Connect with the security community at Microsoft Ignite 2025

In today’s AI-powered world, security professionals are facing unprecedented challenges—and opportunities. As generative AI reshapes the digital landscape, the need for robust, intelligent, and adaptive security strategies has never been more urgent. At Microsoft Ignite 2025, we will showcase...

Dow’s 125-year legacy: Innovating with AI to secure a long future

Founded more than 125 years ago, Dow has demonstrated a commitment to leveraging science to make the world a better place. Today, Dow’s ambition to be the most innovative, inclusive, and sustainable materials science company is supported by a global security team dedicated to keeping employees,...

Microsoft Bounty Program year in review: $17 million in rewards

We’re thrilled to share that this year, the Microsoft Bounty Program has distributed $17 million to 344 security researchers from 59 countries, the highest total bounty awarded in the program’s history. In close collaboration with the Microsoft Security Response Center MSRC, these security...

Hackers Exploit Microsoft SharePoint Flaws in Global Breaches

Hackers are exploiting critical SharePoint flaws CVE-2025-53770/53771 to breach global targets, including governments and corporations. Microsoft urges immediate action. Learn about the active attacks and how to protect your network from credential theft and backdoors...

Disrupting active exploitation of on-premises SharePoint vulnerabilities

July 23, 2025 update – Expanded analysis and threat intelligence from our continued monitoring of exploitation activity by Storm-2603 leading to the deployment of Warlock ransomware. Based on new information, we have updated the Attribution, Indicators of compromise, extended and clarified...

Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers

A critical security vulnerability in Microsoft SharePoint Server has been weaponized as part of an "active, large-scale" exploitation campaign. The zero-day flaw, tracked as CVE-2025-53770 CVSS score: 9.8, has been described as a variant of CVE-2025-49704 CVSS score: 8.8, a code injection and...

Improving IT efficiency with Microsoft Security Copilot in Microsoft Intune and Microsoft Entra

When Microsoft introduced Microsoft Security Copilot last year, our vision was to empower organizations with generative AI that helps security and IT teams simplify operations and respond faster. Since then, we’ve continuously innovated and learned alongside our customers. They consistently tell ...

Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for July 2025, which includes 132 vulnerabilities affecting a range of products, including 14 that Microsoft marked as "critical." In this month's release, Microsoft observed none of the included vulnerabilities being actively exploited in the...

Enhancing Microsoft 365 security by eliminating high-privilege access

In this blog you will hear directly from Microsoft’s Deputy Chief Information Security Officer CISO for Experiences and Devices, Naresh Kannan, about eliminating high-privileged access across all Microsoft 365 applications. This blog is part of an ongoing series where our Deputy CISOs share their...

CVE-2025-48805 Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability

...

Windows BitLocker Security Feature Bypass Vulnerability

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...

PT-2025-28521

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue concerns a heap-based buffer overflow in the Windows Cred SSProvider Protocol. This allows an authorized attacker to elevate privileges locally. There is no information provided...

Rising star: Meet Dylan, MSRC’s youngest security researcher

At just 13 years old, Dylan became the youngest security researcher to collaborate with the Microsoft Security Response Center MSRC. His journey into cybersecurity is inspiring—rooted in curiosity, resilience, and a deep desire to make a difference. Early beginnings: From scratch to security...

Building security that lasts: Microsoft’s journey towards durability at scale ​​

In this blog you will hear directly from Microsoft’s Deputy Chief Information Security Officer CISO for Azure and operating systems, Mark Russinovich, about how Microsoft operationalized security durability at scale. This blog is part of an ongoing series where our Deputy CISOs share their though...

Navigating cyber risks with Microsoft Security Exposure Management eBook

Imagine steering a vessel through Arctic waters where 90% of iceberg mass lies hidden beneath the surface; your lookouts equipped only with telescopes and blind to the submerged threats. This parallels today's cybersecurity landscape: According to the Microsoft Digital Defense Report 2024, nearly...

.NET Core RCE Vulnerability (Jun 2025)

This host is missing an important security update according to Microsoft security update June 2025. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft and Adobe Patch Tuesday, June 2025 Security Update Review

Microsoft's June 2025 Patch Tuesday has landed, addressing a new batch of critical and important vulnerabilities across Windows and enterprise products. Here's a quick breakdown of what you need to know. Microsoft Patch Tuesday for June 2025 In this month's Patch Tuesday, June 2025 edition,...

Windows Shortcut Files Security Feature Bypass Vulnerability

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network...

Windows Media Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Media allows an authorized attacker to elevate privileges locally...

Windows Local Security Authority (LSA) Denial of Service Vulnerability

Improper access control in Microsoft Local Security Authority Server lsasrv allows an unauthorized attacker to deny service over a network...