#Windows
All CosmicBytez Labs articles tagged #Windows, across news, security advisories, how-to guides, and projects.
- News
Microsoft: October Windows Update May Break Smart App Control
KB5127648 can grey out Smart App Control on Windows 11 24H2+, blocking users from turning it on. No fix yet — only workarounds.
- News
Microsoft Drops an Actively Exploited Zero-Day Among Record High of 1,413 Vulnerabilities
Microsoft patched a record 1,413 flaws in October, including an actively exploited Windows Shell zero-day that bypasses Mark of the Web warnings.
- News
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's largest Patch Tuesday ever fixes 1,414 flaws, 78 critical, including an exploited Windows Shell zero-day and unauthenticated RCEs.
- News
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows loader uses the Tox P2P network for encrypted C2, ClickFix delivery, and shortcut-hijack persistence, Varonis researchers found.
- News
Microsoft: Windows 11 23H2 Reaches End of Support in 30 Days
Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions stop getting security updates after November 10, 2026, Microsoft warns.
- News
WSL Containers Reaches General Availability, Bringing Native Linux Containers to Windows
Microsoft's WSL Containers feature exits preview with a new wslc.exe CLI, a Windows API, and enterprise controls — no Docker Desktop required.
- News
New x47.c Windows Botnet Weaponizes xAI Grok for AI-Powered Persistence and API Draining
Qrator details x47.c, a $950 Windows botnet using xAI Grok for persistence and a novel attack that drains stolen OpenAI/xAI API credits.
- News
Microsoft Fixes Bug That Broke Windows File History Backup Feature
Microsoft fixed the File History backup bug from September 2026 updates via optional KB5124006/KB5124010 for Windows 11; Windows 10 fix still pending.
- News
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
China-linked UTA0565 chained Chrome and Windows zero-days via spoofed websites to deploy the new CLEANGULP backdoor against Asian targets.
- News
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A GitHub PoC called BigDiskBuster fills disk space to block Microsoft Defender updates — no CVE, no patch exists.
- Security
CVE-2026-55567: BleachBit Windows Junction Flaw Enables Privilege Escalation
BleachBit fails to validate parent directories before deletion on Windows, letting a local attacker use junctions to delete arbitrary system files.
- News
Microsoft: September 2026 Updates Break Windows File History Backup
September's cumulative updates broke File History across Windows 10 and 11, with backups failing silently and no fix yet available.
- Security
CVE-2026-57223: Suricata Unquoted Service Path on Windows
Suricata's Windows service installer can pass an unquoted ImagePath, allowing local privilege escalation to SYSTEM. Fixed in 7.0.17 and 8.0.6.
- News
Microsoft Shares Workaround for Windows Domain Login Issues
Microsoft confirms KB5124008 breaks AD domain login on some Windows 11 PCs and shares a registry workaround while a permanent fix is prepared.
- News
China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE
UTA0560 chained 3 Chrome and Windows zero-days in a phishing campaign against NGOs, deploying the GRIMWEDGE backdoor via a hijacked university site.
- News
Hackers Hijack HBO Max Reddit Account to Push ClickFix Malware Ads
Attackers took over HBO Max's verified Reddit account, running 108 malicious ads over 48 hours that used ClickFix lures to infect Windows...
- News
Microsoft: September Updates Break Audio on Some Windows PCs
KB5124008 and KB5124012 can break USB Audio Class 1.0 devices on Windows 11 24H2+, with no official fix yet — only a channel-mode workaround.
- News
Hackers Exploit Tencent Sogou Input Method Flaw to Deploy GrayRabbit
A China-aligned group chains a Sogou Input Method URI flaw with an outdated Chromium engine for one-click RCE, deploying the GrayRabbit backdoor.
- News
Microsoft Fixes Teams and Outlook Launch Failures on ARM Windows PCs
A bug tied to August's security updates broke Teams and new Outlook on ARM devices like Surface Pro 11; September's Patch Tuesday fixes it.
- News
New 'BlueMoon' Exploit Kit Chains Chrome and Windows Zero-Days for Espionage
At least four espionage-linked threat clusters adopted the BlueMoon exploit kit within days, chaining Chrome and Windows zero-days for backdoor access.
- News
Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days
September's Patch Tuesday breaks records with 974 CVEs fixed, including two actively exploited Windows zero-days now on CISA's KEV catalog.
- Security
CVE-2026-81963: Windows Link Following Flaw Lets Local Attackers Reach SYSTEM
CISA added an actively exploited Windows Update Stack privilege escalation flaw to its KEV catalog, giving federal agencies until Sep 22 to patch.
