# PowerShell Published articles for PowerShell. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Announcing Microsoft Desired State Configuration v3.3.0 DevFeed: [Announcing Microsoft Desired State Configuration v3.3.0]() Original publisher: [Read original article]() Author: Jason Helmick Published: 2026-09-17T14:57:07Z Content type: release Language: en Sources: [PowerShell Team]() Topics: [PowerShell DSC](), [PowerShell](), [Windows](), [configuration](), [Model Context Protocol]() Tags: [announcement](), [configuration](), [mcp](), [microsoft](), [powershell](), [powershell-dsc](), [updates](), [v3](), [windows]() ### AI overview This release announcement covers the general availability of Microsoft Desired State Configuration v3.3.0. It describes new built-in Windows resources, a registry-backed adapter, expanded support, experimental export filtering, expression function updates, and Linux packages. ### Source excerpt This post announces the General Availability of Microsoft Desired State Configuration (DSC) v3.3.0, with new Windows resources, a registry adapter, server mode improvements, expression function updates, expanded what-if support, and experimental export filtering. The post Announcing Microsoft Desired State Configuration v3.3.0 appeared first on PowerShell Team. ## Microsoft прекратит поддержку модулей Graph для Windows PowerShell 5.x DevFeed: [Microsoft прекратит поддержку модулей Graph для Windows PowerShell 5.x]() Original publisher: [Read original article]() Author: maybe\_elf Published: 2026-09-17T07:07:54Z Content type: news Language: ru Sources: [Tagir Valeev]() Topics: [PowerShell](), [Microsoft](), [API](), [REST API]() Tags: [api](), [graph](), [microsoft](), [microsoft-365](), [microsoft-graph](), [powershell](), [rest-api](), [tag-13acbb3718a7](), [tag-25f83bc28918](), [tag-82fb255df683](), [tag-c85b5c428c35](), [windows]() ### AI overview Microsoft is ending support for Microsoft Graph PowerShell modules on PowerShell 5.x through a planned 12-month transition. Version 2.x modules will continue to work during that period, but new features will target PowerShell 7.x and version 3.x modules will support only PowerShell 7.x. ### Source excerpt Microsoft объявила о прекращении поддержки модулей Graph для PowerShell 5.x и порекомендовала пользователям перейти на новую версию. В 2025 году компания сообщила о планах по выводу из эксплуатации некоторых компонентов Graph. Читать далее ## HBO Max's verified Reddit account hijacked to spread malware DevFeed: [HBO Max's verified Reddit account hijacked to spread malware]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-15T11:51:03Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Malware](), [ClickFix](), [Reddit](), [Social engineering](), [passwords](), [Cryptocurrency](), [macOS](), [Windows]() Tags: [clickfix](), [cryptocurrency](), [hbo-max](), [macos](), [malware](), [news](), [passwords](), [pasteswitch](), [powershell](), [reddit](), [security](), [social-engineering](), [terminal](), [windows]() ### AI overview Cybercriminals hijacked HBO Max's verified Reddit account and used it to run 108 malicious ads over about 48 hours. The ads promoted fake software and used ClickFix-style instructions to distribute infostealers and cryptocurrency clipboard hijackers to macOS and Windows users. ### Source excerpt Cybercriminals used HBO Max's verified Reddit account to run 108 malicious ads that tricked people into installing information stealers. ## CodeSOD: An Odd Sort DevFeed: [CodeSOD: An Odd Sort]() Original publisher: [Read original article]() Author: Remy Porter Published: 2026-09-15T06:30:00Z Content type: opinion Language: en Sources: [The Daily WTF]() Topics: [Code](), [PowerShell](), [Script](), [Sorting]() Tags: [code](), [codesod](), [csv](), [excel](), [powershell](), [report](), [script](), [sorting]() ### AI overview The article critiques a PowerShell script that queries Active Directory for users and their last logon times. It explains that the script's alphabet-based approach does not correctly sort names, performs unnecessary searches and property loading, and generates a CSV report for Excel despite these inefficiencies. ### Source excerpt Let's say we wanted to query Active Directory and print out a report of all of our users, and their last logon time. That seems like a pretty normal task for a Powershell script. It'd probably be short and easy to read, at least if it were written by a normal person. Alice sends us one that wasn't. She's already done us a favor, as she writes: "Code cleaned up and indented for the whitespace-missing-impaired." ##################################### # lists accounts and selected attributes alphabetically ##################################### foreach( $letter in "a", "b", "c"......"z") { $strfilter = $letter + "*" $objdomain = New-object