Attention: You are using an outdated browser, device or you do not have the latest version of JavaScript downloaded and so this website may not work as expected. Please download the latest software or switch device to avoid further issues.
| 23 Apr 2026 | |
| Written by Gabi Gerber | |
| Attacks & Threats |
On March 10, 2026, Microsoft patched CVE-2026-26144, a cross-site scripting (XSS) vulnerability in Excel. XSS in Office isn't anything new, but what makes this XSS different is what happens after the script executes.
The vulnerability chains with Copilot Agent mode. An attacker embeds a malicious payload in an Excel file. After a user opens it, the XSS fires without the user ever clicking anything. However, unlike most XSS attacks, which aim to steal a session cookie or redirect the user to a phishing site, this attack hijacks the Copilot Agent and silently exfiltrates data from the spreadsheet to an attacker-controlled endpoint: no user interaction, no visual prompt to indicate that anything had happened. The AI does the exfiltration for you. More here
AI agents aren't black boxes — they're models interacting with software tools. The risk lies in their overlap. More...
SharePoint access often means access to the keys of the kingdom, something attackers and defenders understand all too we… More...
A security researcher discovered the API keys can still be used for up to 23 minutes after deletion, even though the clo… More...
GitHub confirmed a data breach this week involving the theft of thousands of developer code repositories. One threat act… More...
Microsoft has disclosed a new security vulnerability impacting on-premise versions of Exchange Server that it said has c… More...
AI agents aren't black boxes — they're models interacting with software tools. The risk lies in their overlap. More...
Four talks tracing the path from Principles to Practice in Trustworthy AI. More...
SharePoint access often means access to the keys of the kingdom, something attackers and defenders understand all too we… More...
Join our multi-language webinar on June 11, 2026 to hone your cybersecurity skills, expand your practical knowledge and … More...
A security researcher discovered the API keys can still be used for up to 23 minutes after deletion, even though the clo… More...
