Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms

This Microsoft Security Blog collection (May 18–22, 2026) highlights multiple high-impact security topics: a multi-stage Linux intrusion that began with an exposed F5 BIG‑IP appliance and pivoted to an internal Confluence server (including Kerberos‑relay attempts, credential theft, and lateral movement) that Microsoft Defender detected and disrupted; supply‑chain compromises of @antv npm packages delivering the ‘Mini Shai‑Hulud’ payload to steal CI/CD secrets from Linux automation environments (targeting GitHub, AWS, Kubernetes, Vault, npm, 1Password); the discovery of Fox Tempest, a malware‑签