incident response

inforcer announced Threat Detection and Response for Microsoft 365 MSPs on June 9, 2026, following its unveiling at Pax8 Beyond in Salt Lake City, positioning the early-access product as a multi-tenant security layer for detecting, containing, and learning from attacks across Microsoft 365...

Inforcer launched a threat detection and response platform on June 8, 2026, aimed at helping managed service providers detect, investigate, and respond to attacks across Microsoft 365 environments from a multi-tenant security console. The move matters because Microsoft 365 has become both the...

groundcover this week promoted an Azure-native version of its Agent Mode observability product, positioning the feature at Microsoft Build 2026 as an AI-assisted incident investigator that runs inside a customer’s own cloud environment. The pitch is simple: logs, metrics, and traces are no...

ReliaQuest researchers disclosed on June 5, 2026, that a newly tracked threat cluster called OP-512 is targeting Microsoft Internet Information Services servers with a custom three-part web shell framework, and they assess with moderate to high confidence that the espionage activity is linked to...

Cisco warned on May 14, 2026, that CVE-2026-20182 can let an unauthenticated remote attacker bypass authentication and gain administrative privileges on affected Cisco Catalyst SD-WAN Controller and Manager systems, and Cisco later said its PSIRT had become aware of limited exploitation in May...

Microsoft’s Exchange Online incident EX1331830 began on June 2, 2026, disrupted enterprise email delivery across North America, Asia-Pacific, and Europe, and remained unresolved as of June 3 while engineers investigated mail-flow delays and failures in Microsoft 365. The outage is not merely...

Microsoft restored file access in Microsoft Teams and Office for the web on June 1, 2026, after incident MO1329446 prevented some Microsoft 365 users from opening documents in Teams, Excel for the web, PowerPoint for the web, and related browser-based Office experiences. The service came back...

Microsoft Incident Response disclosed on May 12, 2026, that attackers compromised a third-party IT services provider and used legitimate HPE Operations Manager and HPE Operations Agent infrastructure to run scripts, deploy web shells, harvest Windows credentials, and tunnel into a victim...

On May 7, 2026, a federal jury in Alexandria, Virginia convicted Sohaib Akhter, a former federal contractor, after prosecutors said he and his twin brother Muneeb Akhter deleted roughly 96 U.S. government databases hosted by their employer shortly after being fired on February 18, 2025. The case...

Microsoft disclosed on May 8, 2026, that “Dirty Frag,” a Linux local privilege escalation vulnerability chain involving esp4, esp6, and rxrpc kernel components, is being investigated in limited active attacks that can turn low-privileged local execution into root control. The unpleasant part is...

FIRESTARTER is not just another firewall implant; it is a persistence layer that turns a compromised Cisco edge device into something much harder to clean than a simple rebooted box. CISA and the U.K. NCSC say the malware is being used by advanced threat actors to maintain access on publicly...

CISA’s latest addition to its Known Exploited Vulnerabilities Catalog is a reminder that the agency’s most important cybersecurity list is not about theoretical risk, but about active danger. On March 30, 2026, CISA said it had added CVE-2026-3055, described as a Citrix NetScaler out-of-bounds...

Several thousand Microsoft Outlook users were left scrambling on the morning of July 10, 2025, after a sudden authentication-related service incident blocked mailbox access across Outlook’s web, desktop, and mobile surfaces — an outage Microsoft traced to a recent configuration change and...

Microsoft's Exchange platform has experienced another widespread service disruption, leaving enterprise mailboxes intermittently inaccessible while the company investigates the root cause and works to restore full functionality. Background Microsoft Exchange—both the cloud-hosted Exchange Online...

Microsoft’s cloud backbone stumbled again late last year when a configuration error inside Azure Front Door (AFD) knocked a swath of websites and Microsoft services offline — but by the end of the incident most customer-facing sites had been restored and traffic steadily returned to normal. The...

Microsoft’s new operations-focused post takes the hard step beyond threat models and into the trenches: how to detect, investigate, and respond to prompt abuse in real-world AI deployments by instrumenting telemetry, hardening input handling, and turning product signals into actionable incident...

Anthropic’s Claude AI suffered another wave of high‑impact instability on March 11, 2026, leaving users worldwide facing stalled chats, authentication errors, and intermittent “service unavailable” responses across the web client and mobile apps — an outage that arrived amid a string of...

Microsoft’s security entry for CVE‑2026‑26125 identifies an elevation‑of‑privilege flaw in the Payment Orchestrator Service and places special emphasis on the vendor’s confidence metric — a critical signal for defenders about how much technical detail and exploitability information is actually...

A weekend of unexplained reboots turned out to be exactly what it sounded like: a literal knee-jerk. The anecdote — a 1990s-era telemarketing shop, a cluttered server room, a lanky student who somehow managed to press a server’s reset button with his knee when standing up — reads like a...

Cybercriminals are weaponizing the very convenience that OAuth was designed to provide, turning routine consent prompts in Microsoft Entra ID into stealthy, password‑less conduits straight into corporate inboxes. Background OAuth 2.0 was created to let users grant applications limited access to...