Tag: microsoft
-
Microsoft Issues Alert on ASP.NET Flaw Allowing HTTP Request Smuggling Attacks
Microsoft has released a critical security update addressing a severe vulnerability in ASP.NET Core that could enable attackers to execute HTTP request smuggling attacks. On October 14, 2025, the company issued patches for CVE-2025-55315, a security feature bypass flaw affecting the Kestrel web server component with an alarming CVSS score of 9.9, placing it in…
-
Microsoft Edge: Mehrere Löschverläufe erforderlich
Ich kippe mal eine Beobachtung hier in den Blog ein, die mir Thomas B. Mitte Oktober 2025 per E-Mail zukommen ließ. Es geht um das Löschen des Verlaufs im Microsoft Edge-Browser sowie in ChatGPT. Die Anwendungen synchronisieren auch nach dem … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/29/microsoft-edge-mehrere-loeschverlaeufe-erforderlich/
-
Windows 11 KB5067036 update rolls out Administrator Protection feature
Microsoft has released the KB5067036 preview cumulative update for Windows 11 24H2 and 25H2, which begins the rollout of the Administrator Protection cybersecurity feature and an updated Start Menu. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-kb5067036-update-rolls-out-administrator-protection-feature/
-
Warnings Mount Over Windows Server Update Services Hacks
Thousands of Windows Server Update Services Observed Online. Warnings over hackers exploiting a Windows Server Update have compounded since Microsoft rushed out a patch Friday against a flaw allowing unauthenticated attackers to execute arbitrary code. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/warnings-mount-over-windows-server-update-services-hacks-a-29869
-
Copilot now lets you build apps, automate workflows
Tags: microsoftMicrosoft announced today a new Microsoft 365 Copilot agent called App Builder that can help users create and deploy apps “in minutes.” First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-copilot-now-lets-you-build-apps-automate-workflows/
-
Microsoft sued for allegedly tricking millions into Copilot M365 subscriptions
The Australian Competition and Consumer Commission (ACCC) is suing Microsoft for allegedly misleading 2.7 million Australians into paying for the Copilot AI assistant in the Microsoft 365 service. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-sued-for-allegedly-tricking-millions-into-copilot-m365-subscriptions/
-
Critical Microsoft WSUS Security Flaw is Being Actively Exploited
A critical security flaw in Microsoft’s WSUS feature is being actively exploited in the wild by threat actors who could gain access into unpatched servers, remotely control networks, and use them to deliver malware or do other damage. Microsoft is urging organizations to apply a patch to their systems. First seen on securityboulevard.com Jump to…
-
Critical Microsoft WSUS Security Flaw is Being Actively Exploited
A critical security flaw in Microsoft’s WSUS feature is being actively exploited in the wild by threat actors who could gain access into unpatched servers, remotely control networks, and use them to deliver malware or do other damage. Microsoft is urging organizations to apply a patch to their systems. First seen on securityboulevard.com Jump to…
-
9,9 von 10 Punkten: Microsoft schließt gefährlichste Sicherheitslücke aller Zeiten
First seen on t3n.de Jump to article: t3n.de/news/9-9-von-10-punkten-microsoft-sicherheit-1713086/
-
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Active Directory domain join accounts are systematically exposing enterprise environments to compromise, even when administrators follow Microsoft’s official guidance. A comprehensive security analysis reveals that these specialized accounts inherit excessive privileges by default, creating a direct pathway for attackers to escalate access from internal networks to full domain control. During security assessments, domain join accounts…
-
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Active Directory domain join accounts are systematically exposing enterprise environments to compromise, even when administrators follow Microsoft’s official guidance. A comprehensive security analysis reveals that these specialized accounts inherit excessive privileges by default, creating a direct pathway for attackers to escalate access from internal networks to full domain control. During security assessments, domain join accounts…
-
Attackers bypass patch in deprecated Windows Server update tool
Microsoft addressed the critical vulnerability earlier this month, but had to issue an emergency update to resolve issues it previously missed. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-windows-server-update-services-vulnerability-exploited-attacks/
-
Windows will soon prompt for memory scans after BSOD crashes
Microsoft has started testing a new feature that prompts Windows 11 users to run a memory scan when logging in after a blue screen of death (BSOD). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-will-soon-prompt-for-memory-scans-after-bsod-crashes/
-
New policy removes pre-installed Microsoft Store apps