- News
New CrowdStrike 'FalconFlank' Zero-Day Grants SYSTEM Privileges
A researcher released a Falcon Sensor zero-day that abuses macro remediation to spawn SYSTEM shells on fully patched Windows 11 and Server 2025.
- News
FalconFlank PoC Claims Zero-Day Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse published FalconFlank, a public PoC abusing Falcon Sensor's macro remediation to claim SYSTEM-level access.
- News
Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels
A new ClickFix variant tricks victims into running PowerShell in Windows Terminal, sideloading a DLL that opens a persistent reverse-tunnel backdoor.
- News
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
- News
Next.js Patches Two Critical RCE Flaws — AVIF and Windows Path Traversal
Vercel patched two critical Next.js RCEs: a libheif AVIF heap overflow (CVSS 9.5) and a Windows-only path traversal flaw (CVSS 9.0).
- News
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Two new malware loaders — WordlistLoader and SynkLoader — deliver ransomware-enabling payloads and steal Windows credentials via phishing.
- News
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
UAT-10147 uses agentic AI to automate attacks on 170,000 web servers, deploying SPECTRE with BYOVD EDR bypass and an AI-assisted Linux kernel rootkit.
- News
WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials
Two new malware loaders target ransomware access brokering: WordlistLoader drops Amatera Stealer via ClickFix, SynkLoader harvests Windows credentials.
- News
Microsoft Rolls Out Classic Outlook Theme for New Outlook Users
Microsoft is rolling out a Classic Outlook theme for Outlook on the web and New Outlook for Windows, giving users familiar visual styling from legacy Outlook.
- News
Microsoft Blames August 2026 Windows Gaming Crashes on RGB Lighting Devices
Microsoft says August 2026 Patch Tuesday updates are causing games to crash or fail to launch due to conflicts with RGB lighting peripheral software.
- News
Named Pipes Under Attack: Securing Windows Interprocess Communication
Weak access controls on Windows named pipes let untrusted processes reach privileged services. Here's how endpoint verification and strict ACLs help.
- Security
Microsoft IKE Service Extensions Double Free RCE (CVE-2026-33824)
CISA-flagged double free vulnerability in Microsoft IKE Service Extensions enables unauthenticated remote code execution. Patch immediately.
- HOWTO
Writing and Deploying YARA Rules for Malware Detection
Learn to write effective YARA rules to identify malware, hunt threats, and scan endpoints for indicators of compromise — from basic syntax to real-world...
- News
Microsoft's Patch Tuesday Deluge Continues With August 2026 Updates
Microsoft's August 2026 Patch Tuesday drops critical fixes including a CVSS 9.8 Windows DNS RCE requiring no user interaction.
- Security
CVE-2026-50523: Microsoft PowerShell Local Command Injection Vulnerability
A command injection flaw in Microsoft PowerShell allows authorized local attackers to execute arbitrary code via improper input neutralization.
- News
Microsoft Patches LegacyHive Windows Zero-Day That Grants Admin Privileges
CVE-2026-62832 in Windows User Profile Service lets local users hijack registry hives and escalate to admin. Patch now via August Patch Tuesday.
- News
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus Group weaponized a Windows afd.sys kernel flaw to reach SYSTEM, deploy the FudModule rootkit killing 94 EDR channels, and drop new backdoors.
- News
Lazarus Hackers Exploited Windows Zero-Day to Target Defense Firms
North Korea's Lazarus Group weaponized CVE-2026-68820 in Operation Dream Job, hitting defense and aerospace firms across four countries for five weeks.
- News
Microsoft Plugs Nearly 400 Security Holes in August 2026 Patch Tuesday
Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including a WinSock zero-day actively exploited in the wild and two publicly disclosed flaws.
- Security
CVE-2026-68820: Windows WinSock Driver Use-After-Free Privilege Escalation
Actively exploited use-after-free in Windows afd.sys (WinSock driver) enables local privilege escalation to SYSTEM. CVSS 7.0. Patch immediately.
- Security
CVE-2026-68579: FreeRDP Heap Buffer Overflow in Windows Clipboard Client
A critical heap-based buffer overflow in FreeRDP's Windows clipboard client allows an OLE paste consumer to trigger memory corruption, scoring CVSS 9.6....
- HOWTO
What Is SentinelAgent.exe? SentinelOne's Agent Process
SentinelAgent.exe is the core SentinelOne EDR agent process on Windows. How to verify it is genuine, what drives its resource usage, and how to manage it.
