Security updates for October 2026 are now available. Details are here: https://lnkd.in/eGsGbJa As security update packages address more CVEs, prioritization can become more complex. In a new blog, we explore risk cohorts, an approach to grouping CVEs around shared deployment, exposure, and trust-boundary questions to help customers make vulnerability analysis more manageable. Learn more: https://lnkd.in/eH5PwEvp
Microsoft Security Response Center
Computer and Network Security
Protecting customers and Microsoft from current and emerging threats related to security and privacy.
About us
The Microsoft Security Response Center (MSRC) is dedicated to safeguarding customers and Microsoft from security threats. With over two decades of experience, we focus on prevention, rapid defense, and community trust. Together, we’ll continue to protect our users and the broader ecosystem.
- Website
-
https://www.microsoft.com/en-us/msrc
External link for Microsoft Security Response Center
- Industry
- Computer and Network Security
- Company size
- 10,001+ employees
- Specialties
- Cybersecurity, Security response, Incident response, Bug bounty, Security research, and BlueHat
Updates
-
Server-Side Request Forgery (SSRF) remains one of the most impactful vulnerability classes in cloud environments, where network reachability, identity, and trust boundaries intersect. In their latest technical blog, Sonal Shrivastava, Lee Restad, Susan Krkasharian, Emmie Teng, Shruti Tarsolia, and Arjun Gopalakrishna explore how SSRF works, why cloud-hosted environments amplify its impact, how MSRC assesses severity, and practical mitigations for reducing risk at scale. Read more: https://lnkd.in/eAf4rDGD
-
-
For more than three years, Artem Shymshyrian pursued bug bounties without receiving one. Instead of giving up, he made a promise to himself: keep going until he earned his first bounty, even if it was only one dollar. That persistence eventually helped Artem become a 2026 Microsoft Most Valuable Security Researcher (MVR) and qualify for the Microsoft Zero Day Quest live hacking event. In our latest researcher spotlight, Artem shares the setbacks, lessons, and determination that shaped his path into security research: https://lnkd.in/eimc5Y7d
-
-
Every security researcher starts somewhere. In our latest researcher spotlight, Firas Fatnassi shares how curiosity, persistence, and a commitment to learning shaped his journey from finding vulnerabilities as a teenager to becoming a respected voice in the security community. Read his story in the MSRC blog: https://lnkd.in/eA-XPXB9
-
-
We're excited to partner again with Wiz for ZERODAY.CLOUD 2026 at Black Hat Europe! This annual open-source cloud hacking competition brings together researchers from around the world to identify critical vulnerabilities and make the cloud a safer place. 🤝 Put your skills to the test. Register your exploit now: https://www.zeroday.cloud/
Wiz Research is proud to announce ZERODAY.CLOUD 2026!🕵️♀️ Our annual open-source cloud hacking competition! We're partnering again (YES!) at Black Hat Europe with Amazon Web Services (AWS), Microsoft Security Response Center, and Google Cloud Security to make the cloud a safer place. 🤝 This is your official invite to identify vulnerabilities in the critical open-source software that powers the cloud. With a $6,495,000 MILLION prize pool, this will be one of the largest hacking events EVERRR. 💰🏆 We are so excited >> Register your exploit now: https://lnkd.in/gpht-Nkd
-
-
Friday marked the final day of BlueHat Asia, with security professionals from across the community coming together to share research and exchange ideas. The day began with opening remarks from Jeff Moss (Founder, DEF CON & Black Hat), followed by a keynote from Tom Gallagher (VP of Engineering, MSRC), focused on practical security improvements, tactical mitigations, and raising the cost for attackers. From technical sessions to conversations in the Security Villages, Day 2 highlighted the value of collaboration in helping protect customers and strengthen security across the ecosystem. This video features highlights from the keynote by Tom Gallagher, along with perspectives from Cameron Vincent, Senior Security Researcher, MSRC, and Asem Eleraky, Senior Penetration Tester, PayMob.
-
That’s a wrap on BlueHat Asia. Over the past two days, security researchers, defenders, engineers, and security leaders came together to share new research, challenge assumptions, and strengthen the security community. Thank you to everyone who made this event possible, including our attendees, presenters, Microsoft teams, and Microsoft Most Valuable Researchers (MVRs) who traveled from around the world to be part of the conversation. And a special thank you to our Security Villages for creating hands-on opportunities to learn, connect, and explore new skills throughout the event. We’re grateful to this incredible community and can’t wait to see you at the next BlueHat.
-
-
-
-
-
+6
-
-
At BlueHat Asia, Chumy Tsai (蔡聿善) and Katherine Chen shared how they chained multiple SharePoint vulnerabilities into a full pre-authentication remote code execution (RCE) exploit. The research began with a JWT authentication bypass that enabled impersonation of arbitrary SharePoint users, including administrators, by abusing flaws in token validation and identity mapping. The second half of the talk focused on Flow2Shell (CVE-2026-47298), a SharePoint Workflow vulnerability. The researchers showed how workflows are built from XOML and rule files, then walked through four separate workflow validation mechanisms intended to prevent abuse. Through a series of bypasses involving type validation, rule validation, runtime checks, and workflow caching behavior, they were able to evade SharePoint's protections and execute malicious code on a fully patched server. One of the most interesting findings involved SharePoint's workflow cache. A malicious workflow assembly could be loaded into memory before validation errors were surfaced. By triggering the workflow a second time, SharePoint would reuse the cached assembly and skip portions of the validation pipeline, ultimately leading to code execution. Beyond the technical exploit chain, the talk highlighted the value of detailed vulnerability research. The complete proof-of-concept and root cause analysis enabled MSRC to quickly assess severity, identify additional variants, begin remediation, and better protect customers. As the presenters noted, impactful security research is not just about finding a bug, but proving impact, understanding root causes, and helping defenders address entire classes of vulnerabilities.
-
-
What happens when an AI assistant inherits the privileges of the user it's helping? At BlueHat Asia, Johann Rehberger discussed how SQL Copilot in SQL Server Management Studio can become a powerful target when connected to highly privileged accounts. Through his demos, he showed how "read-only" assumptions can break down, how prompt injection techniques can influence AI behavior, and why security boundaries matter just as much as model instructions. The talk offered a deep dive into AI security, database permissions, and the unintended risks that emerge when assistants are granted access to sensitive environments. Johann Rehberger's key message was simple: trust, permissions, and execution context matter.
-
-
How do cross-tenant vulnerabilities happen in complex cloud environments? At BlueHat Asia, Microsoft MVR Haakon Wik Gulbrandsrud walked through his research into Azure Logic Apps and API connections, showing how a single architectural root cause led to multiple cross-tenant security issues. Through a series of real-world examples, he demonstrated how understanding platform internals, not just hunting for bugs, can uncover high-impact vulnerabilities hiding in plain sight. The talk offered a fascinating look at the research process itself: tracing connections, mapping architecture, and asking what could go wrong at every step until the answers lead somewhere unexpected.
-