cyber.hendryadrian.com
Security News · cybersecuritypulse.net

Weekly Security Roundup: Copilot SearchLeak, AI Security Deals and Surveillance Misuse

· Original article ↗

Summary

This weekly roundup covers the patched SearchLeak flaw in Microsoft 365 Copilot, calls to restore access to Anthropic models for defenders, security-sector funding and acquisitions, and alleged police misuse of Flock license plate data.

Key points

  • Varonis reported that SearchLeak could expose Microsoft 365 emails, calendar details, indexed files, and MFA codes through a one-click attack chain. Microsoft patched it as CVE-2026-42824; no exploitation was observed.
  • Security leaders urged the U.S. government to reverse restrictions that led Anthropic to disable Claude Fable 5 and Mythos 5 for customers.
  • Ent launched with $100 million in seed funding for an endpoint workspace security platform focused on risky human and AI-agent actions.
  • Databricks agreed to acquire Panther, bringing detection-as-code and more than 100 integrations to its security operations offering.
  • SailPoint plans to acquire Entro, and 1Password acquired Apono, expanding into non-human identity and AI-agent security.
  • NewCore emerged from stealth with $66 million to secure identities for people, machines, and AI agents.
  • A report described more than a dozen cases of police allegedly using Flock license plate searches to stalk people, including former partners.

Article Details

Event Type
Disclosure and remediation of SearchLeak, a proof-of-concept Microsoft 365 Copilot Enterprise vulnerability chain.
Impact
The flaw could allow a one-click leak of emails, calendar details, indexed files, and MFA codes. Microsoft remediated it as CVE-2026-42824; Varonis reported that it was a proof of concept and had not been observed in exploitation.

CVE

CVE-2026-42824Microsoft · Microsoft 365 Copilotused Bing’s image search endpoint as an SSRF-powered exfil proxy. Microsoft remediated the issue as CVE-2026-42824, and Varonis says it was a proof-of-concept, not observed exploitation.

Vendors

Microsoft🧾 Microsoft walks from Oracle deal: Reported FedRAMP concerns stalled more than $3 billion in cloud capacity.Varonis🕳️ Varonis SearchLeak hits Copilot: One click could leak emails, files, calendar details, and MFA codes.

Products

Bingq parameter as an instruction prompt, raced Microsoft’s HTML sanitizer during streaming, then used Bing’s image search endpoint as an SSRF-powered exfil proxy. Microsoft remediated the issue as CVE-2026-42824,Copilot SearchThe chain abused Copilot Search’s q parameter as an instruction prompt, raced Microsoft’s HTML sanitizer during streaming, then used Bing’s image search endpoint as an SSRF-powered exfil proxy. Microsoft remediated theMicrosoft 365 CopilotVaronis disclosed SearchLeak, a Microsoft 365 Copilot Enterprise flaw chain that could leak emails, calendar details, indexed files, and MFA codes after one click on a trusted Microsoft link.

Related Articles