Incidents tagged Microsoft

Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. [...]

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical

Three-Person Team Uses Claude to Breach OpenAI's Core Codebase; $6,500 Bounty Triggers AI Security Alarm finance.biggo.com

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network,"

A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"

Millions of AI agents imperiled by critical vulnerability in open source package Ars Technica

One AI and two trained eyes delved into the heavily padded leaks

Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit The Hacker News

A data theft campaign has targeted Fortune 500 companies, specifically exploiting Azure cloud environments for sensitive information exfiltration. This incident underscores critical vulnerabilities in cloud infrastructure and the ongoing risk associated with insecure cloud deployments.

Attackers are actively exploiting critical vulnerabilities, including Adobe ColdFusion (CVE-2026-48282) and Langflow (CVE-2026-55255) for credential harvesting. Microsoft released fixes for a Windows Defender local privilege escalation flaw (CVE-2026-50656), and ClamAV patched seven scanner bugs, underscoring ongoing patch management challenges.

This Copilot vulnerability could expose emails, 2FA codes, and other sensitive data Mashable

A critical zero-click vulnerability, dubbed "EchoLeak" and identified as CVE-2025-32711, was discovered in Microsoft Copilot. This flaw leveraged an "LLM scope violation" to allow remote attackers to exfiltrate sensitive data from Microsoft 365 services without any user interaction.

SearchLeak vulnerability allows data theft from Microsoft 365 Copilot Enterprise SC Media

The vulnerability crisis: How AI is shrinking the window for defense TechRadar

Claude Code RCE: claude-cli:// Deeplink Vulnerability Allows Arbitrary Command Execution (Patch 2.1.118) Pasquale Pillitteri

Researchers scanned over 19,000 open-source MCP server repositories, revealing that AI-generated code is present in at least 20% and is disproportionately linked to exploitable vulnerabilities. Key findings include 4.1% of identified flaws being exploitable, with SQL injection, RCE, and path traversal prevalent, and 42.6% of vulnerable repositories showing signs of AI code generation.

OpenAI confirms security breach but says no user data was affected TechRadar

U.S. CISA adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog Security Affairs

Malicious Chromium-based browser extensions are impersonating legitimate AI tools to harvest sensitive LLM chat histories and browsing data, impacting over 900,000 installs and 20,000 enterprise tenants. These extensions exfiltrate proprietary code, internal workflows, and confidential data to threat actor-controlled infrastructure, leading to widespread information leakage.

The RoguePilot vulnerability in GitHub Codespaces leveraged passive prompt injection within GitHub issues to manipulate Copilot. This enabled attackers to silently execute malicious commands and exfiltrate sensitive data, specifically the `GITHUB_TOKEN`, to external servers.