Microsoft, Health-ISAC seize domains behind 1B phishing messages
Microsoft's DCU and Health-ISAC seized domains for YAM Store, CoGUI and Iron Man — a Chinese-language phishing marketplace Microsoft ties to over 1 billion messages since January.
Stories tagged: #microsoft
Microsoft's October Patch Tuesday fixes 1,411 flaws, one exploited
Microsoft's October 2026 Patch Tuesday fixed over 1,400 flaws, including an exploited Windows Shell bypass (CVE-2026-96951) and a disclosed .NET bug (CVE-2026-108398).
Norway fines Microsoft's Xandr 92M NOK over Grindr RTB data
Norway's Datatilsynet fined Microsoft-owned Xandr 92M NOK (€8.6M) for sharing sensitive Grindr-user data via real-time bidding without a legal basis. Its largest fine to date.
Exchange flaw CVE-2026-96940 lets users read colleagues' mail
CVE-2026-96940, a CVSS 8.8 weak-authorization flaw in on-prem Exchange, lets an authenticated user read other mailboxes in the same org. Fix ships in the September V2 security updates.
Microsoft's X account hijacked in $Clippy crypto pump-and-dump
Microsoft confirmed unauthorized access to its 13M-follower official X account on Oct 2 after it promoted a fake $Clippy token. Posts were removed within about half an hour.
Warlock ransomware hits critical infrastructure via SharePoint
Symantec says the Warlock operator, tracked as Longlegs/Storm-2603, hit a water utility, a telecom, a regional government and a university using ToolShell SharePoint exploits.
Microsoft Entra ID to enforce CSP, blocking sign-in script injection
From mid-October 2026, Entra ID enforces a Content Security Policy on login.microsoftonline.com, allowing only Microsoft-trusted scripts. Extensions and tools that inject code into sign-in will break.
Star Blizzard hits 100+ orgs with RedFlick, CosmicPulse backdoor
Microsoft ties 13 phishing campaigns since January to Russia's Star Blizzard, using a new RedFlick delivery technique to drop the CosmicPulse backdoor at 100+ US/UK orgs.
Windows VMSwitch CVE-2026-57092: CVSS 9.9 guest-to-host escape in Hyper-V
Microsoft's July 14 Patch Tuesday closed CVE-2026-57092 — a CVSS 9.9 use-after-free in the Windows VMSwitch that lets a low-privileged guest reach the Hyper-V host.
AD FS zero-day CVE-2026-56155: Microsoft DART finds DKM ACL bug already exploited
Microsoft's DART discovered CVE-2026-56155 during a live intrusion. CISA added it to KEV on July 14. Patch KB 5121391 audits DKM ACLs today, auto-remediates October 13.
LegacyHive drops Windows profsvc zero-day PoC after Patch Tuesday
Nightmare Eclipse published LegacyHive on GitHub the same day as Microsoft's July 2026 Patch Tuesday. It's an unpatched profsvc LPE that still works on fully-updated Windows.
CISA adds SharePoint CVE-2026-56164 to KEV, chained with two prior bugs
CISA added SharePoint auth-bypass CVE-2026-56164 to KEV on July 14 and re-issued a hardening alert citing three chained on-prem SharePoint CVEs under active exploitation. FCEB deadline July 17.
Microsoft patches Defender RoguePlanet LPE CVE-2026-50656
Microsoft shipped Malware Protection Engine 1.1.26060.3008 on July 9 to close a race condition in mpengine.dll that hands SYSTEM to any local user. Public PoC has been circulating for a month.
CISA adds SharePoint CVE-2026-45659 to KEV, FCEB deadline July 4
CISA added SharePoint RCE CVE-2026-45659 to the KEV catalog on July 1 after confirmed exploitation. Deserialization bug patched OOB May 21; FCEB agencies have three days.
Microsoft June 2026 Patch Tuesday: 3 publicly disclosed zero-days
Microsoft's June 9 Patch Tuesday fixes around 200 CVEs and 33 Critical flaws, including publicly disclosed zero-days in BitLocker, HTTP.sys (HTTP/2 Bomb) and CTFMON.
VS Code github.dev zero-day exposed full GitHub OAuth tokens in one click
Researcher Ammar Askar dropped a webview-postMessage exploit on June 2 that steals github.dev OAuth tokens via a single click. Microsoft shipped a stopgap fix the next day.
Windows Netlogon RCE CVE-2026-41089 now exploited in the wild
Belgium's CCB confirms active exploitation of the CVSS 9.8 Netlogon stack-overflow patched by Microsoft in May. Unauthenticated, no user interaction, domain controller takeover.