- News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that hides its command-and-control channel inside the victim's...
- News
Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A sophisticated malvertising campaign dubbed SourTrade has been delivering malware by sending fragmented chunks to victims' browsers, which then assemble...
- News
Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers
Threat actors are hijacking Steam discussion threads to pose as helpful community members, tricking frustrated gamers into running malicious PowerShell...
- Security
CVE-2026-63093: Cursor for Windows Binary Planting Allows RCE via Malicious Git Repository
A high-severity binary planting vulnerability in Cursor for Windows 3.2.16 enables remote attackers to achieve arbitrary code execution by placing a rogue...
- News
New Windows LegacyHive Zero-Day Gives Hackers Admin Privileges
A security researcher has released a public Windows zero-day exploit called LegacyHive that allows local privilege escalation to SYSTEM on fully...
- News
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
A design flaw in the Cursor AI code editor on Windows executes any file named git.exe found in the root of a cloned project directory — automatically,...
- News
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday
Security researcher Chaotic Eclipse released LegacyHive, a proof-of-concept exploit for a Windows User Profile Service privilege escalation vulnerability,...
- News
Zoom Warns of Critical Account Takeover Vulnerability (CVE-2026-53412, CVSS 9.8)
Zoom has disclosed a critical improper input validation flaw in its Windows desktop client and SDK that allows unauthenticated network attackers to hijack...
- Security
CVE-2026-15773: Chrome Use-After-Free Sandbox Escape (CVSS 9.6)
A critical use-after-free vulnerability in Google Chrome's Core component on Windows allows remote attackers to escape the browser sandbox via a crafted...
- News
Microsoft Reins in RoguePlanet Zero-Day After Public PoC Release
Researcher 'Nightmare-Eclipse' published a proof-of-concept exploit for a Windows Defender vulnerability in early June after dropping several other...
- News
Microsoft Patches RoguePlanet Zero-Day in Windows Defender After Public PoC
Microsoft has patched a Windows Defender zero-day vulnerability dubbed RoguePlanet after researcher 'Nightmare-Eclipse' released a working...
- News
GigaWiper: New Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Microsoft has dissected GigaWiper, a destructive Windows backdoor that combines three distinct destructive capabilities — full disk wiping, fake...
- Security
CVE-2026-47831: Weak RNG in BOSH Windows Stemcell Builder Enables Remote Password Prediction
A cryptographically weak random number generator in the GenerateRandomPassword function of bosh-windows-stemcell-builder allows remote attackers to...
- News
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Researchers have uncovered a novel malware artifact generated using DeepSeek that weaponizes the Chromium File System Access API to encrypt files entirely...
- News
CISA: Windows BlueHammer Flaw Now Exploited by Ransomware Gangs
CISA has confirmed that ransomware gangs are actively exploiting BlueHammer, a Microsoft Defender privilege escalation vulnerability previously used in...
- News
Critical SimpleHelp Flaw Exploited to Deploy Djinn Infostealer
Hackers are actively exploiting CVE-2026-48558 in SimpleHelp remote support software to deploy Djinn Stealer, a previously undocumented cross-platform...
- News
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Attackers poisoned at least 18 npm and Go packages with a novel technique: hiding malware in .vscode/tasks.json auto-run tasks, bypassing npm v12's...
- Security
CVE-2026-52884: Notepad++ Trusted Directory Bypass via Path Traversal (CVSS 7.8)
A path traversal flaw in Notepad++ v8.9.6.1 allows attackers to bypass the trusted directory plugin verification check using path sequences, potentially...
- Security
CVE-2026-11374: ManageEngine SSO Ticket Prediction Enables Unauthenticated Account Takeover
A critical authentication vulnerability in four ManageEngine products allows unauthenticated attackers to predict SSO session tickets and take over...
- News
Microsoft Says Windows 11 26H2 Is Coming Soon, Details Upgrade Process
Microsoft has confirmed Windows 11 version 26H2 as the next feature update, with devices running 24H2 and 25H2 able to upgrade via a lightweight...
- News
A Record-Breaking Patch Tuesday for June 2026
Microsoft's June 2026 Patch Tuesday addressed nearly 200 security vulnerabilities — the highest single-month patch count in the company's history —...
- News
Microsoft June 2026 Updates Break Recycle Bin Confirmation Prompts on All Windows Versions
A bug introduced by June 2026 security updates causes Windows to display internal $R filenames instead of original filenames in the Recycle Bin deletion...
