May 28, 2025—KB5058499 (OS Build 26100.4202) Preview

None None...

May 27, 2025—KB5058502 (OS Builds 22621.5413 and 22631.5413) Preview

None None...

CVE-2024-48140

A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message...

Bypass SharePoint Restricted View to exfiltrate data using Copilot AI and more…

TL;DR Restricted View allows users to read files, but not copy, download or print them Attackers will look for ways to circumvent these controls Traditional workarounds include manual transcription, screenshots, and photos OCR tools can extract text from screenshots Microsoft Copilot can read fil...

Malicious code in service-catalog-copilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89c9b90298ed452d812eb4374f8dc339318c0a084a64157722e7b733416fa131 The OpenSSF Package Analysis project identified 'service-catalog-copilot' @ 100.11.1337 npm as malicious. It is considered malicious because: -...

Product Walkthrough: Securing Microsoft Copilot with Reco

Find out how Reco keeps Microsoft 365 Copilot safe by spotting risky prompts, protecting data, managing user access, and identifying threats - all while keeping productivity high. Microsoft 365 Copilot promises to boost productivity by turning natural language prompts into actions. Employees can...

April 25, 2025—KB5055627(OS Build 26100.3915) Preview

None None...

Zero Day Quest 2025: $1.6 million awarded for vulnerability research

This month, the Microsoft Security Response Center recently welcomed some of the world’s most talented security researchers at Microsoft’s Zero Day Quest, the largest live hacking competition of its kind. The inaugural event challenged the security community to focus on the highest-impact securit...

Zero Day Quest 2025: $1.6 million awarded for vulnerability research

This month, the Microsoft Security Response Center recently welcomed some of the world’s most talented security researchers at Microsoft’s Zero Day Quest, the largest live hacking competition of its kind. The inaugural event challenged the security community to focus on the highest-impact securit...

Analyzing open-source bootloaders: Finding vulnerabilities faster with AI

By leveraging Microsoft Security Copilot to expedite the vulnerability discovery process, Microsoft Threat Intelligence uncovered several vulnerabilities in multiple open-source bootloaders, impacting all operating systems relying on Unified Extensible Firmware Interface UEFI Secure Boot as well ...

March 27, 2025—KB5053656 (OS Build 26100.3624) Preview

None None...

Microsoft unveils Microsoft Security Copilot agents and new protections for AI

In this age of AI, securing AI and using it to boost security are crucial for every organization. At Microsoft, we are dedicated to helping organizations secure their future with our AI-first, end-to-end security platform. One year ago, we launched Microsoft Security Copilot to empower defenders ...

OESA-2025-1293 pcp security update

PCP provides a range of services that may be used to monitor and manage system performance. These services are distributed and scalable to accommodate the most complex system configurations and performance problems. Security Fixes: A vulnerability was found in Performance Co-Pilot PCP. This flaw...

SUSE SLES15 Security Update : pcp (SUSE-SU-2025:0801-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0801-1 advisory. - Version upgrade 6.2.0 bsc1217826, PED8192, CVE-2023-6917. - Performance CoPilot 6 is not starting due to missing pmloggerdaily.timer...

SUSE-SU-2025:0801-1 Security update for pcp

This update for pcp fixes the following issues: - Version upgrade 6.2.0 bsc1217826, PED8192, CVE-2023-6917. - Performance CoPilot 6 is not starting due to missing pmloggerdaily.timer bsc1222815...

Security update for pcp

This update for pcp fixes the following issues: Version upgrade 6.2.0 bsc1217826, PED8192, CVE-2023-6917. Performance CoPilot 6 is not starting due to missing pmloggerdaily.timer bsc1222815. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Exciting updates to the Copilot (AI) Bounty Program: Enhancing security and incentivizing innovation

At Microsoft, we are committed to fostering a secure and innovative environment for our customers and users. As part of this commitment, we are thrilled to announce significant updates to our Copilot AI Bounty Program. These changes are designed to enhance the program's effectiveness, incentivize...

The vulnerability of Microsoft Copilot Studio’s graphical tool for creating and supporting artificial intelligence, related to the lack of protection for website structure, allows attackers to enhance their privileges.

The vulnerability of the graphical tool for creating and supporting artificial intelligence in Microsoft Copilot Studio relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability may allow a malicious actor to enhance their privileges remotely...

CVE-2024-49038

Improper neutralization of input during web page generation 'Cross-site Scripting' in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network...

CVE-2024-49038

CVE-2024-49038 affects Microsoft Copilot Studio. The flaw is improper neutralization of input during web page generation (XSS) that an unauthorized attacker can exploit to elevate privileges over a network. Affected: Copilot Studio (Microsoft). Root cause described as input handling in web page g...