Microsoft news

Microsoft has updated its Azure Kubernetes Service with new features for AI, bare metal servers, and managing multiple clusters. This helps teams run more demanding applications and simplifies large-scale operations on the cloud.

Microsoft is closing Ninja Theory, the acclaimed studio behind the Hellblade series. The move is part of a larger Xbox restructuring, with several other studios reportedly in talks to spin off from the company.

For the seventh consecutive time, Microsoft has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection. The placement highlights the company's strength in the endpoint security market, particularly with its Microsoft Defender product, amid increasingly coordinated and fast-moving cyber threats.

Google issued an urgent update for a critical Chrome vulnerability that could allow code execution. Meanwhile, attackers are actively exploiting flaws in Microsoft Defender. Other security news includes scrutiny of child safety on major platforms and new spyware detection tools.

Microsoft is accelerating its quantum computing development, reaffirming its controversial claims about achieving a key milestone. Despite skepticism from some experts, the company is pushing ahead with its roadmap, signaling deep commitment to its unique approach for building a fault-tolerant quantum computer.

Microsoft has revealed that two vulnerabilities in its Defender security software are being actively exploited. One is a privilege escalation flaw (CVE-2026-41091) that could allow an attacker to gain SYSTEM-level access, while the other is a denial-of-service flaw. Both are being used in real-world attacks.

Windows 11 is making it harder to use a local account, pushing users to sign in with a Microsoft account. This creates significant headaches for developers and IT teams who rely on local accounts for security and system management.

Microsoft has taken down a cybercrime operation that offered malware-signing-as-a-service. The service abused Microsoft's own Artifact Signing platform to create fraudulent code-signing certificates, which were then sold to ransomware gangs and other malicious actors to help their malware evade detection.

For months, scammers have exploited a loophole to send spam from an internal Microsoft email address. By creating new accounts, they can send phishing links that appear to be legitimate alerts from Microsoft, bypassing standard email filters and potentially tricking employees into clicking on malicious links.

A new report reveals that multiple popular mobile browsers, including Microsoft Edge and Aloha, are collecting and sharing precise user location data with third-party companies. The findings highlight significant privacy risks for both individual users and corporate environments where data security is a primary concern.

Microsoft has released a year's worth of benchmarking data, comparing its Defender email security platform against rivals. The reports use real-world threat data to measure effectiveness, offering transparency for teams evaluating their security tools.

Microsoft is advocating for Coordinated Vulnerability Disclosure, urging researchers to report issues privately. The statement follows a public dispute where a security researcher disclosed multiple zero-day vulnerabilities, leading to a debate on platform governance and responsible disclosure ethics.

Microsoft has identified an active cryptojacking campaign that uses poisoned search results and AI chatbot interactions to lure victims. Attackers abuse legitimate tools like ScreenConnect and Microsoft .NET utilities to install GPU miners, hijacking system resources for mining cryptocurrency without user consent.

Microsoft is warning of a new campaign where attackers use AI chatbot recommendations to lead users to malicious websites. This social engineering tactic distributes cryptojacking malware by exploiting user trust in AI-generated suggestions, extending threats beyond conventional search engine results.

Microsoft has launched its new MAI-1 family of seven AI models. The release includes MAI-Code-1-Flash, a 7-billion parameter model optimized for generating code across more than 50 programming languages, aiming to boost developer productivity with high performance and efficiency.

A security researcher is threatening to publicly release another zero-day exploit for Microsoft Windows, escalating a dispute with the company. The threat puts pressure on Microsoft and creates a potential security risk for all Windows users, pending the company's response or the exploit's public disclosure.

Microsoft has analyzed a new ransomware variant called 'The Gentlemen.' Written in Go, it operates as a ransomware-as-a-service (RaaS) and is notable for its ability to spread itself across networks automatically. This combination of robust encryption and lateral movement significantly increases its threat.

Microsoft has released its largest-ever security update, fixing 206 vulnerabilities. The patch addresses three publicly known zero-day flaws and dozens of critical bugs that could allow remote code execution, requiring immediate attention from IT teams.

A critical vulnerability in the Windows Netlogon protocol is now being actively exploited by attackers, according to Belgium's Centre for Cybersecurity. The flaw allows for remote code execution, giving attackers potential control over affected systems. Microsoft released a patch in August, and immediate patching is crucial.

Microsoft has identified an active supply chain attack on the npm ecosystem. Attackers are publishing malicious packages that mimic internal corporate libraries. Using a technique called dependency confusion, these packages are designed to infiltrate and gather information from developer environments, posing a significant risk to organizations.

