Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms

Microsoft Security Blog (May 18–22, 2026) aggregates multiple high‑risk security findings and product updates: a multi‑stage Linux intrusion originating from an exposed F5 BIG‑IP appliance that pivoted to an internal Confluence server with Kerberos‑relay and lateral‑movement attempts (detected and disrupted by Microsoft Defender); Mini Shai‑Hulud malware delivered via compromised @antv npm packages that steals CI/CD credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password; and the exposure of Fox Tempest, a malware‑signing‑as‑a‑service operation used to distribute signed malicious