Vulnerabilities
Experts say this is the second-largest Microsoft Patch Tuesday ever based on CVE count.
Hi, what are you looking for?
SecurityWeek
All posts tagged "Microsoft"
Privacy
Claims that “Microsoft is running one of the largest corporate espionage operations in modern history” face scrutiny as researchers analyze LinkedIn’s browser extension probing
Fraud & Identity Theft
Several major tech and retail companies have signed an industry accord against online scams and fraud.
Vulnerabilities
Microsoft has fixed a critical vulnerability, but none of the flaws fixed this Patch Tuesday has been exploited in the wild.
Cybercrime
The phishing-as-a-service platform was used to send fraudulent emails to over 500,000 organizations every month.
Endpoint Security
Windows will have runtime safeguards enabled by default, ensuring that only properly signed software runs.
Endpoint Security
After a decade and a half of service, the current certificates will expire, and new ones will be rolled out.
Vulnerabilities
Microsoft’s Patch Tuesday updates fix roughly 60 vulnerabilities found in the company’s products.
Vulnerabilities
The vulnerability is tracked as CVE-2026-21509 and it can be exploited to bypass security features.
Phishing
Threat actors are leveraging the file-sharing service for payload delivery in AitM phishing and BEC attacks.
Cybercrime
RedVDS enables threat actors to set up servers that can be used for phishing, BEC attacks, account takeover, and fraud.
Email Security
Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally.
Vulnerabilities
All critical vulnerabilities in Microsoft, third-party, and open source code are eligible for rewards if they impact Microsoft services.
CISO Strategy
Promotions across Microsoft’s security organization reinforce the company’s shift toward AI-driven defense and tighter operational oversight under Global CISO Igor Tsyganskiy.
Endpoint Security
Windows now displays in the properties tab of LNK files critical information that could reveal malicious code.
Artificial Intelligence
Without proper security controls, AI agents could perform malicious actions, such as data exfiltration and malware installation.
Cybercrime
Microsoft said the DDoS attack was aimed at an endpoint in Australia and reached 15.72 Tbps and 3.64 Bpps.
Management & Strategy
Microsoft announced new security capabilities for Defender, Sentinel, Copilot, Intune, Purview, and Entra.
Vulnerabilities
CVE-2025-59287 allows a remote, unauthenticated attacker to execute arbitrary code and a PoC exploit is available.
Endpoint Security
In files downloaded from the internet, HTML tags referencing external paths could be used to leak NTLM hashes during file previews.
Artificial Intelligence
Researchers say the new ‘Cryptographic Context Injection’ technique conceals malicious instructions until they are decrypted inside a trusted execution environment.
Cloud Security
Vulnerabilities
Artificial Intelligence
Malware & Threats
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.
Management & Strategy
Vulnerabilities
