Search
Articles · 50
Microsoft discloses CVE-2026-83947 in Azure Event Grid
Microsoft has disclosed CVE-2026-83947, a CVSS 7.7 HIGH spoofing vulnerability in Azure Event Grid caused by missing authorization. Microsoft says it has already fully mitigated the cloud-service flaw and customers have nothing to do.
Critical CVE-2026-77900 Hits Microsoft Azure App Service for Linux
A critical vulnerability CVE-2026-77900 affects Microsoft Azure App Service for Linux with a CVSS score of 9.8. The flaw allows an unauthenticated attacker to execute code over the network. Microsoft says it has already fully mitigated the flaw; no customer action is needed.
Critical CVE-2026-88131 hits Microsoft Dataverse with remote code execution
Microsoft Dataverse is affected by critical vulnerability CVE-2026-88131, which allows remote code execution. The flaw scores 9.8 on CVSS; Microsoft says it has already fully mitigated it and customers have nothing to patch.
First Nvidia RTX Spark laptops range from $2,599 to nearly $7,000
The first laptops built on Nvidia's RTX Spark chip, from Microsoft, Asus, Dell, HP, Lenovo and MSI, start at $2,599 and climb to $6,999.99 for a maxed-out Asus ProArt P16 with 128GB of unified memory, The Verge reports. The first models ship as early as October 16.
Meta and Microsoft Slash Employee Claude AI Spending
Meta and Microsoft are cutting employee use of Anthropic’s Claude AI and directing staff toward their own coding tools, The Information reported. The changes reflect tighter internal AI budgets while customer access to Claude through Microsoft platforms continues to expand.
Microsoft preparing local MAI-Code-1.1-Flash for high-end PCs
Microsoft has introduced a local edition of MAI-Code-1.1-Flash that runs on Windows PCs without server access. The model requires substantial memory and is coming to GitHub Copilot in experimental preview by the end of October, starting with Nvidia RTX Spark PCs.
Microsoft opens Surface Laptop Ultra preorders and pushes AI agents deeper into Windows
At its Windows and Surface event, Microsoft opened preorders for the $2,599 Surface Laptop Ultra and the $5,999 Surface RTX Spark Dev Box, and said Copilot will be able to use files and act across Windows in the coming months.
NVIDIA, Microsoft Open RTX Spark Preorders and Push AI Agents on Windows PCs
NVIDIA and Microsoft opened RTX Spark preorders and made Microsoft Execution Containers generally available at the Windows AI and Surface event, aimed at running AI agents on Windows PCs. RTX Spark laptops, first introduced in June, are on preorder today with up to 128 GB unified memory and one petaflop of AI compute, shipping October 16.
Microsoft is giving Copilot access to your Windows files and the power to act on them
Microsoft says Copilot on Copilot+ PCs will be able to use files and recent activity on your PC, take actions across Windows, and tap local AI models, with your permission. The features are expected to start rolling out in the coming months.
Windows 11 Insider Builds Add Updated Search and Battery Widget
Microsoft released new Windows 11 Insider Preview builds to Beta and Experimental channels on October 7. The updates introduce a redesigned Windows Search with inline actions and a Battery Status widget.
Microsoft introduces Magnetic Connect charging for Surface Laptop Ultra
Microsoft announced Magnetic Connect, a magnetic USB-C charging solution for the Surface Laptop Ultra that keeps the port's video and data functions. The laptop starts at $2,599 and begins shipping October 16.
Microsoft Turns Windows Task Bar Search Into AI Chatbot This Fall
Microsoft will turn the Windows Task Bar search menu into a chatbot interface this fall that handles thousands of actions through typed commands. The redesign lets users control settings, access Copilot and send messages without separate apps.
Microsoft shows hybrid AI running large models locally on Windows
Microsoft demonstrated hybrid intelligence on Windows that runs AI models from 70 billion to 284 billion parameters locally. The approach keeps data on-device, supports offline use, and switches to cloud models for heavier tasks.
