Microsoft Security Research

A security researcher has published a write-up describing how they could have accessed 17 trillion Microsoft records through a vulnerability. The blog post walks through the flaw and how access was theoretically possible. Hacker News readers are discussing the finding, debating the scale of the exposure and how Microsoft handles responsible disclosure.

Security researchers report that four separate spyware groups deployed the same exploit kit targeting Google Chrome and Microsoft Windows, all within a single week. The finding suggests the groups are sharing or purchasing identical hacking tools rather than developing their own, raising fresh concerns about the proliferation of surveillance capabilities. Cybersecurity commentators are highlighting the case as evidence of a growing grey market for exploits used against journalists, dissidents and other targets.

Microsoft researchers have detailed attacks exploiting a Zimbra command injection vulnerability, CVE-2026-73570, in which a single crafted email is enough to run code on the mail server. The documented attacks involve deploying web shells, gaining root access, and stealing cryptographic keys. Security teams running Zimbra are being urged to patch and review their servers for signs of compromise.

Security firm Proofpoint reports that the threat group TA419 impersonated prominent AI-policy figures and used a real-time Microsoft 365 phishing proxy to steal authenticated login sessions. The highly targeted campaign hit fewer than ten specialists. Researchers say it shows how attackers can capture live sessions, though successful compromises and government attribution remain unclear.

A critical vulnerability, CVE-2026-73570 with a CVSS score of 8.9, in Zimbra Collaboration Suite allowed unauthenticated attackers to run operating system commands through its SNMP service. According to Microsoft Security Research, attackers exploited the flaw to deploy web shells and steal mailbox credentials. A patch has been released, and security teams are urged to update affected servers promptly.

Security researchers have published a two-part technical write-up of a Windows vulnerability tracked as ZDI-26-708, described as a cross-context proxy authentication coercion in the Network Connectivity Status Indicator (NCSI). The disclosure is circulating among security professionals sharing the detailed analysis. Details on affected versions and patches remain unclear from the discussion so far.

Microsoft has published an analysis of NeedyMantis, a malware family deployed after attackers have already breached a network, with use in targeted operations against specific victims. The report breaks down how the malware behaves once inside a compromised environment. Security researchers and practitioners are sharing the findings, warning organisations to review the indicators of compromise Microsoft disclosed.

Autonomous System 8075, the network operated by Microsoft, was observed announcing IP address space located in Oslo, Norway. The observation was logged and shared on 25 September 2026 with the cybersecurity community under the tag #shodansafari. This type of sighting is used by security researchers to track how large cloud and technology providers extend their network presence into new regions and data centre locations.