#windows
-
CISA: Windows Task Host Vulnerability Now in the Ransomware Playbook
The US agency CISA has confirmed that ransomware groups are exploiting a privilege-escalation vulnerability in the Windows Task Host component. The flaw was patched back in November 2025, but the attacks continue.
-
Microsoft Pulls WMIC from Windows 11 — a Tool Beloved by Hackers
The legendary WMIC command-line utility is vanishing from Windows 11: Microsoft is finishing its removal in versions 24H2 and 25H2, as well as in the latest beta builds. The reason — years of the tool being abused by attackers.
-
Certighost: an ordinary domain user turns the certificate authority into a domain controller
The CVE-2026-54121 vulnerability lets a rank-and-file domain user issue a domain controller certificate and take over the entire domain. Microsoft has shipped a fix, but the real problem lies in accumulated privileges and blind trust in the PKI.
-
Microsoft closes the LegacyHive zero-day in Windows
In its August batch of updates, Microsoft fixed a vulnerability in the Windows User Profile Service that allowed local escalation to administrator privileges. The patch arrived a month after the PoC was published.
-
Microsoft is merging its Copilot apps ahead of a “super app”
Microsoft is bringing the consumer and enterprise versions of its Copilot assistant into a single interface — groundwork for the launch of a “super app” promised before the end of the year.
-
Researcher Publishes New Windows 0-Day Despite Microsoft's Threats to Sue
A specialist going by the handle Nightmare Eclipse has disclosed ShieldBreak, a Windows Defender vulnerability that allows privileges to be escalated to full control of the system. There is no patch yet.
-
Lazarus Exploited a Windows 0-Day to Attack Defense Firms
The North Korean group Lazarus exploited a zero-day vulnerability in AFD.sys for privilege escalation as part of the Operation Dream Job campaign, targeting the defense sector in Europe, India and Latin America.
-
ShieldBreak: PoC Bypasses Patch for Microsoft Defender Vulnerability
A researcher going by the handle Chaotic Eclipse has published a proof-of-concept that, by his account, fully bypasses Microsoft's fix for the RoguePlanet vulnerability and hands an attacker SYSTEM privileges.
-
Microsoft Patches 400 Vulnerabilities in August Update, Three of Them Zero-Days
Microsoft's August Patch Tuesday turned out to be record-breaking in scale: 400 fixed vulnerabilities and three zero-days, one of which has already been used by North Korea's Lazarus hackers.
-
Plug and Pwn: USB Driver Auto-Install Becomes a SYSTEM Takeover on Windows 11
Researchers showed how Windows' built-in Plug and Play mechanism can be coerced into installing signed vendor software for a spoofed USB device and, through a chain of vulnerabilities, into granting SYSTEM privileges — including remotely over RDP.
-
Three Attacks on Passkeys: The Cryptography Held, but the Protection Was Bypassed
Last week researchers demonstrated three separate ways to bypass passkey protection — from recovering private keys to impersonating privileged users — without touching the cryptography itself.
-
The 1998 World Atlas on Windows 11: A Time Machine from the Thrift Store
A developer poured a surprising amount of effort into reviving an educational CD-ROM from the Windows 95 era that his son had found in a thrift store. The result was a compatibility layer with an automated build and a release on GitHub.
-
Trojanized QuickFox Installer Delivered the FDMTP Backdoor
Fortinet researchers have uncovered a years-long supply-chain attack on QuickFox, a VPN service aimed at Chinese nationals abroad: an infected Windows installer deployed the FDMTP backdoor, previously linked to the Mustang Panda group.
-
Three Attacks on Google Password Manager Let Attackers Hijack Passkey Accounts
Unit 42 researchers describe three ways malware running with ordinary user privileges on Windows can log into a victim's passkey-protected accounts — with no fingerprint, no PIN and no on-screen prompt of any kind.
-
Certighost: An Ordinary AD User Can Impersonate a Domain Controller
Researchers have published a working exploit for AD CS that lets an ordinary account obtain a domain controller certificate and, via DCSync, reach the krbtgt secret. Microsoft closed the vulnerability with its July 14 update.
-
LG monitors were quietly installing an app on Windows that advertised McAfee
Some LG monitors were silently installing a program on connected computers through Windows Update that displayed ads for McAfee antivirus. After the story went public, Microsoft said LG would disable the pop-ups.
-
JadeProx: Chinese Group Targets Government Bodies and Hospitals with New TriBack Loader
An open server on Alibaba Cloud exposed an operation that Group-IB tracks as JadeProx: attacks on government, healthcare and educational institutions across Asia and Latin America using a previously unknown Windows loader, TriBack.
-
Windows LegacyHive Vulnerability Gets a Free Unofficial Patch
Free micropatches from ACROS Security have been released for a fresh 0-day in the Windows User Profile Service that allows privilege escalation on fully patched systems. There is still no official fix from Microsoft.
-
New LegacyHive exploit discovered for privilege escalation in Windows
A researcher operating under the alias Nightmare Eclipse has published a zero-day exploit called LegacyHive that grants administrator rights on fully updated Windows systems.
-
Zoom Warns of Critical Vulnerability Allowing Account Takeover
Zoom has disclosed a critical vulnerability in its Windows client and SDK that could be exploited to take over user accounts. The attack requires no authentication on the attacker's part.
- More