Surface Laptop Ultra will launch October 16 starting at $2,599
Microsoft has set an October 16 launch date for the Surface Laptop Ultra with pricing from $2,599. The RTX Spark-powered laptop targets premium creative, gaming, and AI workloads.
Surface RTX Spark Dev Box opens preorder at $5,999
Microsoft’s Surface RTX Spark Dev Box is available for preorder at $5,999 with November shipping. The Nvidia-powered mini PC targets developers running local AI models exceeding 120B parameters.
Microsoft Rolls Out Windows 11 2026 Update as Small Enablement Package
Microsoft has begun rolling out Windows 11 version 26H2 as a small enablement package. The update resets support timelines and offers no exclusive new features for users already on recent versions.
Microsoft Outlook Flaw CVE-2026-100208 Could Allow Remote Code Execution
Microsoft Office Outlook has an integer overflow flaw, CVE-2026-100208, that could let an unauthorized attacker run code over a network. Microsoft scores it 7.5 (High), and an attack needs user interaction.
CISA Adds Microsoft SharePoint Code Injection Flaw CVE-2026-65660 to KEV
CISA added CVE-2026-65660, a Microsoft SharePoint code injection vulnerability, to its Known Exploited Vulnerabilities catalog on September 25, with a federal deadline of September 28. The flaw could let an authorized attacker execute code over a network and carries a Microsoft CVSS 3.1 score of 8.8.
Microsoft unveils Surface Pro 12-inch and Laptop 13-inch with Snapdragon X2 Plus
Microsoft announced the Surface Pro 12-inch and Surface Laptop 13-inch with Snapdragon X2 Plus at the Snapdragon Summit, citing up to 95% faster on-device AI and 18% better battery efficiency. The devices maintain prior form factors while adding features such as Ink Canvas and a recycled-content enclosure, with the Pro model priced from $1149.99 and shipping October 13.
Microsoft Sets October 7 Windows and Surface Event With Nadella and Jensen Huang
Microsoft will hold a Windows and Surface event in San Francisco on October 7, 2026, framed as a conversation on how local AI will shape the next chapter of the PC. CEO Satya Nadella, Nvidia CEO Jensen Huang, and Windows and Surface lead Pavan Davuluri are expected to appear. Coverage is set for 10 a.m. PT / 1 p.m. ET.
Microsoft Edge Use-After-Free Flaw CVE-2026-85893 Rated High Severity
Microsoft has disclosed CVE-2026-85893, a high-severity use-after-free vulnerability in Edge that could let an attacker elevate privileges from Low to Medium Integrity Level after a user visits a malicious page and performs two tap gestures. The flaw affects versions prior to 153.0.4234.32 and is rated CVSS 8.8, though exploitation is assessed as unlikely.
Microsoft AI Opens Six-Week Consultation on Humanist Code of Conduct for MAI Models
Microsoft AI released a draft Humanist AI Code of Conduct for MAI models on September 14, 2026, opening six weeks of public feedback. The company says the draft puts people first, keeps models interruptible and auditable, sets Absolute Constraints on weapons, offensive cyber, and mass manipulation, and will be revised later in 2026 to guide 2027 training — current models are not trained on it yet.
Windows 10 1607 DHCP Server Hit by CVSS 8.0 Vulnerability
Microsoft disclosed CVE-2026-69412, an 8.0-rated stack-based buffer overflow in Windows DHCP Server that lets an authenticated attacker execute code over an adjacent network, affecting Windows 10 1607. Patches are available while exploitation remains unlikely with no known attacks reported.
Windows Biometric Service CVE-2026-69298 Allows Local Privilege Elevation
Microsoft disclosed CVE-2026-69298, an integer overflow in Windows Biometric Service that lets an authorized local attacker elevate to SYSTEM privileges with a CVSS score of 7.8. The patch is available now for affected Windows versions including Windows 10 Version 1607.
