Browse All Security Content (537)

Allison announces updates to GitHub secret scanning, including a new partner (Lovable Labs), more secret types blocked by push protection by default, and richer alert context via extended metadata to help teams assess ownership and impact faster.

Shamir AbdulAziz lays out a practical operating model for “Zero Ops” using Azure SRE Agent: agents handle investigation and remediation work, while humans focus on intent, governance, and outcome review. The post breaks down how to scope agents, connect context, build repeatable artifacts, and safely graduate from human-in-the-loop to autonomy.

John Savill runs through the 7th August 2026 Azure update, covering changes across compute, networking, security, storage, SQL, and Databricks—highlighting VM defaults and retirements, new routing and proxy capabilities, Private Link over IPv6, and several Databricks and Azure SQL enhancements.

GitHub covers stacked pull requests (now in public preview), a security incident involving an OpenAI test model accessing Hugging Face servers, and a pixel-art “Isometric NYC” project built with 3D tiles and image generation models.

John Edward covers a Microsoft Defender update that surfaces AI-generated Microsoft Purview Insider Risk Management triage summaries directly in the Defender alert queue, helping SOC analysts and insider risk investigators triage alerts faster while keeping the full investigation workflow in Purview.

sbaynes outlines an Azure-native reference architecture for deploying Fireworks AI open-model inference on Azure AI Foundry, with guidance on moving from prototype to production while tracking latency, token usage, and cost. The post highlights optional platform components for caching, rate limiting, secrets management, and observability.

Mason Torres announces the general availability of Windows Server 2016 Extended Security Updates (ESUs) enabled by Azure Arc, explaining how to onboard servers, enroll in ESUs through the Azure portal or Azure Policy, and use Azure services like Update Manager and guest configuration to manage patching and compliance.

Ankit Kumar Honey explains how GitHub expanded Dependabot malware advisories from npm to eight package ecosystems by ingesting OpenSSF’s malicious-packages data into the GitHub Advisory Database, including the validation, normalization, deduplication, and safety controls used to keep auto-published advisories resilient.

Mike Hulme explains why Microsoft was named a Leader in Gartner’s 2026 Magic Quadrant for AI-augmented code modernization tools, and outlines how GitHub Copilot modernization and Azure are positioned to assess, upgrade, and migrate legacy applications with agentic workflows while keeping developers in control.

Eric van Wijk introduces the new Azure DevOps service connection, which lets pipelines authenticate to Azure DevOps using a Microsoft Entra workload identity (service principal or managed identity) instead of PATs or build session tokens, and shows where and how to use it across YAML, tasks, and scripts.

Jatin Garg explains how to choose between Microsoft Foundry and PyRIT for AI red teaming, framing the decision around whether you’re testing a model in a managed Foundry/Azure OpenAI surface or attacking a full RAG/agent application with custom endpoints and orchestration.

Dona Mukherjee announces a public preview of Confidential Virtual Machines on Azure Local, explaining how hardware-backed memory encryption and attestation can protect data-in-use on customer-managed edge infrastructure, including how Azure Attestation and Azure Key Vault enable secure key release for sensitive workloads.

EldertGrootenboer explains why some .NET Framework WCF Relay listeners start failing against Azure Relay after TLS 1.0/1.1 retirement, and outlines practical fixes ranging from app config changes to code updates and machine-wide registry settings.

Ran Rosin summarizes why KuppingerCole named Microsoft a Leader in its 2026 CNAPP Leadership Compass, and what that says about where cloud security is heading: unified risk management across cloud infrastructure, identities, data, applications, and AI, with runtime-driven prioritization and SOC integration.

Microsoft Security Research and Srinivasan Govindarajan break down how a macOS ClickFix infostealer campaign evolved from openly serving malicious lures to hiding them behind a server-side browser-fingerprinting gate, and they provide practical hunting pivots, IOCs, and Defender coverage to help defenders detect related activity.

Dan Hellem announces the general availability of the Azure DevOps Remote MCP Server, explaining how AI assistants can securely connect to Azure DevOps via a hosted endpoint. The post covers the minimal mcp.json setup, Entra ID authentication requirements, current client support, and when to use the local MCP server instead.

Microsoft Security Research, Ravikant Tiwari, Sagar Patil and Suriyaraj Natarajan break down ChainDrop, a large-scale npm supply chain compromise that used a Bun-based, self-propagating worm to steal credentials from developer machines and CI/CD runners, then republish infected packages. The post includes mitigation steps, IOCs, and Defender XDR hunting queries.

WSilveira explains how the Logic Apps Standard extension for VS Code can use Managed Identity for connectors during local development, so the same connection setup works both on your machine and after deployment. The post covers required versions, the WORKFLOWS_AUTHENTICATION_METHOD setting, and connector-specific behavior and limitations.

Allison announces a new way to customize GitHub code scanning default setup using a repository property, enabling teams to apply a shared CodeQL configuration across one repo or an entire organization without maintaining per-repo GitHub Actions workflows.

Ron Pessner announces updates to Microsoft’s Zero Trust for AI approach, including new AI-focused checks in the Zero Trust Assessment, a DevSecOps pillar in the Zero Trust Workshop, and a companion e-book with practical patterns for securing AI agents, AI memory, and the software supply chain.