System.DirectoryServices.DirectoryEntry $objSearcher = New-object System.DirectoryServices.DirectorySearcher $objSearcher.SearchRoot = $objdomain $objSearcher.Filter = $strFilter $objSearcher.PropertiesToLoad.Add("name"); $colResults = $objSearcher.FindAll() foreach($result in $colResults) { $name = $result.Properties.Name $searcher = New-Object DirectoryServices.DirectorySearcher([adsi]"") $searcher.filter "(&(objectCategory=User)(sAMAccountName=$name))" $users = searcher.FindAll() foreach($user in $users) { Write-Output $user.properties.item("name") + "," + $user.properties.item("lastLogon") } } } This accomplishes sorting alphabetically by iterating across the alphabet. Which, I suspect, isn't going to actually get them in alphabetical order; it makes sure that albert and alice appear before bob, but doesn't enforce that albert must come before alice. In any case, we iterate across the alphabet, and then create a searcher that finds a*, then b*, etc. We explicitly tell the searcher that the only property we care about is the name field, so that we don't load unnecessary fields, like the ones we want to report on. We then iterate across the list of names, construct a new searcher, and search for the account with the username we fetched. That lets us get all of the fields we need, including the ones we aren't going to use. Now, we sea ## How AI Is Changing Malware Detection: From Traditional Antivirus to Next-Gen Protection DevFeed: [How AI Is Changing Malware Detection: From Traditional Antivirus to Next-Gen Protection]() Original publisher: [Read original article]() Author: Manish Shivanandhan Published: 2026-09-11T15:22:46Z Content type: article Language: en Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More]() Topics: [Malware](), [Machine learning](), [ransomware](), [cloud-infrastructure](), [PowerShell](), [Microsoft]() Tags: [ai](), [ai-agents](), [attacks](), [cloud](), [machine-learning](), [malware](), [microsoft](), [powershell](), [ransomware](), [security]() ### AI overview An overview of how malware detection is shifting beyond signature-based antivirus toward machine learning, behaviour tracking, and cloud threat data. It also describes how malware evades traditional detection and notes limitations of AI-based approaches. ### Source excerpt Malware used to be simple to describe. A virus attached itself to a file, and antivirus software removed it. That world is gone. Today, a single attack can steal your passwords, lock up your photos, w ## Client-Side SDK Generation with VMware Cloud Foundation OpenAPI Specs DevFeed: [Client-Side SDK Generation with VMware Cloud Foundation OpenAPI Specs]() Original publisher: [Read original article]() Author: vmwareblogs Published: 2026-09-07T09:38:44Z Content type: tutorial Language: en Sources: [VMware Blogs]() Topics: [OpenAPI Specification](), [SDKs](), [.NET](), [C#](), [developer tooling](), [Java](), [Python](), [PowerShell]() Tags: [apis](), [cli](), [cloud](), [cloud-infrastructure](), [csharp](), [developer](), [developer-tooling](), [docker](), [home-page](), [java](), [net](), [openapi](), [powershell](), [programming](), [programming-language](), [python](), [rest](), [rest-api](), [sdk](), [specifications](), [vcf-9-0](), [vcf-9-1](), [vcf-sdk]() ### AI overview This guide explains how to generate a strongly typed .NET C# client SDK from VMware Cloud Foundation and vSphere OpenAPI specifications. It covers OpenAPI Generator, installation options, large specification handling, API-surface scoping, and the REST and JSON-RPC interfaces targeted by the example. ### Source excerpt Starting with VMware Cloud Foundation (VCF) 9.0, VMware officially publishes OpenAPI specifications for VCF APIs. This is a major milestone for developers, enabling you to consume VCF APIs using your programming language of choice. VMware provides first-class developer tooling such as VCF PowerCLI for PowerShell users and the VCF SDK offering Java and Python bindings. ... Continued The post Client-Side SDK Generation with VMware Cloud Foundation OpenAPI Specs appeared first on VMware Blogs. ## Impersonating IT support: how threat actors turn a remote session into enterprise-wide access DevFeed: [Impersonating IT support: how threat actors turn a remote session into enterprise-wide access]() Original publisher: [Read original article]() Author: Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari Published: 2026-09-02T22:51:18Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [High Profile Threats](), [Node.js]() Tags: [c2](), [identity](), [infrastructure](), [javascript](), [microsoft-teams](), [node-js](), [powershell](), [security](), [social-engineering](), [windows]() ### AI overview Microsoft analyzes an intrusion campaign in which attackers impersonate IT support through Microsoft Teams, obtain remote access, deploy a Node.js and