Microsoft is updating six Windows apps, most notably adding an optional Copilot watermark for AI-edited images in the Photos app. The feature is off by default, giving users control over labeling AI content.

A Microsoft AI agent found new malware by analyzing its behavior, not its signature. This allowed it to spot a variant that evades normal security tools. The AI also declined to name the threat actor it found.

Microsoft Azure now offers sandboxes to safely run untrusted code from AI agents. The isolated environments start in under a second, scale massively, and cost nothing when idle, making AI experimentation much safer for developers.

Microsoft has open-sourced a new tool for PostgreSQL called pg_durable. It allows developers to run complex workflows directly inside the database, which can simplify system design by removing the need for external orchestration tools.

Microsoft is pushing enterprises to switch from Azure Repos to GitHub. The recommendation comes despite GitHub's recent history of major outages, forcing IT leaders to weigh new features against platform stability.

Microsoft's new AI platform, Microsoft Discovery, is now available on Azure. It helped develop a new quantum chip that is 1,000x more reliable, halving the company's timeline for a scalable quantum computer to just 2029.

Microsoft has identified seven new security vulnerabilities specific to agentic AI systems. This research provides a new framework for developers and security teams to understand and defend against emerging AI-based threats.

After a year of testing, Microsoft's AI Red Team updated its framework for AI agent threats, adding seven new failure modes. This new taxonomy helps developers and security teams better understand and defend against emerging AI vulnerabilities.

Microsoft has released two open-source tools, Rampart and Clarity, to help developers secure AI agents. The tools are designed for safety verification during early development, addressing risks as AI agents gain more operational authority. This is part of Microsoft's push for continuous AI safety engineering.

Microsoft and EY are investing $1 billion over five years to accelerate enterprise AI adoption. The partnership will create integrated teams of EY's Forward Deployed Engineers and Microsoft experts to help clients implement AI projects and build their own capabilities, offering a combined engineering and innovation service.

Microsoft Research has released Data Formulator 0.7, an open-source, AI-powered system for enterprise data analytics. The tool combines data connectivity, AI agent-guided exploration, and visualization in a shared workspace. A new Data Connectors feature simplifies integration with various data sources like databases and BI systems.

Microsoft has withdrawn its proposal for a 244-acre data center campus in Caledonia, Wisconsin, following significant community opposition. The decision highlights growing local resistance to large-scale infrastructure projects, which can impact cloud service expansion plans for major tech companies and their customers.

Microsoft is highlighting the security challenges organizations face when adopting AI. As companies like St. Luke’s and ManpowerGroup move to AI-powered models, establishing a strong security foundation for cloud, data, and identity becomes essential for enabling responsible innovation and managing new risks.

Microsoft has launched MDASH, a new AI-powered security platform for large-scale vulnerability discovery. The system uses more than 100 specialized AI agents that work together to automatically scan, validate, and prove security flaws across complex codebases like Windows and other Microsoft software.

Microsoft has appointed Matthew Ball, a well-known games analyst and investor, as the new chief strategy officer for Xbox. Ball's extensive experience in analyzing market shifts is expected to help guide Xbox's hardware and console strategy as it faces increasing competition in the gaming industry.

AI presents both opportunities and significant risks for growing businesses. Cybercriminals are leveraging AI to launch more effective and targeted attacks. For example, AI-automated phishing has proven to be 4.5 times more effective than traditional methods, creating new challenges for business leaders balancing growth and security.

Microsoft has officially released Azure Linux 4.0, its first server-grade Linux distribution. The new OS is designed for cloud environments and can be run on Azure infrastructure or locally on desktops using the Windows Subsystem for Linux, marking a significant step for the company.

The US cybersecurity agency has updated its Known Exploited Vulnerabilities (KEV) catalog with seven new entries, including flaws in Microsoft Windows, Defender, and Adobe Acrobat. The additions signal that these vulnerabilities are being actively used by attackers, requiring urgent attention from IT and security teams.

Microsoft's Deputy CISO for Gaming, Aaron Zollman, discussed the unique security challenges in the gaming sector. With over 500 million monthly active players on platforms like Xbox and PC, the scale presents distinct security demands compared to traditional enterprise environments, requiring specialized strategies.

Microsoft's May security update for Windows 11 is failing for some users, leaving their systems unprotected. The installation fails and rolls back when the device's boot partition has insufficient free space. The issue occurs during the reboot phase, leaving dozens of security patches uninstalled.

A security researcher has released a proof-of-concept exploit for a new Windows zero-day vulnerability called MiniPlasma. The exploit can grant full SYSTEM privileges on fully patched Windows 11 systems. The flaw is reportedly an unfixed version of a bug Microsoft claimed to have patched in 2020.