Microsoft Security Research (David Shiran and Ayelet Artzi) explains how Microsoft Defender’s Automatic Attack Disruption used a new device isolation action to contain a multi-stage ransomware attack at QNET in 128 seconds, including a detailed attack timeline and mapped MITRE ATT&CK techniques.

Allison announces new Dependabot configuration options that let you control the branch names created for dependency update pull requests, including prefixes, maximum length, separators, letter casing, and custom templates—useful for CI/CD naming constraints and for keeping monorepo branches easier to identify.

Allison summarizes the CodeQL 2.26.2 release for GitHub code scanning, including new language support (Swift 6.3.3 and Kotlin 2.4.10), query behavior changes that may surface more findings, and a breaking change affecting how query authors embed links in alert messages.

Andrew Lock explains the new CSRF protection in ASP.NET Core (.NET 11 preview 6) that uses Fetch Metadata HTTP headers instead of synchronizer tokens, including how the middleware decides to allow or deny requests and what changes (if any) app authors need to make.

kinfey explains how Kars (Agent Reference Stack for Kubernetes) runs long-lived, tool-using AI agents with a tight blast radius by making the pod the trust boundary, brokering identity and egress through an in-pod router, and enforcing content safety, token budgets, and tamper-evident auditing on AKS.

Ricardo M. Martins describes a reference Azure-based operations assistant that uses RAG over runbooks and gates any write action (like incident creation) behind explicit user confirmation, with practical notes on Azure AI Search ingestion pitfalls, identity boundaries, managed identity, and idempotency.

aimeelittleton explains a recommended Azure outbound networking design that pairs Azure Firewall with StandardV2 NAT Gateway to get centralized inspection plus scalable, zone-resilient SNAT with predictable egress IPs, and shows what’s changed in the Azure portal create flow to set this up faster.

.NET Team announces upcoming NuGet.org publishing security changes: new API keys will be capped at 30 days starting August 17, 2026, and older keys will expire on November 1, 2026. The post explains the supply-chain risk of long-lived secrets and recommends migrating to NuGet Trusted Publishing using OIDC.

John Savill explains Azure Standard Service Endpoints, focusing on how Network Identifiers (NIDs) simplify and scale VNet-to-PaaS access, and how they work alongside Network Security Perimeter controls for securing inbound access to supported Azure services.

John Edward explains Microsoft’s retirement of support for the Microsoft Entra SSO plug-ins used with self-hosted Atlassian Jira and Confluence (Server/Data Center), what “unsupported” means in practice, and the security and operational risks organizations should plan for after July 31, 2026.

John Edward breaks down what GitHub Copilot does (and doesn’t) send to the service, how training and retention settings vary by subscription, and the practical security risks teams should plan for when using AI-assisted coding in real projects.

This week's Security roundup links attacker tradecraft with platform-side guardrails, starting with Microsoft's CaptiveCrunch reporting on Midnight Blizzard targeting travelers through captive portals and device code authentication abuse. On the supply chain front, npm and GitHub tightened automation paths with restrictions on bypass-2FA tokens, publish-time malware scanning, expanded malware advisories for Dependabot, and workflow runs that can be held for approval in public repos. Microsoft and Azure updates rounded out the week with identity and AI protections (including agentic SecOps and expanded external AI red teaming), plus concrete governance controls across Azure Policy, Fabric encryption, and data egress boundaries.

Microsoft Threat Intelligence details CaptiveCrunch, a Storm-2945 (Midnight Blizzard) campaign abusing captive portals to manipulate traffic, deliver malware, and steal credentials and tokens. The post breaks down the CornFlake and ChocoShell toolchain, device code phishing against Microsoft Entra ID, and provides Defender/Sentinel hunting queries plus practical mitigations for travelers and enterprises.

shashankamalladi outlines updated scale limits for Azure Network Security Perimeter, including new hard limits for perimeters, profiles, rule elements, and associated PaaS resources, plus what changes apply to existing configurations through the 10/31/26 transition window.

Allison announces a security change for npm: granular access tokens configured to bypass 2FA can no longer perform sensitive account, org, and package-management actions without an interactive 2FA challenge, and automated publishing should move to trusted or staged publishing.

John Savill rounds up a week of Azure platform updates, spanning AKS, networking, API Management, monitoring, data services, and regional expansion, plus a few notable AI model availability items and security-related changes like Azure Enclave and Key Vault symmetric keys.

HimanshuYadav explains how to transfer a live GitLab project to a new group without accidentally “resetting” Terraform state or breaking pipelines, focusing on what changes during a namespace move (variables, runners, identity mappings) and how to validate and roll back safely.

diptiborkar summarizes why Microsoft Fabric and OneLake were recognized as a Leader in Forrester’s 2026 Data Lakehouses report, focusing on a unified lakehouse foundation for analytics and AI, open table formats, cross-cloud interoperability, and built-in governance and security across engines like Spark, SQL, KQL, and Power BI.

arindamc explains how Workspace Outbound Access Protection (OAP) in Microsoft Fabric controls outbound connectivity for Eventstream, so streaming pipelines can only read from approved sources and write to approved destinations (including cross-workspace routes) using data connection rules.

Abhishek Tiwari explains how Azure Front Door edge actions adds customer-defined logic in the request path while keeping hyperscale performance predictable, enforcing strong tenant isolation with Hyperlight micro-VMs, and building resiliency through bounded latency, fast-fail behavior, and validated fallback mechanisms.