Weekly Security Roundup: Signed Audits and Agent Guardrails

by TechHub

Azure Cloud HSM Hardware Audit Logging is rolling out across public regions, giving security teams searchable operational records and hardware-signed audit batches they can independently verify. Investigations into malicious Claude Code-branded Cursor extensions and help desk impersonation show why remediation must address persistent SSH artifacts, privileged certificates, and previously issued Kerberos tickets rather than stop at the initial entry point. Marketplace Trusted Publishing introduces publishing without long-lived personal access tokens, while GitHub Copilot's server-to-server authentication preview gives organization-installed apps short-lived credentials governed by organizational policies and budgets. GitHub Agentic Workflows and Copilot assisted permissions reached general availability with execution safeguards and approval controls, while Dependabot's reachability preview adds call-path evidence for vulnerability prioritization and Copilot's security extension previews local review and fixes. Across these releases, teams need to verify the boundaries of each control: affected PHP runtimes require their own patches, and hotpatch-enabled Windows Server 2022 devices still need restart windows for November and December security updates.

This Week's Overview

Hardware-signed audit trails for Azure Cloud HSM

Azure Cloud HSM Hardware Audit Logging captures supported management operations, including authentication, administrator changes, policy updates, key lifecycle operations, and backup and restore activity. Customers receive readable records alongside HSM-signed binary audit data, signatures, and certificates, allowing independent verification of signed audit batches.

Logging is enabled as an immutable hardware security module (HSM) partition policy, and events flow into Azure Monitor Log Analytics for use in Microsoft Sentinel security workflows. The feature is rolling out across public regions and is automatically enabled for newly provisioned Azure Cloud HSM resources where available. For security teams, the distinction is between having searchable operational records and having signed evidence they can independently verify.

Intrusion investigations expose persistent access paths

This week's investigations show why response must extend beyond removing the initial entry point. Unauthorized SSH artifacts, privileged certificates, and compromised development workflows can require separate investigation and remediation.

Malicious Cursor extensions leave artifacts outside their installation directory

Cursor reported malicious Claude Code-branded extension versions 2.1.312 and 2.1.313 in its marketplace on October 29, 2026. Microsoft confirmed that Visual Studio Marketplace and the npm Claude Code distribution were unaffected, while Anthropic reported no compromise of its systems. The injected loader attempts SSH key installation, reverse forwarding, platform-specific persistence, and host reconnaissance reporting.

Removing or updating the extension does not remove unauthorized SSH keys, scripts, tunnel identities, or startup artifacts outside the extension directory. Affected teams therefore need to investigate host-level persistence rather than treat an extension update as complete remediation. Microsoft provides Defender detections and advanced hunting queries, but query matches are investigative leads, not proof of compromise.

Help desk impersonation leads to certificate-based access

Two Microsoft investigations began with Teams support impersonation and user-approved remote access, primarily through Quick Assist, rather than a Teams vulnerability. One intrusion exploited an ESC1-vulnerable Active Directory Certificate Services template to obtain privileged authentication certificates and perform DCSync. Defender blocked more than 1,000 SMB file-access attempts, but an excluded privileged account remained usable and supported data exfiltration.

The second intrusion used PetitPotam and ESC8 NTLM relay to obtain a domain-controller certificate and authenticate through Kerberos PKINIT. No further progression was observed after customer-led workstation isolation. Response teams should account for the fact that revoking a certificate does not invalidate Kerberos tickets already issued through it.

North Korean actors apply AI within human-directed operations

Microsoft Threat Intelligence assesses that North Korean AI-enabled operations remain human-directed, with Jade Sleet, Coral Sleet, and Jasper Sleet having operationalized AI across their activities. Microsoft identified over 100 target-specific Onyx Sleet PDF lures created in August and September 2026, including dozens generated within minutes.

Since April 2026, Coral Sleet has used a workflow to trojanize private GitHub repositories within its existing malware chain. Microsoft has also identified Onyx Sleet and Pearl Sleet using the open-source agentic penetration testing framework ARTEX since late October 2026. These findings describe AI supporting existing intrusion workflows, not fully autonomous attacks.

Security updates require deployment-specific action

PHP remediation and upcoming Windows Server updates both require teams to check the systems they actually operate. Updating a pipeline agent or retaining hotpatch enrollment does not, by itself, complete the required maintenance.

