Tag: microsoft
-
Microsoft sued for allegedly tricking millions into Copilot M365 subscriptions
The Australian Competition and Consumer Commission (ACCC) is suing Microsoft for allegedly misleading 2.7 million Australians into paying for the Copilot AI assistant in the Microsoft 365 service. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-sued-for-allegedly-tricking-millions-into-copilot-m365-subscriptions/
-
Critical Microsoft WSUS Security Flaw is Being Actively Exploited
A critical security flaw in Microsoft’s WSUS feature is being actively exploited in the wild by threat actors who could gain access into unpatched servers, remotely control networks, and use them to deliver malware or do other damage. Microsoft is urging organizations to apply a patch to their systems. First seen on securityboulevard.com Jump to…
-
Critical Microsoft WSUS Security Flaw is Being Actively Exploited
A critical security flaw in Microsoft’s WSUS feature is being actively exploited in the wild by threat actors who could gain access into unpatched servers, remotely control networks, and use them to deliver malware or do other damage. Microsoft is urging organizations to apply a patch to their systems. First seen on securityboulevard.com Jump to…
-
9,9 von 10 Punkten: Microsoft schließt gefährlichste Sicherheitslücke aller Zeiten
First seen on t3n.de Jump to article: t3n.de/news/9-9-von-10-punkten-microsoft-sicherheit-1713086/
-
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Active Directory domain join accounts are systematically exposing enterprise environments to compromise, even when administrators follow Microsoft’s official guidance. A comprehensive security analysis reveals that these specialized accounts inherit excessive privileges by default, creating a direct pathway for attackers to escalate access from internal networks to full domain control. During security assessments, domain join accounts…
-
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Active Directory domain join accounts are systematically exposing enterprise environments to compromise, even when administrators follow Microsoft’s official guidance. A comprehensive security analysis reveals that these specialized accounts inherit excessive privileges by default, creating a direct pathway for attackers to escalate access from internal networks to full domain control. During security assessments, domain join accounts…
-
Attackers bypass patch in deprecated Windows Server update tool
Microsoft addressed the critical vulnerability earlier this month, but had to issue an emergency update to resolve issues it previously missed. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-windows-server-update-services-vulnerability-exploited-attacks/
-
Windows will soon prompt for memory scans after BSOD crashes
Microsoft has started testing a new feature that prompts Windows 11 users to run a memory scan when logging in after a blue screen of death (BSOD). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-will-soon-prompt-for-memory-scans-after-bsod-crashes/
-
New policy removes pre-installed Microsoft Store apps
Tags: microsoftMicrosoft now allows IT administrators to remove pre-installed Microsoft Store apps (also known as in-box apps) using a new app management policy. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-now-lets-admins-remove-pre-installed-microsoft-store-apps-via-policy/
-
Windows 11: Microsofts Credential Guard leakt Credentials, kein Fix geplant
In Windows 11 und Windows Server 2025 soll der Credential Guard das Abfließen von Anmeldedaten verhindern. Sicherheitsforscher haben nun gezeigt, dass sich der Credential Guard in Windows austricksen lässt und weiterhin Anmeldedaten preisgeben kann. Angreifer können NTLMv1-Anmeldeinformationen abrufen. Microsoft teilte … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/27/windows-11-microsofts-credential-guard-leakt-credentials-kein-fix-geplant/
-
Critical CoPhish Exploit Uses Copilot Studio to Hijack OAuth Tokens
Security researchers at Datadog have uncovered a sophisticated phishing technique that weaponizes Microsoft Copilot Studio to conduct OAuth token theft attacks. Dubbed >>CoPhish,
-
Sicherheit: AI-Browser und Copilot-Schwachstellen
Der von Perplexity vorgestellte Comet-Browser ist quasi eine perfekte Überwachungslösung und verursacht jede Menge Sicherheitsprobleme, Fall von geht gar nicht. Ähnliches gilt für weitere AI-Browser. Sicherheitsforscher haben einen Meermaid-Angriff auf den Microsoft 365 Copilot demonstriert, und bei Microsoft Teams können … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/27/sicherheitsprobleme-perplexity-comet-browser-copilot-teams-und-mehr/
-
Microsoft Adds WiBased Work Location Auto-Detection to Teams
Microsoft is preparing to introduce a groundbreaking feature in Teams that will revolutionise how hybrid workers manage their presence information. The new capability will automatically identify and update users’ work locations by detecting their connection to organisational Wi-Fi networks, eliminating the need for manual status updates. Scheduled for deployment in December 2025, this opt-in functionality…