- News
USB Worm Spreads Crypto-Stealing Malware via Windows Shortcut Files
A self-spreading USB worm active since February 2026 hides real files behind malicious .lnk shortcuts, hijacks clipboard cryptocurrency addresses, hunts...
- News
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
Microsoft Threat Intelligence has exposed a cryptocurrency clipboard-hijacking campaign active since February 2026 that spreads via malicious USB LNK...
- News
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
Anonymous researcher Chaotic Eclipse released a PoC exploit for a new Microsoft Defender zero-day named RoguePlanet. The race condition flaw grants SYSTEM...
- News
Microsoft Patches Record 206 Flaws Including Three Zero-Days and Critical RCE Bugs
Microsoft's June 2026 Patch Tuesday is the largest single release on record, fixing 206 vulnerabilities across its software portfolio — including three...
- News
Microsoft Patches YellowKey, GreenPlasma, and MiniPlasma Zero-Days
Microsoft's June 2026 Patch Tuesday fixes three actively exploited Windows zero-days: two SYSTEM privilege escalation flaws and a BitLocker bypass...
- News
Hola Browser for Windows Compromised to Deliver Cryptominer
The Windows version of the Hola Browser has been hit by a supply chain attack that bundled a cryptocurrency miner with the official installer, silently…
- Newsletter
June 3 Digest: AI Ransomware, Netlogon RCE, Miasma Supply Chain
An AI-generated ransomware toolkit automates EDR evasion; Windows Netlogon RCE is actively exploited on domain controllers; the Miasma campaign hits Red Hat…
- News
Microsoft's Coreutils Project Brings Linux Commands to Windows
Microsoft announced Coreutils for Windows at Build 2026, bringing widely used Linux command-line utilities — ls, grep, cat, awk, and more — to Windows as…
- Security
CVE-2018-25427: Arm Whois 3.11 Stack-Based Buffer Overflow RCE
A critical stack-based buffer overflow vulnerability in Arm Whois 3.11 (CVSS 9.8) allows remote attackers to execute arbitrary code by supplying oversized…
- Security
CVE-2026-27788: Fujitsu ServerView Agents Privilege Escalation to SYSTEM
An incorrect permission assignment vulnerability in Fujitsu ServerView Agents for Windows V11.60.04 and earlier allows a local authenticated attacker to…
- News
Critical Windows Netlogon RCE Flaw Now Exploited in Attacks
Belgium's national cybersecurity authority (CCB) has issued an urgent warning that threat actors are actively exploiting a recently patched critical Windows…
- HOWTO
Osquery Endpoint Visibility & Threat Hunting
Use SQL to query your endpoints like a database. Deploy osquery across Linux and Windows hosts to surface process trees, network connections, user activity…
- News
Microsoft Says Zero-Day Public Releases Are 'Never Justifiable' as Researcher Threatens More Drops
Microsoft publicly condemned unauthorized zero-day disclosures as 'never justifiable' after a security researcher published working proof-of-concept...
- News
Can You Enforce Strong Active Directory Password Rules Without Frustrating Users?
Strong AD passwords don't have to mean frustrated users — passphrases, breached-password checks, and self-service resets balance security and usability.
- News
Microsoft: Domain Controller Lookup May Fail on Windows
Microsoft has confirmed a new known issue affecting Windows Server 2016 systems where domain controller lookups fail after installing the KB5087537 May 2026.
- News
Making Vulnerable Drivers Exploitable Without Hardware: The
A new technical analysis reveals that many Windows kernel-mode drivers can be exploited from user mode without the physical hardware they were designed...
- News
Trend Micro Warns of Apex One Zero-Day Exploited in the Wild
Trend Micro has patched an Apex One zero-day vulnerability actively exploited in attacks targeting Windows systems. The flaw, discovered in the company's...
- News
MiniPlasma Windows 0-Day Enables SYSTEM Privilege
A new Windows kernel privilege escalation zero-day dubbed MiniPlasma, released by researcher Chaotic Eclipse, grants SYSTEM-level access on fully patched...
- News
Hackers Earn $1,298,250 for 47 Zero-Days at Pwn2Own Berlin
Pwn2Own Berlin 2026 has concluded with security researchers earning over $1.29 million in prizes after successfully exploiting 47 zero-day vulnerabilities...
- News
New Windows ''MiniPlasma'' Zero-Day Exploit Gives SYSTEM
A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed MiniPlasma that lets attackers gain...
