Microsoft

Big claims by Satya Nadella, big news for the industry, but no benchmarks or hard specifications yet.

Biggest overhaul of Redmond's security in 20 years sees promises of "code analysis [of] 100% of commercial product”, cryptographic keys to be kept in a hardened Azure HSM, more.

Both blunt and more advanced social engineering approaches used for initial access; the group also has sophisticated hands-on-keyboards capabilities and a diverse toolset.

Copilots are everywhere as part of Microsoft's "platform transition" in the new world of AI.

AI, says Microsoft, is "redefining our role in business applications” with partners adding Copilots as a “process transformation layer" on top of existing systems.

Microsoft had "shifted at least $39 billion in U.S. profits to Puerto Rico, where... KPMG, had persuaded the territory’s government to give Microsoft a tax rate of nearly 0%."

A CVSS 9.8, pre-auth RCE that lets an attacker execute arbitrary code without user interaction is wormable on systems where Message Queuing is enabled.

Microsoft itself warns that it is "not possible to audit the generation of SAS tokens"

An attacker could have been forging access tokens to Microsoft services for up to two years, unnoticed