Tags: microsoftMicrosoft now allows IT administrators to remove pre-installed Microsoft Store apps (also known as in-box apps) using a new app management policy. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-now-lets-admins-remove-pre-installed-microsoft-store-apps-via-policy/
-
Windows 11: Microsofts Credential Guard leakt Credentials, kein Fix geplant
In Windows 11 und Windows Server 2025 soll der Credential Guard das Abfließen von Anmeldedaten verhindern. Sicherheitsforscher haben nun gezeigt, dass sich der Credential Guard in Windows austricksen lässt und weiterhin Anmeldedaten preisgeben kann. Angreifer können NTLMv1-Anmeldeinformationen abrufen. Microsoft teilte … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/27/windows-11-microsofts-credential-guard-leakt-credentials-kein-fix-geplant/
-
Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens
Security researchers at Datadog have uncovered a sophisticated phishing technique that weaponizes Microsoft Copilot Studio to conduct OAuth token theft attacks. Dubbed >>CoPhish,
-
Sicherheit: AI-Browser und Copilot-Schwachstellen
Der von Perplexity vorgestellte Comet-Browser ist quasi eine perfekte Überwachungslösung und verursacht jede Menge Sicherheitsprobleme, Fall von geht gar nicht. Ähnliches gilt für weitere AI-Browser. Sicherheitsforscher haben einen Meermaid-Angriff auf den Microsoft 365 Copilot demonstriert, und bei Microsoft Teams können … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/27/sicherheitsprobleme-perplexity-comet-browser-copilot-teams-und-mehr/
-
Microsoft Adds WiBased Work Location Auto-Detection to Teams
Microsoft is preparing to introduce a groundbreaking feature in Teams that will revolutionise how hybrid workers manage their presence information. The new capability will automatically identify and update users’ work locations by detecting their connection to organisational Wi-Fi networks, eliminating the need for manual status updates. Scheduled for deployment in December 2025, this opt-in functionality…
-
Microsoft Digital Defense Report 2025 – Deutschland ist das größte Ziel für Cyberangriffe in der EU
First seen on security-insider.de Jump to article: www.security-insider.de/deutschland-digitaler-angriff-microsoft-report-2025-a-f334421a421db80ef7613a3647bd5d5d/
-
Microsoft Digital Defense Report 2025 – Deutschland ist das größte Ziel für Cyberangriffe in der EU
First seen on security-insider.de Jump to article: www.security-insider.de/deutschland-digitaler-angriff-microsoft-report-2025-a-f334421a421db80ef7613a3647bd5d5d/
-
Exchange Online- und Teams-APIs: Änderungen der Standardeinstellungen
Es gibt Änderungen in den Standardeinstellungen der Exchange Online- und Teams-APIs, die die Sicherheit erhöhen sollen. Ab Ende Oktober bis November 2025 verlangt Microsoft die Zustimmung des Administrators für Drittanbieter-Apps, die über die von Microsoft verwaltete Standard-Zustimmungspolitik auf Exchange Online- … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/27/exchange-online-und-teams-apis-aenderungen-der-standardeinstellungen/
-
OpenAI goes after Microsoft 365 Copilot’s lunch with ‘company knowledge’ feature
ChatGPT can now rummage through corporate files via connectors, though Redmond still has the deeper hooks First seen on theregister.com Jump to article: www.theregister.com/2025/10/24/openai_chatgpt_company_knowledge/
-
Security Affairs newsletter Round 547 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed CVE-2025-59287: Microsoft fixes critical WSUS…
-
New CoPhish attack steals OAuth tokens via Copilot Studio agents
A new phishing technique dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cophish-attack-steals-oauth-tokens-via-copilot-studio-agents/
-
CISA Beware! Hackers Are Actively Exploiting Windows Server Update Services RCE Flaw in the Wild
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, flaw, hacker, microsoft, rce, remote-code-execution, service, update, vulnerability, windowsCybersecurity researchers are sounding the alarm after discovering that hackers are actively exploiting a critical remote code execution (RCE) vulnerability in Microsoft’s Windows Server Update Services (WSUS). The flaw, tracked as CVE-2025-59287, allows unauthenticated attackers to run arbitrary code on vulnerable servers, and evidence suggests that these attacks are being carried out manually, a technique…
-
New ‘CoPhish’ technique wraps OAuth phishing in Microsoft Copilot
A new phishing technique dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cophish-technique-wraps-oauth-phishing-in-microsoft-copilot/
-
CVE-2025-59287: Microsoft fixes critical WSUS flaw under active attack
Microsoft released urgent updates to address the critical WSUS RCE vulnerability CVE-2025-59287, which is under active attack.. Microsoft released an out-of-band fix for CVE-2025-59287, a critical WSUS RCE flaw (CVSS 9.8) that is under active exploitation. Researchers MEOW and Markus Wulftange of CODE WHITE GmbH reported the vulnerability. >>To comprehensively address CVE-2025-59287, Microsoft has released…