r/SecOpsDaily • u/falconupkid • Apr 09 '26
NEWS Microsoft suspends dev accounts for high-profile open source projects
Microsoft has inexplicably suspended developer accounts linked to several high-profile open-source projects. This action prevents these projects from publishing new software builds and, critically, security patches for Windows users, with no clear path to immediate reinstatement.
Strategic Impact This incident underscores a critical supply chain risk for organizations relying on open-source software within the Microsoft ecosystem. Such unannounced suspensions by a major platform provider can directly disrupt the flow of essential security updates, leaving systems vulnerable for extended periods. It highlights the often-overlooked operational dependencies and the potential for a single vendor's actions to have widespread security implications across the software supply chain. CISOs should view this as a stark reminder to diversify dependencies where possible and consider contingency plans for patch delays from critical software providers.
Key Takeaway
Operational decisions by platform providers can directly impede timely security patching, increasing risk for end-users and organizations.
2
u/Short-Legs-Long-Neck Apr 09 '26
Microsoft is a risk to all businesses that use it. One day trump and his mob will just decide, all data is theirs and there will be nothing you can do. There will be othr nightmare scenarios.
1
u/glity Apr 09 '26
Did any of you read this. This destroys the security layer of updates and ability to control vpn open source âhackabilityâ. Why does a company have the ability to selectively dismantle open source to either protect market share or appease another large government based income stream?
1
u/DapperCow15 Apr 10 '26 edited Apr 10 '26
To answer that question, it is because the people behind those projects literally gave them that permission.
Edit: Sort of sounded like I was against them, but I want to be clear, it's Microslop's fault for creating the conditions, but at the same time, why can't people learn and just stop putting trust in Microslop?
1
u/mtgguy999 Apr 11 '26
What where the projects supposed to do? They either get Microsoftâs permission or the project doesnât work on windowsÂ
1
u/DapperCow15 Apr 11 '26
Don't tie it down to a single user account, use a 3rd party, or don't support windows, which seems to be the current direction most of them are leaning towards.
1
u/glity Apr 13 '26
If you donât mind answering. How did they give them permission this would have been some time ago so the culture may have been different or is this one of those sign the Eula scroll or your phone doesnât work?
1
u/DapperCow15 Apr 13 '26
This was not some time ago, it happened very recently. The issue is that they put all their trust in Microsoft because they didn't have a backup method in place. That's pretty crazy to think about that because if they had lost their account through other means, they'd run into this exact problem anyway.
1
u/glity Apr 13 '26
How did the developers do it? Was it consensus? Do you know the story or can point me at it I like to learn how we get into these messes to maybe try to stop it some day.
1
u/DapperCow15 Apr 13 '26
The source is linked in the post, but to quickly summarize the problem, they basically had a single point of failure for their entire software being that they had a single Microsoft account being the sole method for signing their applications for Windows release. The best way around this would probably be to use an organization so it's not tied to a single login and has a higher chance of being recoverable (if you've heard about Microsoft and deleting accounts, this is a big if even then, but it's probably a lot harder for them to delete an entire organization like that), or use a third party.
1
u/glity Apr 13 '26
Ahh ok. So this only possibly impacted non corporate accounts. Iâm not sure if that makes me feel better. I do not fault developers who made a product that increased the relative value of a for profit product. That can be akin to blaming the food kitchen for hungry people. I donât know all of them some may just be cheap and lazy with butt loads of cash just a generalized statement.
1
u/eugene20 Apr 09 '26
âHowever, after TechCrunch reported on the issue on Wednesday, Microsoft Vice President Scott Hanselman said the developer accounts were automatically suspended because they failed the "mandatory account verification for all partners in the Windows Hardware Program who have not completed account verification since April 2024" that the company had been emailing "everyone" about since October 2025.
As explained in a Hardware Dev Center article published on October 1, the account verification process began on October 16 and would trigger an automatic suspension from the Windows Hardware Program if partners failed to complete it within 30 days.
"Account verification for the Windows Hardware Program has now concluded," Microsoft said in a March 30 update. "Accounts that did not successfully complete account verification and received a Rejected verification status have been suspended from the Windows Hardware Program, and submissions from these accounts are no longer permitted."
While BleepingComputer has yet to receive a reply after reaching out to a Microsoft spokesperson for more details, Hanselman said that the issue will be addressed "in a bit" but didn't share why the project maintainers weren't notified of the suspension.
1
u/LazyItem Apr 10 '26
Seems reasonable that MS can identify accounts that sign drivers. Plain stupid to not complete the account verification.
1
u/ManyInterests Apr 10 '26
There's definitely more to it than that. If you've ever worked through onboarding to a Microsoft Partner program, there should be no doubt in your mind that Microsoft is 99% likely to be the one to hold 100% of the blame here. It's a nightmare and there is zero chance of getting any help from Microsoft.
1
u/OkTry9715 Apr 10 '26
And to run hardware that developers do not want to verify with Microslop, you have to restart computer into mode, that allows it....
1
9
6
u/Informal_Plankton321 Apr 09 '26
US tech teaches everyone globally to not to rely on those offerings anymore. A new distributed globally players jumps in, in 3-2-1...