[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhmNPncwIledIT4mINHGYY_m1JxbYmJz2rzPmZYOrBlg":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":103},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4ba83c0c-8517-4bbb-925c-662fa00b219e","Microsoft to block Entra ID script injection attacks starting October","microsoft-to-block-entra-id-script-injection-attacks-starting-october-29c032","Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. [...]","Microsoft will enhance Entra ID sign-in security by enforcing Content Security Policy (CSP) to block external script injection attacks starting mid-October 2026. This change aims to protect users from threats like cross-site scripting (XSS) by only allowing trusted Microsoft-hosted scripts during authentication. Enterprise customers are advised to stop using browser extensions that inject code into sign-in pages and test their sign-in scenarios before the deadline.","Microsoft Entra ID to block external script injection attacks starting October 2026.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-to-block-entra-id-script-injection-attacks-starting-october\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2021\u002F09\u002F15\u002FMicrosoft_passwordless.jpg","2026-09-30T13:37:15+00:00","2026-09-30T14:00:31.322473+00:00",7,[17,20,23,26,28],{"name":18,"type":19},"Entra ID","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Content Security Policy","technology",{"name":27,"type":25},"cross-site scripting",{"name":29,"type":30},"Secure Future Initiative","campaign","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":31,"icon":33,"name":34,"slug":35},null,"Identity & Access","identity-access",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,18],{"controls":52,"vendors":99},[53,73],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[58,66],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":67,"vendor_name":21,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":74,"name":75,"problem":76,"products":77},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[78,84,91],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":79,"product_name":80,"url":82,"description":83},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":74,"product_name":88,"url":89,"description":90},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[100],{"slug":67,"name":21,"logo_path":68,"roles":101},[102],"affected",{"slug":104,"title":105,"body":106,"framework_refs":107,"framework_notes":117},"microsoft-enforces-csp-to-block-entra-id-script-injection-attacks","Microsoft Enforces CSP to Block Entra ID Script Injection Attacks","Microsoft is proactively enforcing Content Security Policy (CSP) on Entra ID sign-in pages to eliminate the risk of cross-site scripting (XSS) attacks, which can allow attackers to steal credentials or hijack authentication sessions. The root issue is that browser extensions and third-party scripts injected into authentication pages create an uncontrolled execution environment, bypassing identity security controls. This matters because authentication pages are high-value targets — a compromised sign-in flow can expose entire enterprise environments. Organizations that have customized sign-in experiences with external scripts or browser extensions must act before mid-October 2026 or risk breaking their own authentication workflows.",[108,109,110,111,112,113,114,115,116],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 AC-3 – Access Enforcement","NIST CSF PR.IP-1 – Baseline Configuration","OWASP Top 10 A03:2021 – Injection (XSS)","GDPR Article 32 – Security of Processing",{}]