-
Microsoft Digital Defense Report 2025 – Deutschland ist das größte Ziel für Cyberangriffe in der EU
First seen on security-insider.de Jump to article: www.security-insider.de/deutschland-digitaler-angriff-microsoft-report-2025-a-f334421a421db80ef7613a3647bd5d5d/
-
Microsoft Digital Defense Report 2025 – Deutschland ist das größte Ziel für Cyberangriffe in der EU
First seen on security-insider.de Jump to article: www.security-insider.de/deutschland-digitaler-angriff-microsoft-report-2025-a-f334421a421db80ef7613a3647bd5d5d/
-
Exchange Online- und Teams-APIs: Änderungen der Standardeinstellungen
Es gibt Änderungen in den Standardeinstellungen der Exchange Online- und Teams-APIs, die die Sicherheit erhöhen sollen. Ab Ende Oktober bis November 2025 verlangt Microsoft die Zustimmung des Administrators für Drittanbieter-Apps, die über die von Microsoft verwaltete Standard-Zustimmungspolitik auf Exchange Online- … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/27/exchange-online-und-teams-apis-aenderungen-der-standardeinstellungen/
-
OpenAI goes after Microsoft 365 Copilot’s lunch with ‘company knowledge’ feature
ChatGPT can now rummage through corporate files via connectors, though Redmond still has the deeper hooks First seen on theregister.com Jump to article: www.theregister.com/2025/10/24/openai_chatgpt_company_knowledge/
-
Security Affairs newsletter Round 547 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed CVE-2025-59287: Microsoft fixes critical WSUS…
-
New CoPhish attack steals OAuth tokens via Copilot Studio agents
A new phishing technique dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cophish-attack-steals-oauth-tokens-via-copilot-studio-agents/
-
CISA Beware! Hackers Are Actively Exploiting Windows Server Update Services RCE Flaw in the Wild
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, flaw, hacker, microsoft, rce, remote-code-execution, service, update, vulnerability, windowsCybersecurity researchers are sounding the alarm after discovering that hackers are actively exploiting a critical remote code execution (RCE) vulnerability in Microsoft’s Windows Server Update Services (WSUS). The flaw, tracked as CVE-2025-59287, allows unauthenticated attackers to run arbitrary code on vulnerable servers, and evidence suggests that these attacks are being carried out manually, a technique…
-
New ‘CoPhish’ technique wraps OAuth phishing in Microsoft Copilot
A new phishing technique dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-cophish-technique-wraps-oauth-phishing-in-microsoft-copilot/
-
CVE-2025-59287: Microsoft fixes critical WSUS flaw under active attack
Microsoft released urgent updates to address the critical WSUS RCE vulnerability CVE-2025-59287, which is under active attack.. Microsoft released an out-of-band fix for CVE-2025-59287, a critical WSUS RCE flaw (CVSS 9.8) that is under active exploitation. Researchers MEOW and Markus Wulftange of CODE WHITE GmbH reported the vulnerability. >>To comprehensively address CVE-2025-59287, Microsoft has released…
-
Windows Server: OutBand Updates für WSUS-Schwachstelle CVE-2025-59287 (23.10.2025)
Es gibt ein Out-of-Band Update KB5070883 für Windows Server 2019, welches Microsoft zum 23. Oktober 2025 bereitgestellt hat. Ziel dieses Notfall-Updates ist es, eine kritische Schwachstelle in WSUS zu schließen. Die Remote Execution-Schwachstelle CVE-2025-59287 wurde mit einem CVSS-Score von 9.8 … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/24/windows-server-2019-out-of-band-update-kb5070883-fuer-wsus-schwachstelle/
-
Top 10 Best Cloud Security Companies For AWS, Azure And GCP in 2025
Organizations are not just adopting cloud; they are embracing multi-cloud and hybrid strategies as the new norm, distributing workloads across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) to optimize for cost, performance, and resilience. While the cloud offers unparalleled agility and innovation, it also introduces a unique set of security challenges.…
-
Hackers exploiting critical vulnerability in Windows Server Update Service
Microsoft has issued an out-of-band update and is urging users to immediately apply the patch. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/hackers-exploiting-critical-vulnerability-windows-server-update-service/803810/
-
Microsoft Issues Emergency Patch for Critical Windows Server Bug
Microsoft initially fixed CVE-2025-59287 in the WSUS update mechanism in the October 2025 Patch Tuesday release, but the company has now issued a second, out-of-band update for the flaw, which is under attack in the wild. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/microsoft-emergency-patch-windows-server-bug
-
Newly Patched Critical Microsoft WSUS Flaw Comes Under Active Exploitation
Microsoft on Thursday released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with a proof-of-concept (Poc) exploit publicly available and has come under active exploitation in the wild.The vulnerability in question is CVE-2025-59287 (CVSS score: 9.8), a remote code execution flaw in WSUS that was originally fixed by the tech…