Browse All Security Content (480)

Richard Lander explains how NuGet packages can carry version-matched agent skills alongside library binaries. He demonstrates tools for discovering and copying those skills into repositories, compares package delivery with Git-based approaches, and discusses model evaluation, token costs, and the security implications of agents consuming package documentation.

tompeplow demonstrates how OneLake supports agent-driven data engineering through hosted MCP servers, endpoint discovery, and shortcuts. Using GitHub Copilot, the examples explore mirrored databases, document permissions, combine external data in a Lakehouse, and run SQL and Spark analytics while working within existing access permissions.

Microsoft Security Research and Jiacen Xu examine a fake-download campaign that bundles proxyware, distributed-computing software, and unwanted utilities through trojanized installers. They explain its staging and callback patterns, scheduled-task persistence, and Microsoft Defender hunting queries, with guidance for correlating evidence across an entire installer session rather than individual payload attempts.

Yun Jung Choi explains how six specialized Azure plugins extend AI-agent workflows for AKS troubleshooting, cost analysis, Advisor recommendations, graph queries, Azure Local, and Foundry IQ knowledge bases. The guide includes example prompts, installation commands for supported clients, and approval requirements for resource changes and disruptive operations.

Allison outlines CodeQL 2.27.3 updates for GitHub code scanning, including Python 3.15 support, JSON data extensions, and improved analysis across languages. The release also adds an opt-in threat model for LLM-generated data and introduces GitHub Actions control flow changes that may require updates to custom queries.

Allison announces that Dependabot now supports Python 3.15, allowing projects to upgrade while continuing to receive dependency updates. Support is available to all github.com users and will also be included in GitHub Enterprise Server 3.24.

Wiliam_Rosa explains how to configure environment variables for Azure Databricks serverless jobs using the Jobs API. The walkthrough covers task-level selection, inline and file-based precedence, secret references, and configuration limits, including why best-effort log redaction still requires care when handling credentials.

Emanuele Bartolesi recaps GitHub Universe 2026 through its two keynotes, connecting Copilot’s multi-repository workflows with review, security, and Git infrastructure changes. His practical takeaways focus on verification gates, contributor guardrails, shared planning, and keeping human judgment central as teams adopt coding agents.

kinfey explains how Meridian 24 separates managed AI research and editing from deterministic audio production and publication. The implementation uses Microsoft Copilot Harness, Foundry and durable Blob storage to produce bilingual bulletins, with evidence checks, recovery checkpoints, identity permissions and measured audio timing rather than relying on a single prompt.

Allison explains how GitHub Desktop 3.6.10 and later use short-lived, automatically refreshing authentication tokens for eligible accounts. The gradual rollout reduces leaked-token exposure without manual renewal for Git operations or API requests. Existing sessions remain signed in, but existing tokens are not automatically migrated, and GitHub Enterprise Server is excluded.

sbaynes shares how Microsoft's Copilot Cowork team used coding agents, written specifications, automated reviews, and human checkpoints to build and migrate a live service. The article explains practical controls for parallel development, security boundaries, trustworthy tests, and a Python-to-Rust migration, including measured gains and remaining limitations.

Microsoft Security Research, Yair Tsarfaty and Or Begam analyze which vulnerabilities attackers actually exploit and why system-takeover flaws deserve priority. Their findings connect exploitation patterns and patching delays with practical use of Microsoft Defender exposure scores and attack path analysis to reduce risk beyond patching alone.

WSilveira collects November’s Azure Logic Apps product and community updates, including a local CLI preview, AI agent orchestration, pricing allowances, and hybrid storage benchmarks. The newsletter also points developers to secure Foundry integrations, C# workflow tooling, Fabric real-time analytics, deployment walkthroughs, and BizTalk migration guidance.

Allison explains how GitHub’s code security and secret risk assessments now distinguish findings in protected and unprotected repositories. The update helps organization admins and security managers identify gaps in security coverage, with availability in GitHub Enterprise Cloud and GitHub Team and planned secret assessment support in Enterprise Server 3.24.