Windows Storage Spaces Controller Hit by Heap Buffer Overflow CVE-2026-68844
Microsoft has patched CVE-2026-68844, a heap-based buffer overflow in Windows Storage Spaces Controller rated CVSS 7.8 that lets authorized local attackers execute code. The fix ships in the September 2026 Patch Tuesday release covering nearly 1,000 vulnerabilities, with exploitation considered less likely.
Microsoft Patches High-Severity Race Condition in Windows USB Driver
Microsoft has released security updates for CVE-2026-68840, a race condition in the Windows USB Driver that lets an authorized local attacker elevate privileges. The high-severity flaw, scored 7.0, was published September 8, 2026, and requires winning a race condition with no listed workarounds.
Microsoft Windows Media Foundation CVE-2026-62744 Rated High Severity
Microsoft has published details on CVE-2026-62744, a heap-based buffer overflow in Windows Media Foundation that allows unauthorized remote code execution with a CVSS score of 8.8. The flaw requires a user to open a specially crafted media file and is included in the September 2026 security updates.
CISA Adds Actively Exploited Microsoft Entra ID Flaw to KEV Catalog
CISA added the actively exploited CVE-2026-69836 deserialization vulnerability in Microsoft Entra ID to its Known Exploited Vulnerabilities catalog on 2026-08-21 with a federal remediation deadline of 2026-08-24. The CVSS 10.0 flaw, already mitigated server-side by Microsoft, allows unauthenticated remote code execution and requires no customer action.
Microsoft Azure Kubernetes Service CVE-2026-50516 Hits CVSS 9.4
Microsoft disclosed CVE-2026-50516, a critical vulnerability in Azure Kubernetes Service with a CVSS score of 9.4 that allows unauthorized privilege elevation over a network. The flaw, published August 11, 2026, highlights missing authentication for a critical function and affects all listed versions.
Microsoft Office Excel Use-After-Free Flaw Rated CVSS 8.8
Microsoft disclosed CVE-2026-62870, a use-after-free vulnerability in Excel rated CVSS 8.8 that allows remote code execution over a network. The flaw affects multiple supported versions of Microsoft 365 Apps, Excel 2016, Office 2019, and LTSC editions and was published August 3, 2026.
Microsoft Edge CVE-2026-57990 Allows External File Access
Microsoft disclosed CVE-2026-57990, a high-severity vulnerability in Chromium-based Edge that lets unauthorized attackers disclose information by accessing external files or directories over a network. The CVSS 7.4 flaw, published July 26 2026, underscores the need for prompt patching in widely deployed browsers.
Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity
Microsoft disclosed CVE-2026-57989, a high-severity origin validation error in Chromium-based Edge that lets an unauthorized attacker disclose information over a network. The flaw is rated CVSS 7.4 and affects versions before 150.0.4078.99.
Critical CVE-2026-56163 Hits Azure Kubernetes Service
Microsoft disclosed CVE-2026-56163, a critical vulnerability in Azure Kubernetes Service with a CVSS 3.1 score of 10.0 that allows unauthorized network-based privilege elevation. The flaw was received from Microsoft on July 24, 2026 and requires immediate attention from Azure Kubernetes users to prevent high-impact compromise.
CISA Adds Actively Exploited SharePoint Flaw CVE-2026-50522 to KEV
CISA added the actively exploited Microsoft SharePoint deserialization vulnerability CVE-2026-50522 to its Known Exploited Vulnerabilities catalog on 2026-07-22 with a federal due date of 2026-07-25. Agencies and organizations must apply vendor mitigations per BOD 26-04 or discontinue use if patches are unavailable.
Microsoft Halts July 2026 Windows 11 Update Rollout on Select Dell Machines
Microsoft has suspended the July 2026 Windows 11 Patch Tuesday update on certain Dell models after it triggered unexpected shutdowns, sluggish performance, higher heat and fast battery drain. The flaw traces to an Intel driver clashing with a new USB-C Connection Manager interface; exact affected machines remain undisclosed while a fix is prepared.
Microsoft to cut 605 jobs in Redmond
Microsoft has filed notice to permanently lay off 605 workers at its Redmond headquarters effective September 4, 2026. Axios notes 493 Redmond + other WA sites for the 605 total. The cuts are part of a sweeping Xbox gaming division restructure inside a global plan targeting approximately 3,200 roles in FY2027.
