Tag: microsoft defender
26 articles
Microsoft Disregards Defender Alerts as False Positives
If you've recently updated Microsoft Defender Antivirus, you might be seeing annoying false alarms claiming it's turned off - but don't worry, it's still working hard to protect you. These pesky alerts are affecting all supported Windows versions, including Windows 11 26H1 and Windows Server 2025.
Microsoft Defender Driver Exploited to Disable Security Software
Researchers at Check Point have uncovered a technique that exploits Microsoft Defender's own driver to disable security software, leaving Windows 7 to 11 users vulnerable to attack. This clever hack requires no external driver or software vulnerability, making it a worrying threat.
Signed Drivers Exposed to Abuse Microsoft Defender Driver Repurposed $10 Million Reward Offered AI Model Exploits Vulnerabilities RCE Flaws Discovered in Gogs, n8n
In a stunning example of old-school ingenuity, a team of investigators finally thwarted a sophisticated espionage campaign by doing something remarkably low-tech: cutting a cable to a compromised router in a Chicago data center. This bold move brought an end to months of digital detective work that had been stymied by the elusive threat actors.
Microsoft Scrambles to Patch Defender Zero-Day Exploited in Wild
Microsoft is racing against the clock to patch a zero-day vulnerability in Defender, known as ShieldBreak, that's being exploited in the wild. The tech giant is working on a high-quality security update to address the elevation of privilege issue in the Microsoft Malware Protection Engine.
Microsoft Defender Zero-Day Exploited to Gain System Privileges
A security researcher known as Nightmare Eclipse has unveiled a new exploit, ShieldBreak, which can bypass Microsoft's patch for the RoguePlanet vulnerability and grant SYSTEM privileges on fully patched Windows systems. This alarming development highlights a significant gap in Microsoft Defender's defenses, leaving users vulnerable to potential attacks.
Microsoft Defender Faces ShieldBreak Exploit With SYSTEM Access
A security researcher known as Chaotic Eclipse has unleashed a powerful proof-of-concept exploit called ShieldBreak, which cleverly bypasses Microsoft's patch for the RoguePlanet vulnerability, granting SYSTEM-level access. This devastating exploit has been tested on the latest Windows 11 and Server 2025 with a 100% success rate.
HollowFrame Loader Evades Defender with Fake Python DLL Tactic
Clever attackers have found a way to slip past Microsoft Defender by using a fake Python DLL, effectively creating a trusted execution lane that evades detection. They set the stage for this trick by first gaining elevated access through a sneaky spear-phishing link.
Microsoft Defender for Endpoint update cripples Linux protection
A recent update to Microsoft Defender for Endpoint has caused a major hiccup, crippling Linux protection and potentially leaving some devices vulnerable. The issue affects specific Linux versions, and a simple upgrade or reinstall followed by a reboot could be the culprit behind a disabled Defender service.
Microsoft Fixes Defender Flaw That Exposes Systems to SYSTEM Privileges
Microsoft has patched a critical flaw in its Defender software, known as RoguePlanet, that could have allowed hackers to gain SYSTEM privileges and take control of vulnerable systems. The vulnerability, tracked as CVE-2026-50656, has been fixed with the latest security updates.
Microsoft Fixes RoguePlanet Zero-Day Flaw in Defender Update
Microsoft has swiftly patched a high-risk zero-day flaw in Defender, known as RoguePlanet, that could have allowed hackers to gain SYSTEM privileges and take control of your device. This critical update fixes the vulnerability, CVE-2026-50656, and ensures your Defender is now better equipped to protect you from potential attacks.
Ransomware gangs exploit Windows BlueHammer flaw
Ransomware gangs are actively exploiting a critical Microsoft Defender flaw, nicknamed BlueHammer, which has been added to CISA's list of Known Exploited Vulnerabilities. This vulnerability is a prime target for malicious cyber actors, posing a significant risk to those who haven't yet applied the necessary patches.
Malicious Chrome Extension Exploits Search Functionality for Data Interception
A malicious Chrome extension, masquerading as a popular AI search engine, was discovered to be secretly logging users' searches and address bar inputs, with Microsoft confirming that the data collection was no accident. The extension, since removed by Google, cleverly disguised itself as a legitimate tool, routing queries through an attacker-controlled server.