Allison outlines GitHub Actions’ upcoming default block on pull_request_target events in public repositories, with enforcement moved to December 2, 2026. Two November brownouts will help maintainers identify affected workflows. The update explains how to review blocked runs and explicitly permit workflows while accounting for risks to repository secrets.

Azure Cloud HSM Hardware Audit Logging is rolling out across public regions, giving security teams searchable operational records and hardware-signed audit batches they can independently verify. Investigations into malicious Claude Code-branded Cursor extensions and help desk impersonation show why remediation must address persistent SSH artifacts, privileged certificates, and previously issued Kerberos tickets rather than stop at the initial entry point. Marketplace Trusted Publishing introduces publishing without long-lived personal access tokens, while GitHub Copilot's server-to-server authentication preview gives organization-installed apps short-lived credentials governed by organizational policies and budgets. GitHub Agentic Workflows and Copilot assisted permissions reached general availability with execution safeguards and approval controls, while Dependabot's reachability preview adds call-path evidence for vulnerability prioritization and Copilot's security extension previews

ibrahimbaig explains how to build repository-scoped, ephemeral GitHub Actions runners using Azure Container Apps Jobs and KEDA. The guide covers private Key Vault access, GitHub App authentication, separate OIDC deployment identities, lifecycle validation, and the cold-start trade-offs of installing tools at runtime rather than using pre-baked images.

Carlin Cherry explains how reachability analysis follows call paths to determine whether an application can invoke vulnerable dependency code flagged by Dependabot. The short introduces reachability as one signal for prioritizing vulnerabilities, alongside severity, EPSS, and production context, rather than a standalone basis for deciding what to fix.

Microsoft Security Research analyzes a malicious Claude Code-branded extension distributed through Cursor’s marketplace, detailing its attempted SSH backdoor and cross-platform persistence. The article provides Microsoft Defender detections, hunting queries, and remediation steps, explaining why removing the extension alone does not eliminate unauthorized keys and startup artifacts.

John Savill reviews this week's Azure updates, covering Container Apps logging, confidential VMs, network security, storage quotas, and cross-tenant backup restore. The Halloween edition also covers Azure AI Foundry model cost management, Azure MCP Server 3.0, new model topics, and GitHub Universe.

Microsoft Security Research, Sagar Patil, Jesse Birch and Tal Tzhori examine two intrusions that escalated from help desk impersonation to AD CS certificate abuse. Their analysis explains ESC1 and ESC8 attack paths, contrasting containment outcomes, and practical Microsoft Defender hunting queries and hardening measures for certificate-backed identity compromise.

spurthikommajos explains how Microsoft Fabric Eventstream’s preview support for workspace-level private connectivity lets custom applications publish events without public internet access. The article covers Azure private endpoints, workspace-scoped network restrictions, setup prerequisites, and supported analytics destinations, including important capacity requirements and ingestion limitations.

yaelbiss explains how Microsoft Fabric’s preview Allow workspace settings editing policy restricts sensitive encryption and networking changes without removing workspace administrator responsibilities. The article covers security-group-based rules, development and production boundaries, audit logging, and allow-list behavior that administrators should test before activating policies across a tenant.

amitch and Shehab Amin explain how Sail connects Spark-compatible workloads to Microsoft OneLake without copying data. They demonstrate lakehouse transformations, Python-based embedding generation, and scoped access through LakeSail Cloud Sessions, while outlining compatibility checks and limitations of the reported performance and cost comparisons.

Allison details three additional IP ranges for GitHub webhook deliveries, now included in the Meta API. Teams using static network allowlists need to add the prefixes to avoid rejecting deliveries. Allowlists kept current through the Meta API require no changes, and the additions apply across all github.com plans.

Microsoft Threat Intelligence examines how North Korean threat actors use AI to accelerate reconnaissance, identity deception, malware development, and operational scaling. The report distinguishes observed activity from suspected AI use, explains why operations remain human-directed, and provides Microsoft Defender detections and practical guidance for protecting identities, endpoints, and software repositories.