Critical RCE Flaw in Windows GDI+ Carries 9.6 CVSS Score
Microsoft disclosed CVE-2026-50380, a critical heap-based buffer overflow in Windows GDI+ that enables remote code execution over a network with a 9.6 CVSS score. The flaw affects numerous Windows 10 and 11 releases and is being patched as part of the July 2026 Patch Tuesday.
Microsoft Secure Boot bypassed for 13 years via unrevoked shims
ESET researchers found that 11 defective Microsoft-signed shims allowed trivial bypasses of UEFI Secure Boot for 13 years until revocation in the June 2026 Patch Tuesday update. The flaw affects Windows and Linux devices alike and enables persistent bootkit installation with minimal attacker effort.
Microsoft tells Windows 10 holdouts they can keep using their PCs until 2027
Microsoft is now emailing Windows 10 users about the consumer Extended Security Updates extension to October 2027 while making no reference to Windows 11. The outreach recognizes ongoing hardware cost barriers and stalled adoption rates that still leave millions on the older platform.
Microsoft to expand Patch Tuesday security releases with AI
Microsoft is expanding the number of fixes delivered in each Patch Tuesday release for Windows 11 by using AI to surface potential security issues earlier. The adjustment comes amid rising AI-assisted vulnerability hunting and exploitation by both attackers and security researchers.
Microsoft patches Nightmare Eclipse's RoguePlanet Defender zero-day
Microsoft has fixed the RoguePlanet zero-day in Defender via an update to the Malware Protection Engine. The patch closes the latest vulnerability publicly disclosed by researcher Nightmare Eclipse, who has sparred with the company over its handling of bug reports all year.
CVE-2026-58525 Reserved by Microsoft, Details Under Embargo
NIST lists CVE-2026-58525 as reserved by Microsoft with details withheld until the embargo ends. The placeholder NVD entry directs to an MSRC link while providing no severity, affected products, or technical description.
Microsoft accelerates Quantum Safe Program to 2029
Microsoft has moved its Quantum Safe Program target to 2029 because cryptographically relevant quantum computers could arrive sooner than previously expected. The update underscores the need for organizations to begin preparing now against harvest-now-decrypt-later attacks and future quantum decryption threats.
Microsoft cuts 4,800 jobs as new financial year starts
Microsoft eliminated approximately 4,800 roles on the first day of its new financial year, with the largest share coming from Xbox and commercial sales. The company cited industry-wide changes driven by AI, while noting that it has redeployed thousands of workers and used a voluntary retirement program to limit forced layoffs.
Microsoft assigns 6,000 workers and $2.5 billion to new AI client deployment subsidiary
Microsoft is committing $2.5 billion and reassigning 6,000 employees to its new Microsoft Frontier Co. subsidiary to help clients deploy artificial intelligence. The announcement follows similar forward deployed engineering initiatives launched this year by Amazon, Anthropic and OpenAI.
CISA Warns of Active Exploitation of SharePoint RCE Flaw
CISA warned Wednesday that attackers are exploiting CVE-2026-45659, a SharePoint RCE flaw patched by Microsoft in May, and added it to its KEV catalog on July 1 with a July 4 deadline for federal agencies. The deserialization vulnerability lets low-privileged authenticated users execute code remotely over the network, and more than 10,000 SharePoint servers remain exposed online.
Cloudflare to block mixed-purpose bots from ad-supported sites by default
Cloudflare will block mixed-use crawlers from ad-supported pages by default beginning September 15, 2026, aiming to protect publisher revenue from unpermitted AI training scrapes while still allowing search indexing. The policy affects bots from Apple, Google, and Microsoft that combine indexing with data harvesting and encourages clearer separation of those activities.
Microsoft pulls forward quantum-safe encryption deadline to 2029
Microsoft is accelerating its quantum-safe security roadmap to transition critical products and services to post-quantum cryptography by 2029. The move reflects advances in quantum computing that have shifted the risk horizon for "harvest now, decrypt later" attacks sooner than previously expected.