A new vulnerability called YellowKey allows attackers with access to a Windows device to bypass Bitlocker encryption and access files. Microsoft is working on a permanent patch for the flaw (CVE-2026-45585) and has released temporary mitigation steps for companies to implement immediately.

Microsoft details an attack where a threat actor used a single compromised identity to breach an entire cloud environment. The attack began with social engineering and escalated through Microsoft Entra ID and M365 to compromise critical Azure services, including databases and virtual machines.

A BeyondTrust report found that while Microsoft's total vulnerability count was stable in 2023, critical flaws doubled. Attackers are shifting focus from initial access to privilege escalation, using identity-based attacks to gain deeper control over systems. This trend highlights the growing importance of internal security controls.

Microsoft has released a mitigation for a BitLocker security bypass vulnerability known as "YellowKey." The zero-day flaw, tracked as CVE-2026-45585, was publicly disclosed last week and carries a CVSS score of 6.8, affecting the Windows disk encryption feature.

A China-aligned hacking group known as Webworm is using new custom backdoors, EchoCreep and GraphWorm. The group leverages popular services like Discord and the Microsoft Graph API for its command-and-control communications, primarily targeting government agencies with this updated tooling, according to recent cybersecurity research.

Microsoft has disrupted a "malware-signing-as-a-service" operation run by a group called Fox Tempest. The service abused Microsoft's own code signing system to make malicious software, including ransomware, appear legitimate, compromising thousands of machines and networks globally.

Microsoft's May Security Update for Windows 11 is failing to install on some devices. The issue is caused by insufficient free space on the EFI System Partition. This leaves affected systems vulnerable, as they do not receive the dozens of security patches included in the update.

Microsoft has detailed a financially motivated group called Fox Tempest that operates a service selling fraudulent code-signing certificates to other criminals. This service helps malware, including ransomware, appear legitimate to bypass security software and infect systems more easily.

Microsoft has officially acknowledged that the May 2026 Windows 11 security update, KB5089549, is failing to install on some devices. Affected users are reporting an error code 0x800f0922, which prevents the update from completing. The company is currently investigating the issue.

Microsoft has taken down a major malware code-signing service that enabled ransomware groups to make their malicious software appear legitimate. The operation involved seizing a website, revoking over 1,000 abused certificates, and shutting down hundreds of virtual machines hosted on Azure.

Microsoft has launched three new Surface devices for business customers: the Surface Pro 12, Surface Laptop 8, and a 13-inch Laptop model. These devices feature Intel's latest Core Ultra Series 3 processors, business-centric upgrades, and notably higher starting prices.

Microsoft has launched new versions of its Surface Pro and Surface Laptop, initially featuring Intel's latest Core Ultra Series 3 processors. This strategy prioritizes Intel chips, with models powered by Qualcomm's Snapdragon X2 processors expected to be released later in the year for business customers.

Microsoft has released two open-source tools, RAMPART and Clarity, to improve the safety of AI agents. As AI systems increasingly perform actions on behalf of users, these tools help developers test for security risks and validate assumptions throughout the development workflow, making agentic AI safer.

Microsoft has released two new open-source tools, RAMPART and Clarity, to help developers improve the security of AI agents. RAMPART is a testing framework designed to identify and measure security risks in AI systems during the development phase, making it easier to build safer applications.

Microsoft is testing a resizable taskbar and Start menu in a new Windows 11 preview build for Insiders. This update, available in the Experimental channel, brings back a popular customization feature from previous Windows versions, allowing users to adjust core UI elements.

A new zero-day vulnerability in Microsoft Exchange, identified as CVE-2026-42897, is being actively exploited. The flaw is a cross-site scripting (XSS) issue that allows attackers to compromise Outlook Web Access (OWA) mailboxes. Microsoft has not yet released a patch to fix the vulnerability.

A Windows vulnerability in the Cloud Filter driver, thought to be patched six years ago, is still exploitable. A security researcher has demonstrated a new method to exploit the flaw, allowing an attacker to gain full SYSTEM-level privileges on an affected machine.

Microsoft is retiring Together Mode, a feature launched during the pandemic that used AI to place meeting participants in a shared virtual space. The move is part of a broader effort to simplify the Teams experience, removing a feature that was sometimes seen as gimmicky.

A spoofing vulnerability in Microsoft Exchange Outlook Web Access (OWA) is being actively exploited. The U.S. CISA is urging organizations to prioritize patching. Microsoft has released a fix and recommends enabling Extended Protection for Exchange Server (EEMS) to mitigate the significant risk.