Salim Chawro introduces Hardware Audit Logging for Azure Cloud HSM, which records supported management operations directly from the hardware. Signed audit data and certificates enable independent verification, while Azure Monitor Log Analytics delivery supports investigations and monitoring. The feature is rolling out across public regions and is automatically enabled on new resources where available.

nareshvenkat introduces Project Osmos, a data engineering agent for Microsoft Fabric that investigates datasets, executes PySpark, and validates results. Persistent, shared tasks retain project context while teams define operating boundaries, review evidence, and guide changes. Tasks can be initiated through GitHub Copilot CLI, Claude Code, or Codex.

GitHub recaps the opening keynote at GitHub Universe 2026, covering a dedicated Copilot app, third-party connectors, and multi-model orchestration through Copilot Fusion. The video also highlights multi-repository agent workflows with Copilot Projects, cloud sandboxes, Code Review Max, code scanning, and architectural upgrades to Git.

Michael MacKenzie explains how IoT, industrial AI, and physical AI connect machine data to decisions and actions. He outlines the roles of Azure IoT Hub, Azure IoT Operations, and Azure Device Registry, including operational inference and the policy, access, and certificate controls that bridge IT and operational technology.

April Leonard, Jay Parikh, Cassidy Williams, Burke Holland, and Damian Brady present GitHub Universe 2026’s opening keynote. The session covers GitHub Copilot updates, autonomous agent workflows, agent-powered quality and security, and changes to GitHub’s core infrastructure, with live demonstrations of developer tools and capabilities.

LeeBenjamin introduces the generally available Govern experience in Microsoft Fabric’s OneLake catalog and the new Govern Skills collection. Together, they provide centralized estate insights, policy controls, and AI-assisted governance checks, with evidence-based recommendations and confirmation before sensitive changes through tools such as GitHub Copilot.

JPCalhau explains how to give Azure API Management v2 predictable outbound public IP addresses using virtual network integration and Azure NAT Gateway. The walkthrough covers subnet configuration, network security groups, NAT association, and validation, while explaining why backend IP allowlisting should complement rather than replace service-to-service authentication.

John Edward explains why hotpatch-enabled Windows Server 2022 systems will require restarts for November and December 2026 security updates. The article outlines affected devices, the planned January baseline update, and practical steps for scheduling maintenance, coordinating failover, and verifying successful installation without changing hotpatch enrollment.

Lynn Dai introduces Trusted Publishing for Visual Studio Marketplace, enabling extension releases from GitHub Actions and Azure Pipelines without long-lived personal access tokens. The article explains federated identity setup, GitHub policy activation, Azure Pipelines service connections, and how to migrate existing publishing workflows while verifying access before removing stored secrets.

GitHub Staff examines the 2026 Octoverse findings on repository activity, agent-started pull requests, and changing model choices. The report connects growing use of coding agents with shifts in review workflows, GitHub Actions usage, and language participation, while explaining the telemetry’s limitations and announcing general availability of GitHub Copilot Fusion.

WSilveira introduces the public preview of the Logic Apps Standard CLI extension, covering local workflow creation, connector discovery, validation, execution diagnostics, and packaging. An Outlook-to-Blob walkthrough explains managed-identity setup and preview limitations, while a GitHub Copilot skill provides procedures for agent-assisted development with explicit approval for cloud changes.

Allison introduces the GitHub security extension, now in public preview for the GitHub Copilot app. Developers can browse code scanning alerts, ask Copilot to explain or fix them locally, and review changes before opening pull requests. The announcement also covers permissions, AI credit usage, and supported GitHub environments.

Allison announces general availability of GitHub Agentic Workflows, which compiles natural-language Markdown into GitHub Actions workflows powered by coding agents. The release adds runner support, model routing, and stronger isolation, with read-only defaults and validated outputs. The default GitHub Copilot CLI engine requires a Copilot license.

Allison introduces Dependabot reachability analysis, now in public preview for JavaScript and TypeScript on GitHub Enterprise Cloud. Using CodeQL and managed GitHub Actions workflows, it identifies call paths to vulnerable dependency functions and adds verdicts to alerts, helping teams prioritize remediation without automatically dismissing vulnerabilities.