CISA Adds BlueHammer to KEV Catalog Over Ransomware Exploitation
CISA confirmed ransomware gangs are exploiting the BlueHammer Microsoft Defender privilege escalation vulnerability, CVE-2026-33825, previously abused in zero-day attacks. The KEV Catalog update highlights continued danger to federal networks and the urgency of patching.
Anthropic Claude Models Now Run on NVIDIA GB300 in Azure
Anthropic’s Claude models in Microsoft Foundry are now generally available on Microsoft Azure running on NVIDIA GB300 Blackwell Ultra GPUs. This gives Azure-native enterprises a new platform for building autonomous and domain-specific AI agents with enhanced performance and governed security.
From the feed · 47
Up to five additional users on Microsoft 365 Family plans will share Copilot and AI features alongside Office apps and OneDrive storage. The change also applies to Premium subscribers.
Indian tech giants are reportedly shrugging off revisions to the US skilled visa program. Microsoft has denied the fraud and abuse allegations that prompted the changes.
US government accused Microsoft of replacing American workers with foreign indentured servants, then awarded Satya Nadella a medal.
Microsoft advises organizations to begin testing certificate ecosystems now ahead of post-quantum authentication. Its PQC TLS Pilot Program is intended to support that preparation.
Microsoft has started testing a redesigned Windows Search built on WinUI 3. "This new Windows Search experience is built for speed," says corporate vice president Anshul Rawat.
Nscale doubled its Bellevue engineering hub lease to 46,000 square feet before the space opens in 2027. The expansion follows a $2B funding round and targets a hiring push led by former Microsoft AI executive Nidhi Chappell.
The US suspended its visa program for tech firms including Microsoft. The move affects hiring at multiple large employers without an announced timeline for resumption.
Microsoft's new magnetic USB-C charger for the Surface Laptop Ultra is drawing company excitement but little reviewer enthusiasm. The design reportedly adds convenience without addressing core charging limitations.
Microsoft replaced laid-off US workers with H-1B hires at a 1.5-to-1 ratio, the Trump administration said in suspending the company from its green card sponsorship program.
Microsoft Graph file APIs will stop returning pre-authenticated tempauth URLs on April 1, 2027. Requests must authenticate with Microsoft Entra ID access tokens instead.
10 AI companies including Amazon, Google, Microsoft and OpenAI agreed to personal data handling changes after ICO scrutiny. The watchdog says further questions remain.
Microsoft Teams will soon support third-party deepfake detection tools along with impersonation protection in meetings. The update targets real-time verification of participants.
2027 is when Call of Duty support arrives on Microsoft's new Arm-based RTX Spark PCs. Hundreds of other games launch compatible at day one.
Microsoft's FORGE Lab is extending its vulnerability research methods from Windows to the Linux kernel. The work yields three lessons on frontier AI exposure.
The Dutch tax office will shift email and calendars to an on-premises setup in 2027, dropping Microsoft 365 in favor of European open source tools.
Satya Nadella and Jensen Huang take the stage at Microsoft's Windows and Surface event. Details are expected on the Surface Laptop Ultra and NVIDIA RTX Spark.
Microsoft has mapped out the full lifecycle stages for Azure virtual machines, from provisioning through retirement and deletion. No dates or transition windows were included.
Microsoft is adding .msix and .msixbundle files to Outlook's blocked attachment list. The move extends the client's existing restrictions on executable formats.
Classic Outlook is showing stale search results for moved messages, with clicks triggering errors while Microsoft develops a fix. Windows Desktop Search remains the workaround.
Two Nikkei employee email accounts were breached, one used to send thousands of phishing emails over the weekend. The Japanese publisher disclosed the incidents involving Microsoft and Google accounts.
tenfold's free Community Edition now includes shared content governance and real-time event auditing for organizations under 150 users. The updates target Microsoft 365 sharing controls and identity activity tracking.