JavaScript implant, and move laterally through enterprise systems. The article provides detection, mitigation, and hunting guidance. ### Source excerpt Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity. The post Impersonating IT support: how threat actors turn a remote session into enterprise-wide access appeared first on Microsoft Security Blog. ## Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams DevFeed: [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams]() Original publisher: [Read original article]() Author: Noam Sala Published: 2026-08-31T10:00:36Z Content type: article Language: en Sources: [Unit 42]() Topics: [Social engineering](), [Malware](), [remote access software](), [Microsoft](), [Cloaked Ursa](), [Entra ID](), [Incident response]() Tags: [attacks](), [cloaked-ursa](), [enterprise](), [entra-id](), [incident-response](), [malware](), [microsoft](), [microsoft-teams](), [payload](), [phishing](), [powershell](), [remote-access-trojan](), [social-engineering](), [spoof](), [threat-research](), [vishing](), [voice]() ### AI overview Spring Ring is a coordinated social engineering campaign that used external Microsoft Teams accounts and voice phishing to impersonate IT help desk staff. The operation targeted more than 150 employees across at least 10 companies and attempted to deliver remote monitoring and management tools or custom malware. A more advanced variant escalated to an NTLM relay attack against an organization's domain controller. ### Source excerpt Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42. ## TerminalFix campaign deploys a reverse tunnel through multistage intrusion DevFeed: [TerminalFix campaign deploys a reverse tunnel through multistage intrusion]() Original publisher: [Read original article]() Author: Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan Published: 2026-08-29T03:43:27Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [High Profile Threats]() Tags: [analysis](), [c2](), [clickfix](), [cloudflare](), [microsoft](), [persistence](), [powershell](), [python](), [ransomware](), [security](), [windows]() ### AI overview Microsoft analyzes the TerminalFix ClickFix campaign, which uses a fake Cloudflare CAPTCHA to induce PowerShell execution and deploys a multi-stage intrusion chain. The chain includes DLL sideloading, steganographic payload delivery, Active Directory reconnaissance, persistence, and an encrypted reverse tunnel that can provide access into the compromised network. ### Source excerpt Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance. The post TerminalFix campaign deploys a reverse tunnel through multistage intrusion appeared first on Microsoft Security Blog. ## Start here: Azure SQL Foundations series DevFeed: [Start here: Azure SQL Foundations series]() Original publisher: [Read original article]() Author: Anna Hoffman Published: 2026-08-25T16:00:18Z Content type: article Language: en Sources: [Developer Blogs]() Topics: [Azure SQL](), [Microsoft](), [migration](), [Artificial Intelligence](), [Azure OpenAI](), [DevOps](), [GitHub](), [Retrieval Augmented Generation (RAG)](), [API](), [MCP Server]() Tags: [ai](), [azure](), [azure-openai](), [azure-sql](), [devops](), [github](), [guide](), [how-to](), [json](), [langchain](), [mcp](), [microsoft-for-developers](), [migration](), [powershell](), [rag](), [terraform]() ### AI overview Microsoft introduces the Azure SQL Database Foundations series, a set of four videos covering Hyperscale databases, modernization and migration, AI features, and operational data. Each episode includes a repository for hands-on follow-up. ### Source excerpt Most developers I talk to aren't asking whether Azure SQL Database can handle their next app. They're asking where to start when it comes to modernization, migration, and AI in the database. If you're reading this, you're probably in a similar boat: you've got an existing schema or databases, a scaling question you haven't had [...] The post Start here: Azure SQL Foundations series appeared first on Microsoft for Developers. ## SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System DevFeed: [SpectrePaste: An AI-Assisted, Fileless PowerShell Malware Delivery System]() Original publisher: [Read original article]() Author: Joshua Platt Published: 2026-07-06T18:54:30Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Artificial Intelligence](), [Malware](), [Threat Research](), [PowerShell](), [C2](), [Caching](), [Encryption](), [Resilience](), [Routing (disambiguation)](), [Polymorphism](), [Back end](), [Spec Driven Development]() Tags: [ai](), [artificial-intelligence](), [backend](), [c2](), [cache](), [cybersecurity](), [detection-engineering](), [encryption](), [malware](), [malware-analysis](), [polymorphism](), [powershell](), [resilience](), [routing](), [spec-driven-development](), [threat-intelligence]() ### AI