incident response

Microsoft Incident Response disclosed on May 12, 2026, that attackers compromised a third-party IT services provider and used legitimate HPE Operations Manager and HPE Operations Agent infrastructure to run scripts, deploy web shells, harvest Windows credentials, and tunnel into a victim...

On May 7, 2026, a federal jury in Alexandria, Virginia convicted Sohaib Akhter, a former federal contractor, after prosecutors said he and his twin brother Muneeb Akhter deleted roughly 96 U.S. government databases hosted by their employer shortly after being fired on February 18, 2025. The case...

Microsoft disclosed on May 8, 2026, that “Dirty Frag,” a Linux local privilege escalation vulnerability chain involving esp4, esp6, and rxrpc kernel components, is being investigated in limited active attacks that can turn low-privileged local execution into root control. The unpleasant part is...

FIRESTARTER is not just another firewall implant; it is a persistence layer that turns a compromised Cisco edge device into something much harder to clean than a simple rebooted box. CISA and the U.K. NCSC say the malware is being used by advanced threat actors to maintain access on publicly...

CISA’s latest addition to its Known Exploited Vulnerabilities Catalog is a reminder that the agency’s most important cybersecurity list is not about theoretical risk, but about active danger. On March 30, 2026, CISA said it had added CVE-2026-3055, described as a Citrix NetScaler out-of-bounds...

Several thousand Microsoft Outlook users were left scrambling on the morning of July 10, 2025, after a sudden authentication-related service incident blocked mailbox access across Outlook’s web, desktop, and mobile surfaces — an outage Microsoft traced to a recent configuration change and...

Microsoft's Exchange platform has experienced another widespread service disruption, leaving enterprise mailboxes intermittently inaccessible while the company investigates the root cause and works to restore full functionality. Background Microsoft Exchange—both the cloud-hosted Exchange Online...

Microsoft’s cloud backbone stumbled again late last year when a configuration error inside Azure Front Door (AFD) knocked a swath of websites and Microsoft services offline — but by the end of the incident most customer-facing sites had been restored and traffic steadily returned to normal. The...

Microsoft’s new operations-focused post takes the hard step beyond threat models and into the trenches: how to detect, investigate, and respond to prompt abuse in real-world AI deployments by instrumenting telemetry, hardening input handling, and turning product signals into actionable incident...

Anthropic’s Claude AI suffered another wave of high‑impact instability on March 11, 2026, leaving users worldwide facing stalled chats, authentication errors, and intermittent “service unavailable” responses across the web client and mobile apps — an outage that arrived amid a string of...

Microsoft’s security entry for CVE‑2026‑26125 identifies an elevation‑of‑privilege flaw in the Payment Orchestrator Service and places special emphasis on the vendor’s confidence metric — a critical signal for defenders about how much technical detail and exploitability information is actually...

A weekend of unexplained reboots turned out to be exactly what it sounded like: a literal knee-jerk. The anecdote — a 1990s-era telemarketing shop, a cluttered server room, a lanky student who somehow managed to press a server’s reset button with his knee when standing up — reads like a...

Cybercriminals are weaponizing the very convenience that OAuth was designed to provide, turning routine consent prompts in Microsoft Entra ID into stealthy, password‑less conduits straight into corporate inboxes. Background OAuth 2.0 was created to let users grant applications limited access to...

A regression in Moby’s authorization path has resurfaced a long‑standing risk: CVE‑2024‑41110 lets the Docker Engine forward API calls to AuthZ plugins without the request body when a client sets a zero Content‑Length, giving an attacker the chance to bypass authorization checks that rely on the...

CVE-2026-0102 is the kind of browser vulnerability that can sound abstract until you translate Microsoft’s “Defense in Depth” label into operational terms: it usually means the flaw is weakening a security boundary or mitigation rather than granting instant, direct takeover by itself. For...

Several thousand Microsoft Outlook users were left locked out of their mailboxes on July 9–10, 2025 after an authentication-related service incident that disrupted Outlook on the web, mobile apps and desktop clients — an outage Microsoft traced to a recent change and addressed with targeted...

Microsoft’s Security Update Guide lists CVE-2026-21229 as a Remote Code Execution (RCE) class vulnerability affecting Power BI, but the public advisory is terse and the precise attack mechanics and proof-of-concept details remain limited at the time of writing. (msrc.microsoft.com) Background /...

A recently disclosed weakness in the AVEVA PI to CONNECT Agent can leak proxy connection details — including proxied URLs and embedded credentials — via Windows event logs, and operators must treat this as an urgent secrets‑exposure incident: inventory affected hosts, purge or redact exposed...

GitHub’s platform suffered a multi-service disruption on 9–10 February 2026 that left Actions queues stalled, pull‑request pages slow or erroring, notifications delayed by up to an hour, and parts of Copilot operating with policy propagation delays — a messy reminder that even the dominant...

Microsoft Azure is not experiencing a single, platform‑wide blackout on February 9, 2026, but the cloud did suffer a string of high‑impact incidents earlier this week — including a VM/control‑plane failure and a follow‑on Managed Identities overload on February 2–3, and a localized West US...