Microsoft confirmed that its September 2026 KB5124010 Windows 11 preview update crashes games and apps using AC-3 Dolby Digital audio decoding.
Up to 2 GB less RAM could be used by Windows 11 26H2 on certain PCs, measurements show. Microsoft has not announced any such reduction.
Microsoft plans to map the ~ key in Windows 11 as a File Explorer shortcut for jumping to common folders. The change targets quicker navigation without menu clicks.
CVE-2026-96940 scores CVSS 8.8 in Microsoft Exchange Server. The authorization flaw permits authenticated attackers to elevate privileges over the network with low complexity, carrying high impact to confidentiality, integrity and availability.
Microsoft released new Windows 11 Insider Preview builds to the Beta and Experimental channels on 2 October 2026.
Microsoft holds a Windows, Surface and AI event on October 7. The NVIDIA RTX Spark-powered Surface Laptop Ultra is the one confirmed topic.
By October 2026, Microsoft will extend Advanced Shader Delivery to all Nvidia RTX cards. The feature, previously limited to AMD and Qualcomm chips, enables near-instant load times.
Over 13 million followers on Microsoft's X account saw it hijacked Thursday in a crypto pump-and-dump scheme promoting a token.
Microsoft's MAI-Transcribe-2-Streaming model ranks number one in accuracy on the Artificial Analysis benchmark for live speech transcription in 60 languages. It launched alongside two new text-to-speech models.
Microsoft says threat actors are outpacing defenders in early AI adoption, using the tools to accelerate vulnerability discovery, malware development, and post-compromise activity. Security teams are struggling to match the pace.
Satya Nadella pitched Copilot as the "OS for work" to enterprise leaders at a private event last week. Microsoft is folding in coding tools, agent features, and the full Office suite for the first time.
Microsoft published its 2026 Digital Defense Report, mapping a security environment that continues to grow more interconnected. The post outlines evolving threat patterns across hybrid and multi-cloud setups.
Government agencies accounted for 27% of observed cyber threat activity in 2026, up from 17% in 2025, making the sector the most targeted according to Microsoft's Digital Defense Report.
Microsoft reportedly detected attackers probing a Zimbra mail server flaw weeks before the bug received a CVE. The activity occurred ahead of any public disclosure.
Microsoft begins removing Exchange Web Services access from tenants today, with no exceptions after April.
Microsoft now enables Windows settings backup and restore by default on all Entra-joined and hybrid-joined devices running Windows 11 26H2. The change applies automatically after the upgrade.
Microsoft began disabling Exchange Web Services by default in Exchange Online today. Apple Mail and Calendar on Mac will lose sync for Microsoft 365 accounts that still rely on the protocol.
Azure maintenance disrupted hybrid clouds, VPNs, and VMware services, with Microsoft still unsure of the root cause.
$42 million in-kind contribution from Microsoft gives the University of Washington's Global Innovation Exchange a permanent, rent-free home on the company's campus, placing students and researchers alongside industry teams.
A 16-year-old researcher exploited a Microsoft bug to gain admin access across databases holding 17.3 trillion rows.
Microsoft executive Charles Lamanna says most business software will run behind AI agents rather than in front of users, eroding apps' pricing power and customer loyalty.
Microsoft tracks exploitation of CVE-2026-73570, an unauthenticated command injection flaw in internet-facing Zimbra mail servers. The analysis covers observed attack paths along with detection and mitigation steps.
Microsoft is testing an Assisted Setup flow in Windows 11 that offers TikTok and Netflix installs outside the Microsoft Store at the end of PC setup. The trial follows the company's March pledge for a more discreet installation process.
Trump asked Meta, OpenAI and Microsoft to set their own AI safety standards during a White House event. The request came as the companies presented their latest models to the president.
ChatGPT Spaces will function as shared hubs for work projects and personal AI agents. The service is also expanding into Slack and Microsoft Teams.
Storm-3068 converted a single compromised identity into broader cloud infrastructure access. The analysis details steps to secure identities, pipelines, and cloud environments.