overview The article describes SpectrePaste, a previously undocumented fileless malware delivery system that threat actors used with AI as its primary orchestrator and developer. Its early architecture included automated AMSI-bypass generation, XOR-encrypted payloads, resilient command-and-control traffic handling, caching, request queuing, and administrative priority routing. ### Source excerpt by Joshua Platt and Jason Reaves [TLP:CLEAR] Earlier this year, Google Threat Intelligence[1] reported threat actors are increasingly deploying novel, AI-enabled malware in active operations[2]. While investigating a recent OSINT article[3] on malware campaign activity reported as "DeepLoad", our threat intelligence team identified a separate, previously undocumented fileless delivery system we track as "SpectrePaste". The prior public reporting correctly suspected AI involvement in the "DeepLoad" delivery chain, but our analysis reveals a more conclusive and concerning reality. AI did not just play a supporting role. It acted as the primary orchestrator and developer behind the entire SpectrePaste system. Threat actors internally referred to the early system as "PasteFast Panel." In this initial iteration, the system was highly modular, structured, and designed specifically for resilience against high-volume bot traffic. One of the hallmarks of automated, AI-assisted development. The early architecture functioned as a centralized PowerShell payload delivery system with several notable features: Automated Evasion Generation: The paste builder module automatically prepended Anti-Malware Scan Interface (AMSI) bypass scripts to payloads upon creation, followed by XOR encryption using a custom obfuscator template. This ensured every payload served was dynamically packed. C2 Resilience & High-Load Handling: The most sophisticated feature of the early version was its custom cache manager queue system. The threat actors anticipated massive, simultaneous beaconing from compromised hosts. To prevent database exhaustion, the panel featured an automated threshold toggle. During traffic spikes, the system queued requests, cached the encrypted payloads in memory, and deduplicated IP addresses to ensure a single infected bot could not inadvertently DDoS the command server. Admin Priority Routing: Developer requirements explicitly prioritized operator access. Administrative routes ## Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances DevFeed: [Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances]() Original publisher: [Read original article]() Author: Zoltán Rusnák Published: 2026-06-25T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Security Attacks]() Tags: [apt](), [cloud](), [dns](), [eset-research](), [infrastructure](), [messaging](), [powershell](), [social-media](), [storage]() ### AI overview ESET Research analyzes Gamaredon's 2025 cyberespionage activity against Ukrainian governmental and military institutions, including spearphishing, new malicious PowerShell tools, cloud-based data exfiltration, and concealed C&C infrastructure. ### Source excerpt ESET Research analyzes Gamaredon's new toolset and the group's growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate stolen data ## Introducing AI-assisted query creation in 1Password Device Trust DevFeed: [Introducing AI-assisted query creation in 1Password Device Trust]() Original publisher: [Read original article]() Author: info@1password.com (Evan Sandhu) Published: 2026-06-23T00:00:00Z Content type: release Language: en Sources: [Blog on 1Password Blog]() Topics: [Device Trust](), [Artificial Intelligence](), [SQL](), [Security](), [data](), [Windows](), [Chrome](), [ChatGPT](), [Claude](), [cursor](), [PowerShell](), [1Password in the browser]() Tags: [ai](), [chatgpt](), [chrome](), [claude](), [cursor](), [device-trust](), [encryption](), [macos](), [powershell](), [real-time](), [security](), [software](), [sql](), [windows]() ### AI overview 1Password Device Trust now includes an AI-assisted query builder that converts plain-English investigations into ready-to-run SQL queries across managed devices. Admins can preview and refine generated queries, choose the devices to query, and use the tool to investigate security and compliance issues without needing advanced SQL expertise. ### Source excerpt Today we're shipping a new capability directly into 1Password Device Trust that lets admins query their fleets faster, without needing to be SQL experts. Now you can describe what you want to investigate in plain English, and Device Trust generates a ready-to-run SQL query you can execute across your devices in a single click. What Device Trust does 1Password Device Trust gives IT and security teams visibility and control over every device accessing company resources. It continuously checks devices