trustworthy computing

Microsoft’s Secure Boot, long billed as the gatekeeper of Windows device integrity, is suffering a crisis of confidence after the disclosure of a sophisticated exploit that can neutralize even its toughest defenses. Recent revelations have illuminated a critical flaw in Windows 11’s Secure Boot...

Microsoft's Secure Boot, a critical security feature introduced with Windows 8, is undergoing significant updates to its certificate infrastructure to maintain system integrity and trustworthiness. This initiative addresses the impending expiration of existing certificates and enhances defenses...

In the ongoing effort to strengthen hardware security, recent developments have revealed a critical vulnerability impacting the TPM-Pluton implementation in AMD Ryzen 9000, 8000, and 7000 series CPUs. This underscores the evolving challenge of securing trusted computing modules as processors...

Microsoft has recently addressed a critical vulnerability in its Secure Boot feature, identified as CVE-2025-3052, which could have allowed attackers to install persistent bootkit malware on most PCs. This flaw, discovered by security researchers at Binarly, involved a legitimate BIOS update...

CVE-2025-3052 is a security vulnerability identified in InsydeH2O firmware, specifically involving an untrusted pointer dereference within Windows Secure Boot. This flaw allows an authorized attacker to locally bypass the Secure Boot security feature, potentially leading to the execution of...

Where growth happens, trust must follow. In the enterprise technology landscape, this idea has become more than advice; it’s a survival strategy. As organizations race to the cloud and digital transformation reshapes every industry, the relationship between security and user experience now forms...

In a significant move to bolster anti-cheat measures, Electronic Arts (EA) has mandated the activation of Secure Boot for players of Battlefield 2042. This requirement, introduced in Update 8.8.0, aims to counteract sophisticated cheating techniques that exploit vulnerabilities during the...

The latest evolution of Windows support for Application Control for Business introduces a significant and controversial overhaul: a new Certificate Authority (CA) handling logic designed to bolster software trust and compliance in modern enterprise environments. Users and administrators who rely...

In the ever-evolving landscape of cybersecurity, the revelation of new vulnerabilities in mainstream software underscores the enduring tension between operational convenience and security rigor. The discovery of CVE-2025-27488—a critical elevation of privilege (EoP) vulnerability rooted in the...

As the boundaries between work, leisure, and travel continue to blur, our reliance on portable computing devices such as laptops has never been greater. With this increased portability comes a heightened concern about privacy: public spaces like trains, airports, coffee shops, and even open-plan...

Microsoft Power Automate Desktop Information Disclosure Vulnerability: A Deep Dive into CVE-2025-29817 In the constantly evolving landscape of cybersecurity, even the most powerful automation tools can become points of vulnerability. Microsoft Power Automate Desktop, a flagship solution for task...

Today we’re publishing the Link Removed. We fielded four questions on various topics during the webcast, with specific bulletin questions focusing primarily on Internet Explorer (MS14-052) and a question about the Windows Update client. We invite you to join us for the next scheduled...

Today, as a part of our regular Update Tuesday process, we released four security bulletins – one rated Critical and three rated Important in severity – to address 42 Common Vulnerabilities & Exposures (CVEs) in Microsoft Windows, Internet Explorer, .NET Framework, and Lync Server. We encourage...

Today, as part of Update Tuesday, we released nine security updates – two rated Critical and seven rated Important – to address 37 Common Vulnerabilities & Exposures (CVEs) in SQL Server, OneNote, SharePoint, .NET, Windows and Internet Explorer (IE). We encourage you to apply all of these...

Today we provide advance notification for the release of four bulletins, two rated Critical and two rated Important in severity. These updates address issues in Microsoft Windows, Office and Internet Explorer. The update provided through MS14-017 fully addresses the Microsoft Word issue first...

Today we published the Link Removed. We answered eight questions in total, with the majority focusing on the updates for Windows (MS14-016) and Internet Explorer (MS14-012). One question that was not answered on air has been included on the Q&A page. Here is the video replay. We invite you to...

Today we provide advance notification for the release of five bulletins for March 2014, two rated Critical and thee rated Important in severity. These updates address issues in Microsoft Windows, Internet Explorer and Silverlight. The update provided in MS14-012 fully addresses the issue first...

Today we’re publishing the Link Removed. We answered 16 questions in total, with the majority of questions focusing on the Dynamics AX bulletin (MS14-004), the update for Microsoft Word (MS14-001) and the re-release of the Windows 7 and Windows Server 2008 R2 updates provided through MS13-081...

Two weeks ago I, along with 7,500 of my closest friends, attended the Black Hat security conference in Las Vegas, NV. I can’t speak for everyone, but I certainly had a great – if not exhausting – time while there. While there were a lot of great talks, a personal highlight for me each year is...

Today we’re publishing the Link Removed. We answered 17 questions in total, with the majority of questions focusing on the Graphics Component bulletin (MS13-096), Security Advisory 2915720 and Security Advisory 2905247. We also wanted to note a new blog on the Microsoft Security Blog site on...