PHP2Shell remediation belongs with the PHP runtime

PHP disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026. Neither Azure DevOps Services nor Azure DevOps Server uses PHP to handle customer requests, but pipeline environments can contain affected PHP installations. Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with vendor-confirmed backports also valid.

Microsoft patches PHP preinstalled on hosted agent images, while customers remain responsible for versions installed by pipeline steps or bundled in custom images. Azure Pipelines agent upgrades do not patch separately installed PHP. Teams need to update affected hosts, rebuild containers, and verify the runtimes deployed by their pipelines.

Windows Server 2022 hotpatch devices need restart windows

Hotpatch-enabled Windows Server 2022 devices will receive standard security updates requiring restarts in November and December 2026. They remain enrolled in hotpatching without additional configuration, but the planned January 2027 baseline also requires a restart. The next hotpatch update is expected in February 2027.

Administrators should reserve maintenance windows and verify both installation success and completion of the required restarts. Windows Server 2025 and hotpatch-enabled Windows 11 devices retain their existing November and December schedules.

Workload authentication reduces dependence on stored credentials

Extension publishing and Copilot integrations gain short-lived credential options, while Azure SDK updates address certificate authentication and managed identity. Each change has different configuration requirements, so adoption needs to follow the specific workload's authentication path.

Marketplace Trusted Publishing replaces long-lived publishing tokens

Trusted Publishing supports publishing Visual Studio Code and Visual Studio extensions from GitHub Actions or Azure Pipelines without a long-lived personal access token (PAT). GitHub Actions uses a Marketplace policy and OpenID Connect (OIDC), with temporary credentials that expire after 15 minutes. Azure Pipelines instead requires an Entra-backed Workload Identity Federation service connection and publisher Contributor access, without a Marketplace Trusted Publishing policy.

Private-repository GitHub policies must complete a successful token exchange within 48 hours to become permanently active. PAT-based publishing remains supported, and publishers should remove stored PATs only after verifying a successful federated publish. That sequence lets teams validate the replacement authentication path before retiring existing credentials.

Copilot previews organization-owned server-to-server access

GitHub Copilot server-to-server authentication is in public preview for GitHub Apps installed on organizations. Apps need the read-only Copilot Requests organization permission and pass a short-lived installation access token to the Copilot SDK, without depending on a signed-in user's credentials.

Usage is attributed and billed to the organization owning the installation, whose model policies, budgets, and spending controls apply. Owners can identify app activity through app_client_id in AI usage CSV reports and revoke access by suspending or uninstalling the app.

Azure SDK updates strengthen authentication and fix token selection

Azure Core 1.63.0 for .NET adds mutual TLS (mTLS) proof-of-possession support for client certificate authentication and the managed identity federated identity flow. Azure Identity 1.26.0 for Python and 1.18.7 for Java add user-assigned managed identity support on Azure Arc-enabled servers. The Python release also fixes a shared-token-cache issue that could return a cached token for another account, giving teams using that cache a specific security reason to review the update.

Agent execution gets explicit permission and input boundaries

The agent-related releases distinguish between permission to execute, authorization to perform a business operation, and protection against malicious instructions. Those controls address different failure modes and should not be treated as interchangeable.

GitHub Agentic Workflows reaches general availability

GitHub Agentic Workflows is generally available on github.com for GitHub Free, Team, and Enterprise. Natural-language Markdown files compile into standard GitHub Actions YAML and reuse existing runner groups and policy constraints. Workflows can use GitHub Copilot or another coding agent, although the default GitHub Copilot CLI engine requires a Copilot license.

Safeguards include read-only default permissions, sandboxed execution, an Agent Workflow Firewall, validated safe outputs, and threat detection before changes are applied. Additional capabilities include Actions Runner Controller with Docker-in-Docker, per-workflow model providers, model routing, and Cloud Hypervisor or NVX micro-VM isolation. Teams evaluating adoption can assess both the inherited Actions policies and the agent-specific execution boundaries.

Copilot assisted permissions retain an approval fallback

Assisted permissions are generally available in GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code. A large language model evaluates requests to run commands, access file system paths, or open URLs. Requests classified as clearly safe proceed automatically, while other requests require user approval.

Enterprise administrators can block Allow All while retaining Assisted, disable Assisted independently, and choose the default permission mode for new sessions. If that default is unavailable or prohibited by policy, sessions start with manual approval. The administrative controls therefore allow assisted decisions without requiring unrestricted execution.