against your security policies, surfacing issues like outdated software, disabled firewalls, and missing encryption, and blocks access when a device falls out of compliance. Under the hood, it uses both osquery and additional proprietary information that collect real-time data directly from endpoints, giving admins a live, queryable view across their devices. That last part is where this new capability comes in. The pain with writing queries today Osquery is powerful, but writing correct, performant SQL takes specialized SQL and DB schema knowledge that most admins don't have on demand, especially during an active investigation. Even experienced users spend time getting syntax right, scoping predicates correctly, and avoiding patterns that are heavy on resources, or return noisy or slow results at scale. This capability clears that barrier while keeping the admin in control. From question to query in seconds To use this AI-assisted query builder, open it from the Device Trust Tools section, describe what you want to find, and leverage it to find real-time information across your fleet. Some examples of what you can ask: "Check all Windows devices to see if PowerShell is disabled" "Which devices have AI desktop apps like ChatGPT, Claude, or Cursor installed?" "Which macOS devices have FileVault disabled?" "Find devices running Chrome older than a specific version" "Which devices have remote-access tools like AnyDesk or TeamViewer installed?" It also works on queries you've ## Security Week 2624: троян в хентай-играх DevFeed: [Security Week 2624: троян в хентай-играх]() Original publisher: [Read original article]() Author: Kaspersky\_Lab ("Лаборатория Касперского") Published: 2026-06-08T17:00:51Z Content type: news Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [Security](), [FFmpeg (Fast Forward Moving Picture Experts Group)](), [PowerShell](), [Windows](), [GitHub]() Tags: [argamal](), [ffmpeg](), [github](), [ip](), [powershell](), [security](), [tag-9fe8963de219](), [trojan](), [udp](), [windows]() ### AI overview Kaspersky researchers analyzed the Argamal remote-access trojan, distributed with hentai games through file-sharing sites and torrent trackers. Modified ffmpeg.dll files trigger a PowerShell-based infection chain that retrieves an encrypted payload from GitHub and establishes persistence on Windows. The trojan can collect system information, execute commands, manipulate files, capture screenshots, and control the keyboard and mouse. ### Source excerpt Исследователи "Лаборатории Касперского" опубликовали подробный разбор вредоносного ПО Argamal, распространяемого на специализированных ресурсах вместе с хентай-играми. Данная вредоносная кампания была обнаружена в этом году, хотя некоторые связанные с ней DLL-файлы существовали как минимум с 2024 года. Игры с вредоносным довеском, как правило, заливались на публичный файлообменник, ссылки на который публиковались на тематических веб-сайтах. Распространялись они и через торрент-трекеры. Во всех случаях это был архив с полностью функциональной игрой, которая дополнялась модифицированной библиотекой ffmpeg.dll. Читать далее ## PowerShell is now notarized and hardened for macOS DevFeed: [PowerShell is now notarized and hardened for macOS]() Original publisher: [Read original article]() Author: Jason Helmick Published: 2026-05-21T14:40:15Z Content type: release Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [macOS](), [Security](), [PowerShell Release](), [GitHub Issues]() Tags: [apple](), [developer](), [documentation](), [github-issues](), [macos](), [microsoft](), [powershell](), [powershell-macos](), [product](), [release](), [releases](), [security](), [software](), [update]() ### AI overview PowerShell packages for macOS are now notarized and hardened to meet Apple security requirements and Microsoft compliance standards. The update also fixes tarball file permissions and is included in PowerShell 7.4 and later maintenance releases. ### Source excerpt PowerShell for macOS is now properly notarized and hardened, meeting both Apple and Microsoft security requirements. The post PowerShell is now notarized and hardened for macOS appeared first on PowerShell Team. ## PowerShell PSResource Roadmap and Best Practices DevFeed: [PowerShell PSResource Roadmap and Best Practices]() Original publisher: [Read original article]() Author: Sydney Smith Published: 2026-05-20T20:56:10Z Content type: article Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [Package Management](), [Security](), [supply-chain-security](), [Automation](), [configuration](), [NuGet]() Tags: [automation](), [best-practices](), [enterprise](), [infrastructure](), [microsoft](), [nuget](), [package-management](), [powershell](), [security](), [supply-chain]() ### AI overview PowerShell PSResourceGet best practices for secure package