Microsoft Tackles RoguePlanet Defender Flaw with Imminent Patch
Microsoft is working on a patch to fix a serious security flaw in Microsoft Defender, known as RoguePlanet, which could allow hackers to gain elevated privileges on affected systems. A high-quality security update is imminent to address this vulnerability and protect users.
Microsoft Scrambles to Patch RoguePlanet Zero-Day in Defender
Microsoft is racing against the clock to fix a critical vulnerability in Defender, known as RoguePlanet, after a proof-of-concept exploit was released, allowing hackers to elevate privileges regardless of real-time protection settings. A patch is in the works, but no release date has been given.
Windows Junctions Expose Hidden Malware Paths
Malware creators have found a sneaky way to evade detection by using NTFS junctions, a feature that's normally used to connect directories, to create hidden paths that can bypass security defenses like Microsoft Defender. By exploiting this vulnerability, attackers can cleverly disguise their malware's true location, making it harder to detect.
Disgruntled Bug Hunter Exposes New Windows 0-Day Vulnerability
A disgruntled bug hunter, known as Nightmare Eclipse, has revealed a new zero-day vulnerability called RoguePlanet, which can give attackers SYSTEM-level control over fully patched Windows 10 and 11 systems. The exploit, fueled by a grudge against Microsoft, targets a weakness in Windows Defender.
Microsoft Defender Zero-Day Exploited for SYSTEM Access
A security researcher, known as Chaotic Eclipse, has discovered a Microsoft Defender zero-day exploit, dubbed RoguePlanet, that can give attackers unrestricted access to compromised machines. The proof-of-concept exploit, released under the handle MSNightmare, can yield a shell with SYSTEM-level privileges, allowing hackers to run arbitrary code and perform unauthorized actions.
Microsoft Defender Zero-Day Exploited for SYSTEM Privileges
A newly discovered Microsoft Defender zero-day exploit, dubbed RoguePlanet, can spawn a Windows command prompt with SYSTEM privileges, posing a significant threat to fully patched Windows 10 and 11 devices. This cleverly crafted exploit uses a hit-or-miss race condition to gain elevated access, with some machines surprisingly vulnerable to a 100% success rate.
Microsoft Decries Uncoordinated Zero-Day Disclosures
Microsoft slammed researchers who publicly revealed six zero-day vulnerabilities without giving the company a heads-up, putting customers at unnecessary risk. The tech giant named and shamed the flaws, including privilege escalation vulnerabilities in Microsoft Defender and a security feature bypass vulnerability in Windows BitLocker.
Microsoft Defender Automatically Isolates Hacked Endpoints
Microsoft Defender for Endpoint just got a major boost with its new automatic isolation feature, which swiftly isolates compromised devices to prevent attackers from wreaking havoc on your organization. This cutting-edge capability is part of Microsoft's automatic attack disruption feature, designed to contain threats and give security teams more time to respond.
Microsoft Discloses Actively Exploited Defender Vulnerabilities
Microsoft warns of two critical vulnerabilities in its Defender software, one of which is being actively exploited by attackers to gain elevated privileges, and the other causing denial-of-service issues. These flaws, tracked as CVE-2026-41091 and CVE-2026-45498, highlight the need for urgent patching to prevent system compromise.
Microsoft Disrupts Zero-Day Attacks with Defender Patch Rollout
Microsoft is taking swift action to protect its users from zero-day attacks with an emergency patch rollout for its Defender software, ensuring that even the most vulnerable systems are safeguarded. The update addresses two critical vulnerabilities that were being actively exploited by hackers.
Microsoft Defender Flags DigiCert Certificates as Malware in False Positives
Microsoft Defender's recent signature update mistakenly flagged legitimate DigiCert root certificates as malware, causing widespread alerts and removal of the certificates, and even prompting some users to reinstall Windows. DigiCert quickly revoked the affected certificates within 24 hours of discovery, minimizing the impact.
CISA Mandates Patching of Exploited BlueHammer Flaw in Federal Systems
Don't let your federal systems become an easy target: CISA is mandating the patching of the exploited BlueHammer flaw to prevent malicious cyber actors from gaining a foothold. A high-severity vulnerability in Microsoft Defender can allow low-privileged users to gain SYSTEM permissions - but a patch is available.