Azure DevOps Blog

On October 21, 2026, the Node.js project released fixes for 10 vulnerabilities. These include flaws in DNS resolution and TLS certificate validation, along with a Brotli decompression bug that can corrupt memory and potentially allow code execution when an application processes attacker-controlled data. The fixes shipped in 22.23.4, 24.22.1 and 26.12.1, with different affected branches The post October 2026 Node.js vulnerabilities: Azure DevOps security guidance appeared first on Azure DevOps Blog.

Today we’re releasing the release candidate (RC) of the next Azure DevOps Server release. It brings new features previously available in our hosted version, along with security and quality improvements. You can download Azure DevOps Server RC (26H2) today. A direct upgrade to Azure DevOps Server RC is supported from any version of Team Foundation The post Azure DevOps Server RC (26H2) Is Now Available appeared first on Azure DevOps Blog.

On October 21, 2026, PHP disclosed two critical vulnerabilities that can allow remote code execution. Neither Azure DevOps Services, our cloud-hosted offering, nor Azure DevOps Server, our on-premises product, uses PHP to handle customer requests. PHP runtimes used by pipelines, containers, and deployed applications have their own patching requirements. Deployment scope: cloud and on-premises Azure The post PHP2Shell and Azure DevOps: what to check appeared first on Azure DevOps Blog.

Fixing a vulnerability takes more than knowing where it is. You need a change that follows your coding standards and works with the rest of your code. Copilot Autofix for GitHub Advanced Security for Azure DevOps now runs on an agentic foundation. It also supports dependency vulnerability fixes and code scanning alerts from third-party tools. The post Introducing Agentic Autofix for code and dependencies appeared first on Azure DevOps Blog.

The Azure DevOps Plugin is now available in Microsoft Copilot. It brings Azure DevOps directly into Copilot Cowork, so you can work with your projects, work items, pull requests, test plans, pipelines, and more without switching to Azure DevOps. The plugin also includes built-in skills to help with everyday development tasks. You can quickly see The post Azure DevOps available in Microsoft Copilot Cowork appeared first on Azure DevOps Blog.

We are releasing new patches for our self‑hosted product, Azure DevOps Server. We strongly recommend that all customers stay up to date with the latest, most secure version of Azure DevOps Server. The most recent release, Azure DevOps Server, is available on the download page. The following versions have been patched. For more details on The post October Patches for Azure DevOps Server appeared first on Azure DevOps Blog.

We are excited to announce a new editing experience for Wiki pages. We are replacing the existing editor with a new editor built on Monaco Editor, the same editor technology that powers Visual Studio Code. Monaco brings many of the editing capabilities familiar to Visual Studio Code to Wiki pages, while preserving the functionality of The post New Wiki Editor Experience appeared first on Azure DevOps Blog.

Today, we’re announcing the general availability of GitHub-hosted agents and pay-as-you-go pricing in Azure Pipelines. GitHub-hosted agents give teams access to more compute options for their pipelines, including native Apple silicon and larger Linux and Windows machines. Instead of purchasing parallel-job capacity in advance, you pay only for the pipeline execution time you use, based The post GitHub-hosted agents with Pay-as-you-Go pricing are now generally available in Azure Pipelines appeared first on Azure DevOps Blog.

We announced the public preview of Copilot Code Review for Azure Repos in late August. Since then, we have continued to make improvements, fix bugs, and add new features. We wanted to share an update on some of the recent changes. Effort levels The effort level controls how much time Copilot spends reviewing a pull The post Updates to Copilot Code Reviews for Azure Repos appeared first on Azure DevOps Blog.

We are releasing new patches for our self‑hosted product, Azure DevOps Server. We strongly recommend that all customers stay up to date with the latest, most secure version of Azure DevOps Server. The most recent release, Azure DevOps Server, is available on the download page. The following versions have been patched. For more details on The post September Patches for Azure DevOps Server appeared first on Azure DevOps Blog.