management, including repository trust, validation, approval, governance, and enterprise use of Microsoft Artifact Registry and OCI-compliant registries. The article also outlines roadmap investments aimed at secure-by-default package management. ### Source excerpt PowerShell is a critical automation and configuration platform across enterprises--and as that automation grows, how you source, validate, and distribute PowerShell packages becomes just as important as the scripts themselves. Modern security guidance increasingly treats package feeds as part of the software supply chain. For PowerShell, that means being deliberate about which repositories you trust, [...] The post PowerShell PSResource Roadmap and Best Practices appeared first on PowerShell Team. ## FrostyNeighbor: Fresh mischief and digital shenanigans DevFeed: [FrostyNeighbor: Fresh mischief and digital shenanigans]() Original publisher: [Read original article]() Author: Damien Schaeffer Published: 2026-05-14T08:50:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [payload](), [C++](), [JavaScript](), [.NET](), [PowerShell](), [Deployment](), [CSS](), [SVG]() Tags: [c-plus-plus](), [css](), [deployment](), [eset-research](), [javascript](), [malware](), [net](), [payload](), [powershell](), [svg](), [techniques]() ### AI overview ESET researchers document new FrostyNeighbor cyberespionage activity targeting governmental, military, and key-sector organizations in Eastern Europe, especially Ukraine. The group continually evolves its compromise chains and tooling, using server-side victim validation and PicassoLoader variants written in .NET, PowerShell, JavaScript, and C++. ### Source excerpt ESET researchers uncovered new activities attributed to FrostyNeighbor, updating its compromise chain to support the group's continual cyberespionage operations ## Announcing Microsoft Desired State Configuration v3.2.0 DevFeed: [Announcing Microsoft Desired State Configuration v3.2.0]() Original publisher: [Read original article]() Author: Jason Helmick Published: 2026-04-29T18:31:13Z Content type: release Language: en Sources: [PowerShell Team]() Topics: [PowerShell DSC](), [configuration](), [Windows](), [gRPC](), [Firewall](), [ssh]() Tags: [announcement](), [firewall](), [integration](), [microsoft](), [powershell](), [powershell-dsc](), [release](), [ssh](), [windows]() ### AI overview This Microsoft PowerShell Team post announces the general availability of Desired State Configuration (DSC) v3.2.0. The release adds built-in Windows resources, experimental Bicep integration through gRPC, extended WhatIf support, version pinning, expression language improvements, custom functions, and adapter enhancements. ### Source excerpt This post announces the General Availability of Microsoft Desired State Configuration (DSC) v3.2.0, with new Windows resources, Bicep gRPC integration, WhatIf support, expression language improvements, and adapter enhancements. The post Announcing Microsoft Desired State Configuration v3.2.0 appeared first on PowerShell Team. ## Native Windows automation without Docker, WSL, or workarounds DevFeed: [Native Windows automation without Docker, WSL, or workarounds]() Original publisher: [Read original article]() Author: Alex Petric Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Windmill Blog]() Topics: [Windows](), [Automation](), [PowerShell](), [active directory](), [Databases](), [C#](), [servers]() Tags: [active-directory](), [ai](), [automation](), [c-sharp](), [database](), [enterprise](), [powershell](), [servers](), [windows](), [windows-enterprise-powershell-ai]() ### AI overview This article explains how Windmill automates Windows servers as a native Windows service. It covers PowerShell, C#, SQL and MSSQL Kerberos authentication, Active Directory access, mixed Windows/Linux workers, approval workflows, and audit trails without requiring Docker or WSL2. ### Source excerpt How do I automate Windows servers without Docker? Windmill runs natively on Windows as a service with PowerShell, C#, MSSQL Kerberos auth, and Teams integration. ## PowerShell MSI package deprecation and preview updates DevFeed: [PowerShell MSI package deprecation and preview updates]() Original publisher: [Read original article]() Author: Jason Helmick Published: 2026-04-10T14:46:23Z Content type: article Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [PowerShell Release](), [Accessibility](), [Deployment Tools](), [Windows](), [releases](), [enterprise deployment](), [Tooling]() Tags: [accessibility](), [announcements](), [deployment-tools](), [enterprise-deployment](), [net](), [powershell](), [powershell-release](), [releases](), [tooling](), [updates](), [windows]() ### AI overview The PowerShell team announces that MSIX will become the primary Windows installation method starting with PowerShell 7.7-preview.1. MSI