Power Automate actions still need business authorization

A Copilot Studio guide explains how configured actions invoke Power Automate flows that validate inputs, execute business logic, and return results. Permissions depend on authentication, connector settings, connection references, and execution context, so invoking a flow does not replace authorization checks.

Submitting a contract for approval and recording an approval decision require distinct operations and checks. Long-running approvals should return submission confirmation and a tracking reference rather than imply a final decision. The guide recommends testing unauthorized users, missing inputs, invalid records, duplicate requests, rejected approvals, and downstream failures.

Foundry demonstrates guardrails against direct and tool-borne instructions

A Microsoft Foundry demonstration attacks the Sparkles agent through user input and instructions hidden in responses from the Cupcake Store tool. Enabling Prompt Shields for user input and indirect attacks blocks both replayed attacks before the agent acts, while agent traces show where the guardrail intervenes. The demonstration provides a concrete test pattern for checking both input paths rather than testing user prompts alone.

Vulnerability triage and AI-generated fixes need evidence

Dependabot adds call-path evidence for prioritization, while Copilot exposes local security review and remediation. Microsoft's code migration work addresses the next question: how to validate changes generated at scale.

Dependabot previews reachability analysis

Dependabot reachability analysis is in public preview for JavaScript and TypeScript repositories on GitHub Enterprise Cloud, including data residency. CodeQL builds call graphs across repositories and dependencies, with analysis running in managed GitHub Actions workflows. The preview is free, requires no GitHub Advanced Security license, and does not bill the Actions minutes used for analysis.

Repositories need an npm, Yarn, or pnpm lockfile, and self-hosted runners are unsupported. The feature is off by default, may not support some complex repositories, and reruns daily while alerts remain open. It never closes or dismisses alerts.

A companion explanation recommends combining reachability with severity, exploit prediction scores (EPSS), and production context. The practical use is prioritization based on whether an application can call vulnerable dependency code, not automatic removal of alerts that appear unreachable.

Copilot's security extension keeps fixes local

The GitHub security extension is in public preview on github.com and GitHub Enterprise Cloud with data residency, but not GitHub Enterprise Server. Any Copilot plan supports installation and /security-review on local changes, and generated fixes affect only the local working copy without committing or pushing.

Viewing existing alerts requires code scanning and alert permissions, plus GitHub Code Security for private repositories. Explain, Fix, and /security-review consume AI credits using the selected model, while browsing and dismissing alerts do not use AI. Teams should distinguish the requirements for local review from those for accessing repository alerts.

Large-scale code migration combines agents with independent checks

Microsoft describes combining AI agents with static analysis, testing, and formal verification for large-scale software transformation since 2024. Examples include adding Clang/LLVM toolchain support across Windows and remediating CodeQL, PREfast, and Roslyn analyzer findings. Experts approve agent-generated knowledge bases rather than individual fixes, reserving human review for novel or ambiguous cases.

For C/C++ modernization into Rust, Microsoft uses differential testing, held-out tests, and Verus proofs to validate changes. Agents also infer TLA+ specifications, while TLC checks implementation traces. The approach separates generating a plausible change from gathering evidence that it preserves the required behavior.

Fabric centralizes governance and workspace security controls

Microsoft Fabric's OneLake catalog Govern experience is generally available, while related policy and private-connectivity controls remain in preview. Administrators need to distinguish the available governance interface from the lifecycle and limitations of each enforcement feature.

OneLake catalog brings governance into a shared view

The Govern experience centralizes governance across Fabric tenants, domains, capacities, workspaces, tags, and policies. Govern Skills are available in Skills for Fabric across the Health, Protect, and Trust pillars, using supported Fabric admin APIs and requesting confirmation before sensitive or destructive actions.

The governance insights report provides a customizable semantic model and is available to all tenants regardless of license or size. Policies Center remains in preview and supports attribute-based controls across tenants, capacities, domains, and workspaces.

Workspace editing policies restrict existing administrators

The preview Allow workspace settings editing policy initially covers customer-managed key encryption and outbound networking controls. Administrators can define rules using Microsoft Entra security-group membership, workspace, and setting type, but allow rules grant no additional privileges: users still need the workspace admin role.

