Microsoft

Security news, advisories and exploited vulnerabilities.

Actively exploited (CISA KEV)

CVEs in the news

Timeline (last 30 days)

• ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants — Infosecurity Magazine, 2026-10-19
• Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks — Help Net Security, 2026-10-19
• Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365 — Security Affairs, 2026-10-19
• Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services — Cybersecurity News, 2026-10-19
• Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services — Cybersecurity News +1 sources, 2026-10-19
• Ongoing Microsoft 365 Campaign Abuses ConnectWise App — Decipher, 2026-10-18
• ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants — The Hacker News, 2026-10-18
• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack — BleepingComputer, 2026-10-17
• MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon — The Hacker News, 2026-10-17
• Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts — Cybersecurity News, 2026-10-17
• Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts — Cybersecurity News, 2026-10-17
• Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants — The Hacker News, 2026-10-17
• Networking problems after the October 2026 Windows update? NTLM might be to blame — The Register, 2026-10-16
• CVE-2026-105008 Windows Schannel Spoofing Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-96044 Microsoft Office SharePoint Elevation of Privilege Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-83831 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-85890 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-85897 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-85898 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-96198 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Update Guide, 2026-10-16
• CVE-2026-96199 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability — Microsoft Security Update Guide, 2026-10-16
• Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts — Cybersecurity News, 2026-10-16
• Microsoft: October Windows update may break Smart App Control — BleepingComputer, 2026-10-16
• Microsoft Patches Two Dozen RCE Flaws in Office — SecurityWeek, 2026-10-16
• KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs — Cybersecurity News, 2026-10-15
• Microsoft Fixes Windows 11 Update Issue that Causes Black Screen Errors or Windows Explorer crash — Cybersecurity News, 2026-10-15
• Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet — Cybersecurity News, 2026-10-15
• CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET — AWS Security Bulletins, 2026-10-14
• CVE-2026-7461 - OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials — AWS Security Bulletins, 2026-10-14
• Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities — CyberScoop, 2026-10-14
• Microsoft VSS: Still Essential, But Not the Whole Story — Huntress, 2026-10-14
• CVE-2026-0314 GlobalProtect App: Local Denial of Service (DoS) on Windows (Severity: MEDIUM) — Palo Alto Networks Advisories, 2026-10-14
• Microsoft’s Recent Windows Updates Break Remote Desktop Services With Error “0xC000000D” — Cybersecurity News, 2026-10-14
• Microsoft’s Recent Windows Updates Break Remote Desktop Services With Error "0xC000000D" — Cybersecurity News, 2026-10-14
• Microsoft, Health-ISAC and partners take down popular phishing kit services — Cybersecurity Dive, 2026-10-14
• Microsoft fixes VPN issues caused by September Windows updates — BleepingComputer, 2026-10-14
• Meta, Google, Microsoft and OpenAI Join Global Crackdown on West African Scam Networks — Cybersecurity News, 2026-10-14
• Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals — The Record, 2026-10-14
• Global takedown hits network behind 1 billion phishing messages — BleepingComputer +5 sources, 2026-10-14
• Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages — SecurityWeek, 2026-10-14
• Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem — CyberScoop, 2026-10-14
• Update Windows: Record Patch Tuesday fixes flaw already under attack — Malwarebytes Labs, 2026-10-14
• Microsoft: Recent Windows updates may trigger Remote Desktop failures — BleepingComputer, 2026-10-14
• Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks — Cybersecurity News, 2026-10-14
• Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks — Cybersecurity News, 2026-10-14
• Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs — Infosecurity Magazine, 2026-10-14
• Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks — Cybersecurity News, 2026-10-14
• Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave — The Hacker News, 2026-10-14
• Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks — Cybersecurity News, 2026-10-14
• Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks — Cybersecurity News +4 sources, 2026-10-14
• Microsoft Patches More Than 1,400 Security Flaws — Krebs on Security, 2026-10-13
• Microsoft Patch Tuesday, October 2026 Security Update Review — Qualys Threat Research +2 sources, 2026-10-13
• Microsoft releases Windows 10 KB5126657 extended security update — BleepingComputer, 2026-10-13
• Microsoft: Windows 11 24H2 Home and Pro reached end of support — BleepingComputer, 2026-10-13
• Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts — Cybersecurity News, 2026-10-13
• Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts — Cybersecurity News, 2026-10-13
• Windows 11 KB5127648 & KB5126653 cumulative updates released — BleepingComputer, 2026-10-13
• October 2026 Patch Tuesday: 1,411 fixes and counting — ThreatHunter.ai +9 sources, 2026-10-13
• WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows — Cybersecurity News, 2026-10-12
• Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption — BleepingComputer, 2026-10-12
• Microsoft: Windows 11 23H2 reaches end of support in 30 days — BleepingComputer, 2026-10-12
• Microsoft’s new model helps AI agents judge their next move — Help Net Security, 2026-10-12
• Windows PCs missing key updates could lose security fixes in 2027 — Help Net Security, 2026-10-12
• Microsoft: Outdated Windows devices will stop receiving security updates — BleepingComputer, 2026-10-09
• “Azure30” Node.js Backdoor Delivered by a Trojanized MSI — ThreatHunter.ai, 2026-10-09
• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer — Huntress +1 sources, 2026-10-08
• NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL — CloudSEK, 2026-10-08
• Microsoft, Adobe, Apple, and Foxit vulnerabilities — 0dayfans, 2026-10-07
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs — Huntress, 2026-10-07
• Your Windows PC can now reach other PCs through Windows App — Help Net Security, 2026-10-07
• A 32-node Azure fleet is checking the internet for 1,197 webshell filenames — HoneyLabs, 2026-10-07
• 'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates — Dark Reading, 2026-10-06
• Microsoft extends the Outlook naughty step with two more file types — The Register, 2026-10-06
• Nikkei discloses breaches of employees’ Microsoft, Google email accounts — BleepingComputer, 2026-10-06
• ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits — The Hacker News, 2026-10-06
• Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes — The Hacker News +1 sources, 2026-10-05
• Falcon Data Security for SaaS Secures Sensitive Data in Microsoft 365 — CrowdStrike, 2026-10-05
• Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure — Security Affairs, 2026-10-04
• China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing — The Hacker News, 2026-10-04
• Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware — The Hacker News, 2026-10-03
• doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures — SecurityWeek, 2026-10-03
• Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel — Security Affairs, 2026-10-03
• Warlock ransomware breach SharePoint in water, telecom operator attacks — BleepingComputer, 2026-10-02
• Defending against AI-fueled cyberattacks requires focus on identity, data governance, Microsoft says — Cybersecurity Dive, 2026-10-02
• Microsoft: AI Cuts Post-Compromise Attack Time to Minutes — Infosecurity Magazine, 2026-10-02
• Crypto Scammers Hijack Microsoft’s Official X Account — SecurityWeek, 2026-10-02
• Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks — SecurityWeek, 2026-10-02
• Microsoft’s X account hacked in crypto pump-and-dump scheme — BleepingComputer, 2026-10-02
• Microsoft says threat actors are ahead in the early AI race — BleepingComputer, 2026-10-01
• Microsoft catches hackers exploiting Zimbra bug before disclosure — The Register, 2026-10-01
• Insights from the 2026 Microsoft Digital Defense Report — Microsoft Security Blog, 2026-10-01
• ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability — ZDI Published Advisories, 2026-10-01
• ​​Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026 — Microsoft Security Blog, 2026-09-30
• 16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows — The Register, 2026-09-30
• Microsoft to block Entra ID script injection attacks starting October — BleepingComputer, 2026-09-30
• US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access — The Hacker News, 2026-09-30
• Microsoft Warns NeedyMantis Malware Enables Persistent Network Access — Infosecurity Magazine, 2026-09-29
• Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate — Qualys Threat Research, 2026-09-29
• JadePuffer crims hijacked Azure identities and used them to blow up cloud resources — The Register, 2026-09-28
• JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack — Dark Reading, 2026-09-28
• Decades-old file security flaws found in Android, Linux, macOS, and Windows — The Register, 2026-09-24
• ​​​​​​​​What’s new in Microsoft Security: September 2026​​ — Microsoft Security Blog, 2026-09-24
• Managed or Modified: Choose How Huntress Hardens Microsoft 365 — Huntress, 2026-09-24
• Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications — Bishop Fox, 2026-09-24
• File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”) — LevelBlue SpiderLabs, 2026-09-24
• Over 75% of Organizations Experience Microsoft 365 Governance Issues — Infosecurity Magazine, 2026-09-24
• Enumerating Users and MFA via Microsoft's Password Reset Portal — LevelBlue SpiderLabs, 2026-09-23
• Reimagining the SOC for the agentic era in Microsoft Defender — Microsoft Security Blog, 2026-09-23
• Windows Botnet x47.c Offers AI API Draining, 18 Attack Methods — Infosecurity Magazine, 2026-09-23
• OAuth Token Theft Through Microsoft's Front Door — Huntress, 2026-09-23
• Researchers Find Windows Malware With Autonomous C2 Functionality — Decipher, 2026-09-22
• Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions — The Register, 2026-09-22
• Microsoft Disrupts EvilTokens Device Code Phishing Service — Dark Reading, 2026-09-22
• Microsoft disrupts AI-assisted platform that compromised 12,000 accounts — Ars Technica, 2026-09-22
• NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past — The Register, 2026-09-22
• UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites — The Register, 2026-09-22
• Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits — Volexity, 2026-09-21
• Windows Exploitation Techniques: Dangling COM Object Registrations — Project Zero, 2026-09-21