packages will continue for existing releases, including PowerShell 7.6, but are not planned for PowerShell 7.7 GA and later releases. The change is driven by MSIX's modern servicing model, reliability, update support, and accessibility goals, while the team works to address gaps involving remoting, system-level services, and enterprise deployment. ### Source excerpt This post announces the deprecation of MSI packaging beginning with PowerShell 7.7. The post PowerShell MSI package deprecation and preview updates appeared first on PowerShell Team. ## PowerShell 7.6 release postmortem and investments DevFeed: [PowerShell 7.6 release postmortem and investments]() Original publisher: [Read original article]() Author: Jason Helmick Published: 2026-04-01T21:01:54Z Content type: article Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [PowerShell Release](), [releases](), [bug](), [Tooling](), [GitHub](), [Microsoft]() Tags: [bug](), [building](), [compliance](), [github](), [microsoft](), [nuget](), [post](), [powershell](), [powershell-release](), [release](), [release-cadence](), [release-schedule](), [releases](), [systems](), [testing](), [tooling](), [validation](), [windows]() ### AI overview This postmortem explains why PowerShell 7.6 shipped in March 2026 instead of earlier as planned. It examines packaging, compliance, validation, release coordination, holiday freezes, and publishing constraints, and outlines changes intended to improve release predictability and transparency. ### Source excerpt This post shares context on the delayed timing of the PowerShell 7.6 release, our learnings, and the changes the team has already begun making to improve release predictability and transparency. The post PowerShell 7.6 release postmortem and investments appeared first on PowerShell Team. ## Announcing PowerShell 7.6 (LTS) GA Release DevFeed: [Announcing PowerShell 7.6 (LTS) GA Release]() Original publisher: [Read original article]() Author: Jason Helmick Published: 2026-03-18T21:47:31Z Content type: release Language: en Sources: [PowerShell Team]() Topics: [releases](), [.NET]() Tags: [automation](), [availability](), [net](), [powershell](), [release]() ### AI overview PowerShell 7.6 is now generally available as a long-term support release built on .NET 10. It focuses on reliability, module updates, command handling, tab completion, dependency alignment, and a small set of breaking changes. ### Source excerpt We're excited to announce the General Availability of PowerShell 7.6, the next Long Term Support (LTS) release of PowerShell. PowerShell 7.6 is built on .NET 10 (LTS), continuing the alignment between PowerShell and the modern .NET platform. PowerShell 7.6 includes reliability improvements across the engine, modules, and interactive shell experience. Preview releases focused on improving [...] The post Announcing PowerShell 7.6 (LTS) GA Release appeared first on PowerShell Team. ## Sednit reloaded: Back in the trenches DevFeed: [Sednit reloaded: Back in the trenches]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-03-10T09:58:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [apt](), [Cloud](), [obfuscation](), [PowerShell](), [Code](), [Network](), [Open Source]() Tags: [apt](), [attacks](), [backdoor](), [cloud](), [code](), [department-of-justice](), [eset-research](), [network](), [obfuscation](), [open-source](), [powershell](), [us]() ### AI overview This article examines the resurgence of Sednit, also known as APT28, and its modern espionage toolkit. It describes the BeardShell and Covenant implants, their use of legitimate cloud providers for command and control and resilience, PowerShell execution, obfuscation, and links to Sednit's earlier tools and operations. ### Source excerpt The resurgence of one of Russia's most notorious APT groups ## PowerShell, OpenSSH, and DSC team investments for 2026 DevFeed: [PowerShell, OpenSSH, and DSC team investments for 2026]() Original publisher: [Read original article]() Author: Steve Lee Published: 2026-02-17T19:21:34Z Content type: article Language: en Sources: [PowerShell Team]() Topics: [PowerShell](), [OpenSSH](), [Security](), [Tooling](), [pull-requests]() Tags: [community](), [openssh](), [post](), [powershell](), [pull-requests](), [security](), [tooling]() ### AI overview The PowerShell, OpenSSH, and DSC teams outline planned investments for 2026, emphasizing security and compliance, critical bug fixes, community pull requests, and upcoming PowerShell improvements. Proposed work includes relocating PSUserContentPath, enabling module features without profile scripts, and improving update notifications. ### Source excerpt Planned team investments for 2026 for PowerShell, OpenSSH, DSC, and related tooling. The post PowerShell, OpenSSH, and DSC team investments for 2026 appeared first on PowerShell Team. [Next page]()