News · via Microsoft Security Response Center
CVE-2026-69409 Microsoft Office SharePoint Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft
Coverage tagged "Microsoft".
News · via Microsoft Security Response Center
CVE-2026-69282 Microsoft Office SharePoint Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
News · via Microsoft Security Response Center
CVE-2026-80073 Microsoft Office Outlook Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
News · via BleepingComputer
Windows 11 KB5124010 update released with 46 changes and fixes
Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2, with 46 changes including Bluetooth improvements and the ability to remap the Copilot key.
News · via Infosecurity Magazine
Over 75% of Organizations Experience Microsoft 365 Governance Issues
ShareGate study claims to reveal a governance ‘crisis’ as AI usage grows
News · via Hornetsecurity
Email Prompt Injection: The New Phishing Risk Hiding in Enterprise Inboxes
A seemingly harmless email can contain instructions meant for the AI assistant that handles, summarizes, or acts on your email. This is important as organizations start to connect AI tools like…
News · via The Register
Government contractor exposed path to immigration records
Welcome back to PWNED, the column where we look at all the ways your security can become self-owned. Today’s scary story involves government contractors who just had to make their lives easier at the…
News · via BleepingComputer
Microsoft fixes bug that broke Windows File History backup feature
Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates.
News · via The Hacker News
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According…
News · via arXiv cs.CR
SAGEGAN: Style-Based Anomaly Detection with Gaussian Embeddings using Generative Adversarial Networks
arXiv:2609.27357v1 Announce Type: new Abstract: Malware evolves faster than rule-based and signature-driven detection pipelines. This paper presents SAGEGAN, a benign-only trained malware anomaly…
News · via Malwarebytes Labs
How device code phishing gives scammers access to your account
You receive an invitation to a password-protected meeting, a secure chatroom, or a shared document. To get access, it says, you need to enter a short code on a sign-in page for one of your accounts…
News · via Microsoft Security
Reimagining the SOC for the agentic era in Microsoft Defender
The physics of cybersecurity are changing. So must the security operations center (SOC). Cyberattackers are using agents to automate execution at unprecedented scale.
News · via The Register
Academic publisher Elsevier hit by LAPSUS$ redirect attack
Academic publishing giant Elsevier confirmed a compromise this week after students found its platform redirecting users to a cybercriminal crew's leak page. One Reddit user, a self-described nursing…
News · via Microsoft Security Response Center
CVE-2026-70125 Microsoft Outlook Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in September 2026, but the CVE was inadvertently omitted from the September 2026 Security Updates. This is an informational…
News · via Help Net Security
Fake Claude Max giveaway tricks users into handing over their Google account credentials
A fake Claude Max giveaway uses a spoofed Google sign-in window to steal users’ login credentials, Malwarebytes researchers have found. “Browser-in-the-browser” is not a new technique. Researchers…
News · via Huntress
OAuth Token Theft Through Microsoft's Front Door | Huntress
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
News · via Malwarebytes Labs
Fake Claude Max giveaway hides a Google account phishing trap
Phishing follows whatever people want at the moment, and right now that includes AI subscriptions they don’t have to pay for. We recently uncovered a new variation on this theme: A fake Claude Max…
News · via SecurityWeek
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.
News · via BleepingComputer
Microsoft: September Windows updates break Always On VPN connections
Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems.
News · via Security Affairs
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Microsoft, Coinbase and law enforcement took down EvilTokens, a phishing kit that compromised 12,000 inboxes through device-code phishing and AI. EvilTokens showed up in February 2026 and moved fast…