Microsoft News

In the October 2026 Security Update, Microsoft reports an actively exploited Windows vulnerability that small and midsized organisations should not treat as a routine patch note. CVE-2026-96951 affects Windows Shell, has a CVSS score of 8.8, and can bypass protections around Mark of the Web, according to Microsoft. For administrators, the practical response is clear: … Read more

With the October 2026 Early Security Updates, Microsoft published an Exchange Server vulnerability that small and midsized organisations with on-premises or hybrid Exchange should review without delay. CVE-2026-96940 affects Outlook Web Access (OWA), has a CVSS score of 8.8, is rated “Important”, and is classified by Microsoft as “Exploitation More Likely”. Exchange Online has already … Read more

Microsoft updated its Learn documentation for Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat on 5 October 2026. For SMBs, the important point is practical: DLP can now be planned not only around files and classic data flows, but also around prompts, external web search, and external email. That creates a clear review … Read more

Microsoft updated its Learn documentation for Conditional Access with resource exclusions on 8 October 2026. The change matters for tenants that apply policies to “All resources” and exclude selected resources. Baseline scopes such as openid, profile, or User.Read were previously not enforced automatically in these constellations. Microsoft now describes an improved enforcement model: sign-ins that … Read more

Microsoft is warning in the Security Blog that preparing for post-quantum cryptography does not stop at encrypted data. Certificate-based authentication also has to be tested: certificate chains, trust anchors, PKI services, applications, devices, and hardware security modules can all be affected by new algorithms and larger certificates. For small and midsize companies, this is not … Read more