The threat group Storm-2949 conducts targeted attacks on Microsoft 365 and Azure by abusing the Self-Service Password Reset system, gaining access to sensitive data with stolen credentials, and exfiltrating it across various Azure services.

Microsoft confirms that a macOS security update is causing annoying, non-closeable location prompts in Teams, and the company is working on a fix while recommending manual configuration in macOS settings as a workaround.

The FBI warns of a 58 percent increase in losses from cryptocurrency ATM fraud, with over 13,400 complaints and total losses of $388 million reported in 2025, prompting several states to impose bans.

A critical security vulnerability (CVE-2026-45829) in ChromaDB allows attackers to execute malicious AI models and take over servers, with approximately 73 percent of exposed instances at risk; users should switch to the Rust frontend or isolate their servers.

Microsoft disrupted a malware signature service operation that created over a thousand fraudulent certificates and supplied various ransomware gangs, seizing the domain signspace[.]cloud and dismantling the criminal infrastructure while filing a lawsuit.

Discord has enabled end-to-end encryption for all voice and video calls across its platform; the DAVE protocol now protects calls on desktop, mobile, web, and consoles by default without user action required, while text chats remain unencrypted for now.

GitHub confirms a security breach of approximately 3,800 internal repositories after an employee installed a malicious VS Code extension; hacker group TeamPCP demands $50,000 for access to around 4,000 private code repositories and threatens free disclosure.

GitHub confirmed a security breach of approximately 3,800 internal repositories through a malicious VSCode extension, with the hacker group TeamPCP demanding $50,000 for the stolen data; trojanized VSCode extensions are not a new threat.