Ok so.
Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).
Vulnerability was reported.
They fixed it - incorrectly. Reported again.
They fixed it this time... and broke the previous fix. So it's vulnerable again.
What a clown show.
Really not surprising given the history of sloppy coding, elementary authentication mistakes, outsourced "support", and anecdotal reports of horrid internal culture over the past few years
[2026] Erosion of Trust @ Azure
https://news.ycombinator.com/item?id=47616242
https://isolveproblems.substack.com/p/how-microsoft-vaporize...
[2026] https://www.microsoft.com/en-us/security/blog/2026/05/18/sto...
[2025] https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft...
[2025] https://www.securityweek.com/all-microsoft-entra-tenants-wer...
[2024] https://www.cloaked.com/post/microsoft-data-breach
[2023] https://www.reuters.com/world/us/chinese-hackers-stole-60000...
[2023] https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...
[2022] https://www.spiceworks.com/it-security/cloud-security/news/m...
[2022] https://techcrunch.com/2022/03/23/microsoft-lapsus-hack-sour...
[2021] https://www.cpomagazine.com/cyber-security/microsoft-power-a...
[2021] https://www.darkreading.com/cloud-security/microsoft-azure-c...
And this is just the Azure / O365 stuff - there's been thousands of Windows client/server and Office software exploits across the same time period
They keep forgetting to put "make no mistakes" in the copilot prompt!