- Security
DAEMON Tools Lite Supply Chain Attack via Trojanized
A supply chain attack compromised official DAEMON Tools Lite installation packages distributed from daemon-tools.cc between April 8 and May 5, 2026,...
- News
Microsoft Exchange, Windows 11 Hacked on Second Day of Pwn2Own
On day two of Pwn2Own Berlin 2026, competitors demonstrated 15 unique zero-day vulnerabilities and collected $385,750 in awards, successfully exploiting...
- News
Researcher Drops YellowKey, GreenPlasma Windows Zero-Days
A security researcher has publicly released two unpatched Windows zero-day exploits: YellowKey, a BitLocker bypass requiring physical access, and...
- News
Windows Zero-Days Expose BitLocker Bypasses and CTFMON
An anonymous researcher has publicly disclosed two new unpatched Windows zero-days — YellowKey enabling BitLocker bypass and GreenPlasma targeting CTFMON...
- News
Microsoft May 2026 Patch Tuesday: 137 Flaws Fixed, Zero
Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities including nine critical flaws — but for the first time in two years, not a single...
- News
Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No
Microsoft's May 2026 Patch Tuesday delivers security updates for 120 vulnerabilities across Windows, Edge, Office, Azure, and more — with no zero-days...
- News
Microsoft Patches 138 Vulnerabilities Including DNS and Netlogon RCE Flaws
Microsoft's May 2026 Patch Tuesday addresses 138 security vulnerabilities across its product portfolio, including 30 rated Critical — with notable DNS...
- News
Windows BitLocker Zero-Day Gives Access to Protected
A cybersecurity researcher has published proof-of-concept exploits for two unpatched Windows vulnerabilities — YellowKey (BitLocker bypass) and...
- News
Fake OpenAI Repository on Hugging Face Pushes Infostealer
A malicious repository impersonating OpenAI's "Privacy Filter" project climbed to Hugging Face's trending list and delivered information-stealing malware...
- News
JDownloader Site Hacked to Replace Installers with Python
The official website for JDownloader, one of the most widely-used open-source download managers, was compromised to distribute malicious Windows and Linux...
- News
Microsoft Tests Modern Windows Run Dialog With Dark Mode
Microsoft is testing a redesigned Run dialog for Windows 11 that brings dark mode support and improved performance over the legacy Win+R dialog that has...
- News
CISA Adds Actively Exploited ConnectWise and Windows Flaws
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2024-1708 affecting ConnectWise ScreenConnect...
- News
Vect 2.0 Ransomware Acts as Wiper Thanks to Design Error
The emerging Vect 2.0 ransomware — deployed against TeamPCP supply chain attack victims — permanently destroys files larger than 131KB due to a critical...
- News
VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB
Threat hunters warn that VECT 2.0 ransomware contains a critical flaw in its encryption implementation that acts more like a wiper for files over 131KB...
- News
Incomplete Windows Patch Opens Door to Zero-Click Attacks
A Microsoft Windows vulnerability originally patched in a prior Patch Tuesday was incompletely remediated, leaving a residual attack surface that...
- News
Microsoft Patch Tuesday, March 2026 Edition
Microsoft patched 77 security vulnerabilities in March 2026 with no actively exploited zero-days, a welcome reprieve following February's five-zero-day...
- News
Patch Tuesday, April 2026 Edition
Microsoft released patches for 167 security vulnerabilities in April 2026, including an actively exploited SharePoint Server zero-day and the publicly...
- News
Microsoft Rolls Out Revamped Windows Insider Program
Microsoft is rolling out a revamped Windows Insider Program experience as part of broader plans to address performance and reliability concerns affecting...
- News
Microsoft to Roll Out Entra Passkeys on Windows in Late
Microsoft is rolling out passkey support for phishing-resistant passwordless authentication to Microsoft Entra-protected resources from Windows devices...
- News
Windows Update Gets New Controls to Reduce Forced Restarts
Microsoft is rolling out Windows Update improvements that give users more control over how updates are installed while reducing disruption from frequent...
- News
Kyber Ransomware Gang Uses Post-Quantum Encryption to Target Windows and ESXi
A new ransomware operation called Kyber is targeting Windows systems and VMware ESXi endpoints, with one variant implementing Kyber1024 post-quantum...
- News
Microsoft Drops Its Second-Largest Monthly Patch Batch on Record
Microsoft's April 2026 Patch Tuesday addressed 169 CVEs — the second-largest monthly update in company history — including one actively exploited...
- News
Microsoft Issues Patches for SharePoint Zero-Day and 168
Microsoft's April 2026 Patch Tuesday addresses a record 169 security vulnerabilities including a SharePoint zero-day actively exploited in the wild, 8...
