codename MDASH, Microsoft’s multi-model agentic code-scanning system now deployed in Azure Government, aimed at finding and validating exploitable vulnerabilities across software supply chains with fewer false positives and more actionable results for security teams.

Rahul Bhandari and Tara Overfield recap the September 2026 servicing releases for .NET and .NET Framework, highlighting security and non-security fixes, the list of addressed CVEs, and where to find release notes, installers, container images, Linux packages, and known issues for supported versions.