microsoft

12 articles · newest first

Software

Microsoft's SharePoint bug had a missing half. Someone just published it — and honeypots are already lighting up

The JWT auth bypass we told you about two weeks ago just got its second half: a working RCE chain, two public PoCs, and active probing as of this week.

Priya Nair · 3d ago · 7 min

Software

Microsoft's own antivirus has a hole in it right now — and even Microsoft can't patch it yet

CVE-2026-69414 lets a local attacker walk straight to SYSTEM through Windows Defender itself, there's still no fix nine days after the CVE was assigned, and CISA just started a clock on it.

Priya Nair · Aug 23 · 6 min

Software

microsoft called this bug 'exploited.' then, a few hours later, it wasn't

A maximum-severity remote code execution bug in the identity system behind every Microsoft 365 login got tagged 'exploited in the wild' on Thursday morning — and un-tagged by evening, right after reporters started asking questions.

Priya Nair · Aug 22 · 6 min

Software

H-1B engineers are leaving Big Tech before the layoffs even find them

Amazon, Microsoft, Meta and Oracle have cut over 100,000 jobs since 2022. For visa holders, a layoff starts a 60-day clock to find new sponsorship or leave the country — and some aren't waiting to find out if they're next.

Priya Nair · Aug 20 · 7 min

Software

a researcher posted SharePoint exploit code on Tuesday. attackers were forging admin access by Thursday

Microsoft patched this JWT flaw back in July. A public proof-of-concept turned it into real attacks in under 48 hours — here's exactly what's broken and how to check if you're exposed.

Priya Nair · Aug 20 · 6 min

Software

hackers showed microsoft exactly how to read every inbox on your exchange server — live, at a hacking contest

CVE-2026-62911 only scores an 8.0, but it came with working exploit code demonstrated at Pwn2Own Berlin — and it doesn't stop at one mailbox.

Priya Nair · Aug 17 · 7 min

Software

microsoft just patched a Windows bug that could worm through every DNS server on earth

CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.

Priya Nair · Aug 16 · 6 min

Software

microsoft threatened to sue a researcher for going public. he just broke their patch — again

Microsoft fixed the RoguePlanet Defender flaw in July. On August 12, the same researcher it threatened with legal action published a working bypass — and there's still no patch.

Priya Nair · Aug 14 · 6 min

Gaming

a new survey just measured how far Xbox has fallen — and the number is brutal

85% of US console gamers regularly play PlayStation. 76% play Nintendo. Xbox trails both at 58% — and its own new CEO just called the division 'unhealthy.'

Diego Santos · Aug 13 · 6 min

Software

an AI spent 24 days hacking SharePoint. it found a way in that needs zero login

Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.

Priya Nair · Aug 13 · 6 min

Software

Microsoft just fixed three perfect-10 bugs in Azure and Teams — five days before Patch Tuesday

Three CVSS 10.0 vulnerabilities in Planetary Computer Pro, Azure SQL Database, and Teams got quietly patched on August 6 — completely outside Microsoft's scheduled August 11 Patch Tuesday.

Priya Nair · Aug 9 · 6 min

Software

Microsoft says its AI beat Anthropic's top security model. read the fine print first

the 96% score is real. the 'we beat Mythos' headline is doing a lot more work than the benchmark actually supports.

Priya Nair · Aug 3 · 7 min