Fabric enforces the policies through both the portal and APIs and records enforcement decisions in audit logs. Advanced mode blocks governed edits that match no allow rule, so allowing encryption edits alone can block managed private endpoint edits. Teams should review the full set of governed settings before applying narrowly scoped rules.

Eventstream private connectivity has capacity and destination limits

Eventstream now previews workspace-level private links for custom endpoint sources. Applications can publish through private connections using supported Kafka or AMQP clients, or Azure Event Hubs SDKs, while other workspaces retain their existing public-access settings.

Setup requires Fabric capacity with an F SKU, excluding Trial and Premium P SKU capacities. Private-link-enabled eventstreams do not support Eventhouse direct ingestion mode, Activator, or custom endpoint destinations. Those compatibility limits need checking before changing an existing ingestion workflow.

Oracle Database sovereignty extends beyond region selection

Oracle AI Database@Azure updates combine available policy controls with planned government deployments. The sovereignty guidance also identifies dependencies that remain outside the database's selected Azure region.

Government certification is planned, while policy support is available

Oracle plans to obtain FedRAMP Class D certification for Oracle AI Database@Azure in Azure Government, with dedicated Exadata infrastructure in US Gov Virginia and US Gov Arizona. These are planned government deployments, not a completed certification announcement.

The Oracle Azure Resource Provider now supports EU Data Boundary and Azure Policy. Proximity Placement Group integration is also generally available for new Exadata Database Service on Dedicated Infrastructure deployments, while existing customers can contact Oracle Support about their options.

Key custody and identity replication require separate review

The EU Data Boundary support covers EU member states and the four EFTA countries. Customer-managed keys support Azure Key Vault Standard, Premium, and Managed HSM, with revocation preventing database startup, recovery, and backup restoration using that key. Advanced networking for new deployments applies Network Security Groups, user-defined routes, Azure Firewall, and VNet flow logs to the database subnet.

OCI's Default identity domain replicates to every subscribed region, so tenancy configuration affects sovereignty beyond the database's Azure location. Existing databases continue serving reads and writes during OCI control-plane outages, while provisioning, scaling, configuration changes, and maintenance wait. Architecture reviews should therefore examine identity replication and control-plane dependencies alongside regional placement and key custody.

Other Security News

The Logic Apps Standard Azure CLI extension enters public preview with 59 commands for local development and execution diagnostics, requiring logicapp 1.0.0b1, Azure CLI 2.67.0 or later, and Python 3.10 or later. Its Outlook-to-Blob walkthrough retains cloud-hosted mailbox, managed connection, and storage resources despite local execution, while the Copilot skill supplies discovery, validation, and approval procedures; managed-connector wiring remains manual and the current testing SDK/engine combination has a reported typed-output limitation.

Microsoft Defender for Office 365 Move to Quarantine begins worldwide general availability in early November 2026, with rollout expected to finish by mid-December, supporting Inbox, Junk Email, Deleted Items, and recoverable soft-deleted messages but not hard-deleted messages or on-premises and external mailboxes. Approval requires the Search and Purge role, quarantine access defaults to administrators, and eligible messages continue processing despite individual failures, with statuses tracked in the Unified Action Center.

The GitHub Universe keynote covers the Copilot App and connectors, Copilot Fusion, Canvases, Dreaming, Projects, and automations, alongside agent-powered quality and security. A dedicated segment discusses rebuilding GitHub's core infrastructure.

An Azure Front Door discussion explains how distributed denial-of-service (DDoS) attacks exhaust CPU, memory, and network resources, and why per-IP rate limiting alone cannot distinguish all legitimate traffic from malicious traffic. It examines request-rate and CPU correlations, Microsoft Threat Intelligence, JA4 fingerprints, and probabilistic data structures as signals for real-time, inline analysis.

A Sail and LakeSail tutorial demonstrates OneLake access through a Microsoft Entra service principal, while LakeSail Cloud Sessions proxy private compute using scoped, time-limited tokens. Sail supports Spark SQL and DataFrame workloads targeting Spark 3.5 or 4.x subject to compatibility checks, but the reported nearly 98% cost reduction is not a measured OneLake saving.

The Azure weekly video covers confidential virtual machines, VNet Flow Log filtering, Azure Front Door profile and route web application firewall policies, and Azure Backup cross-tenant restore. A separate Microsoft security overview discusses security foundations, securing AI, MDASH, Perception, Defender ISOC, and DART.

Also relevant this week