Microsoft suspends developer accounts for popular open-source projects

April 10, 20262 min read1 sources
Share:
Microsoft suspends developer accounts for popular open-source projects

Microsoft has suspended the developer accounts for several widely used open-source applications, including Rufus, qBittorrent, and ShareX, effectively blocking them from distributing new software builds and critical security patches to Windows users.

The suspensions, which began in late May 2024, were reportedly executed without clear prior notification. Affected developers stated they received only vague explanations citing policy violations or "malware" without specific, actionable details, leaving them unable to address the supposed issues. The blocks primarily impact accounts on the Microsoft Partner Center and the Microsoft Store, crucial platforms for software distribution and management.

Pete Batard, the developer of the popular bootable USB utility Rufus, was among the first to report the issue. He criticized the company’s opaque appeals process, stating on his blog that "Microsoft's ability to provide a usable appeal process for developers is non-existent." For Rufus, the suspension also impacted the ability to digitally sign software, which can cause security warnings and erode user trust.

The teams behind the qBittorrent client and ShareX screenshot tool also confirmed their Microsoft Store accounts were suspended, halting all application updates delivered through that channel.

The most significant impact of these administrative actions is the immediate security risk posed to end-users. By preventing developers from pushing timely patches, users who rely on the Microsoft Store for updates are left with older, potentially vulnerable software versions. This administrative block creates a window of opportunity for attackers to exploit known flaws that developers are now unable to fix for their Store-based users. The incident has sparked widespread frustration within the open-source community, raising concerns about the reliability and transparency of Microsoft's developer platforms.

Share:

// SOURCES

// RELATED

Adobe patches critical zero-day that was exploited for months

Adobe has patched a critical zero-day (CVE-2024-34097) in Acrobat and Reader that was actively exploited via malicious PDFs for at least four months.

2 min readApr 14

OpenAI rotates security certificates after supply chain attack hits development pipeline

A malicious package impersonating 'axios' was executed in a GitHub Actions workflow, forcing OpenAI to rotate potentially exposed macOS code-signing k

2 min readApr 14

OpenAI issues Mac app update after developer tool hit by supply chain attack

OpenAI released a precautionary update for its macOS app after a developer tool used in its creation pulled a malicious version of a code library.

2 min readApr 14

Docker flaw lets attackers bypass authorization to gain host access

A high-severity flaw in Docker Engine, CVE-2026-34040, allows attackers to bypass security plugins and gain full access to host systems.

2 min readApr 13