Microsoft will introduce a new Content Security Policy for Microsoft Entra ID in October 2026. The measure is intended to prevent cross-site scripting. Microsoft advises organizations not to use browser extensions or tools that inject code into the Entra ID sign-in experience. If you follow this recommendation, you don't need to do anything. The experience will remain unchanged. Do you use tools that inject code? Then you will need to switch to alternatives.
Two researchers reported finding serious vulnerabilities, including ones that expose employee information and drive-through orders, in systems run by Restaurant Brands International (RBI), which owns the Tim Hortons, Burger King and Popeyes brands. The vulnerabilities were reported to the vendor and quickly fixed. In addition, RBI said the system targeted by the researchers is still in early development. However, the company still sent a DMCA complaint to the researchers to force them to remove the blog post detailing their findings.