- News
Recently Leaked Windows Zero-Days Now Exploited in Active
Threat actors are actively exploiting three recently disclosed Windows security vulnerabilities that allow attackers to gain SYSTEM or elevated...
- News
In Other News: Cyberattack Stings Stryker, Windows
A weekly roundup of notable cybersecurity stories: Iran-linked hackers wipe 200,000 Stryker devices, the BlueHammer Windows zero-day PoC goes public,...
- News
Microsoft Suspends Dev Accounts for High-Profile Open
Microsoft has suspended developer accounts used to maintain several prominent open-source projects without prior notice or a quick reinstatement path,...
- News
Disgruntled Researcher Leaks BlueHammer Windows Zero-Day
A security researcher operating under the aliases 'Chaotic Eclipse' and 'Nightmare-Eclipse' has publicly released exploit code for an unpatched Windows...
- News
Bearlyfy Hits Russian Firms with Custom GenieLocker
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, recently deploying a custom...
- Security
CVE-2026-30303 — Axon Code OS Command Injection via Whitelist Bypass
The command auto-approval module in Axon Code contains an OS Command Injection vulnerability. An incompatible Unix-based shell-quote parser is used on...
- News
Microsoft Shares Fix for Windows C: Drive Access Issues on Samsung PCs
Microsoft has published a multi-step recovery procedure for Samsung Galaxy Book 4 laptops running Windows 11 24H2/25H2 where the Samsung Galaxy Connect...
- News
Microsoft Halts Forced Global Rollout of Microsoft 365
Microsoft has stopped automatically installing the Microsoft 365 Copilot app on Windows devices outside the European Economic Area, reversing a bundling...
- News
Microsoft Releases Windows 11 OOB Hotpatch to Fix Three
Microsoft has pushed an out-of-band hotpatch (KB5084597) to Windows 11 Enterprise devices to address three integer-overflow RCE flaws in RRAS, one rated...
- Security
Microsoft MSHTML Framework Security Feature Bypass
An actively exploited protection mechanism failure in the Windows MSHTML (Trident) engine allows attackers to bypass browser security zones and shell...
- Security
Microsoft February 2026 Patch Tuesday Fixes Six Actively
Microsoft's February 2026 Patch Tuesday addresses roughly 60 vulnerabilities including six actively exploited zero-days across Windows, Office, and Azure...
- Security
Microsoft Patch Tuesday February 2026: 6 Actively Exploited
Microsoft's February 2026 Patch Tuesday addresses 60 vulnerabilities including 6 actively exploited zero-days and 3 publicly disclosed issues, with...
- Security
CVE-2026-21533: Windows Remote Desktop Services Zero-Day
Actively exploited zero-day in Windows RDS allows authenticated attackers with low privileges to escalate to SYSTEM. Public exploit code available....
- Security
Windows SmartScreen Bypass Under Active Exploitation
Actively exploited Windows Shell vulnerability bypasses SmartScreen protection, allowing malicious files to execute without security warnings. Patch...
- Checklist
Server Hardening Security Checklist
Comprehensive checklist for hardening Linux and Windows servers before production deployment. Covers OS configuration, network security, access controls,...
- HOWTO
IT Service Dashboards with PowerShell Universal
Build interactive IT service management dashboards using PowerShell Universal. Create real-time client portals, automated ticketing views, and...
- HOWTO
Docker Windows Containers: Native Engine Setup Guide
Deploy Docker Engine natively on Windows without Docker Desktop. Covers installation, Windows container mode, lifecycle management, and troubleshooting.
- HOWTO
Intune Device Enrollment: Windows Autopilot Setup
Configure Windows Autopilot for zero-touch device deployment. Covers hardware hash import, deployment profiles, ESP configuration, and user-driven enrollment.
- HOWTO
Windows Security Baseline Audit: CIS Benchmark Compliance
Automate Windows security baseline checks using PowerShell. Validate configurations against CIS benchmarks for password policies, audit settings, and...
- HOWTO
Windows Security Event Log Analysis: Detect Threats with PowerShell
Learn to analyze Windows Security Event Logs to detect brute force attacks, lateral movement, privilege escalation, and other security threats using PowerShell.
- Security
Microsoft January 2026 Patch Tuesday: 114 Flaws Fixed, One
Microsoft's first security update of 2026 addresses 114 vulnerabilities including three zero-days. One flaw is actively exploited in the wild with CISA...