Tag: windows
293 articles
Microsoft Defender Exposes New Zero-Day Vulnerability
A security researcher has uncovered a new zero-day vulnerability, dubbed ShieldCrash, which exposes a gaping hole in Microsoft Defender's patch for CVE-2026-69414, leaving all supported Windows versions open to attack. This shocking exploit allows hackers to read arbitrary files with SYSTEM privileges, putting even the most secure systems at risk.
Microsoft Patches 974 Flaws, Including Two Actively Exploited Windows Zero-Days
Microsoft just dropped a massive Patch Tuesday update, fixing a record-breaking 974 vulnerabilities - including two Windows zero-days that have already been exploited by hackers. This critical update covers a wide range of products, from Windows and Office to SQL Server and Developer Tools.
Microsoft patches 974 vulnerabilities, including two actively exploited zero-days
Microsoft just dropped a massive Patch Tuesday update, fixing a whopping 974 vulnerabilities across its product lineup - including two zero-day flaws that hackers were actively exploiting before the fixes were even released. The update tackles critical issues, including privilege escalation bugs that could let attackers gain a foothold in your system.
Microsoft Probes Teams Desktop Client Outage on Windows Systems
If you're having trouble launching Microsoft Teams on your Windows device, you're not alone - some users are experiencing loading delays of up to two minutes or being blocked from opening the client altogether. Microsoft is actively working to resolve the issue, which appears when first opening the desktop client.
CrowdStrike Zero-Day Exploit Grants SYSTEM Privileges on Windows Systems
A new zero-day exploit, dubbed FalconFlank, can grant attackers SYSTEM-level access to fully patched Windows machines protected by CrowdStrike Falcon, allowing them to spawn a command prompt with elevated privileges. This alarming vulnerability leverages CrowdStrike's own Office malicious macros remediation feature to perform a devastating privilege escalation.
Iranian Hackers Deploy Cross-Platform Malware via Coding Tests
Iranian hackers are using clever tactics to deploy cross-platform malware, disguising it as coding challenges on LinkedIn and other job search platforms to trick developers into installing the threat. This malware, tracked as NodeRabbit and PollCat, can infect Windows, Linux, and macOS workstations, allowing hackers to gain remote access.
Microsoft Exposes TerminalFix Attacks Deploying Reverse Tunnels
Beware of TerminalFix attacks that use fake Cloudflare CAPTCHA prompts on compromised websites to trick you into executing malicious PowerShell commands in Windows Terminal. These sneaky attacks can lead to more complex threats, making it crucial to stay vigilant online.
Microsoft Warns of TerminalFix Malware Hiding in PNGs
Microsoft researchers have uncovered a sneaky malware campaign, dubbed TerminalFix, that hides in plain sight by masquerading as harmless PNG images - only to delete them after extraction, leaving behind a trail of PowerShell commands that can compromise your system. This fresh variant of the ClickFix social-engineering trick tricks victims into pasting malicious commands into Windows Terminal or PowerShell.
Microsoft Warns of TerminalFix Backdoor Deploying via Fake Cloudflare CAPTCHAs
Beware of fake Cloudflare CAPTCHAs that can lead to a sneaky backdoor invasion, giving attackers direct access to your organization's internal network. A new variant of malware, called TerminalFix, tricks victims into executing a malicious PowerShell command, allowing hackers to gain control.
Next.js Patches Flaws Enabling Unauthenticated Remote Code Execution
If your Next.js application is hosted on Windows, upgrade immediately to patch a critical vulnerability that allows unauthenticated remote code execution. This flaw, tracked as CVE-2026-75604, affects apps using both Pages Router and App Router without Cache Components.
Amazon Kiro Flaw Exposes Sensitive Data Through Prompt Injection
A security flaw in Kiro, known as a prompt injection vulnerability, allowed hackers to tap into sensitive data by manipulating the Kiro agent with malicious repository content. This issue, affecting Kiro IDE 0.7.45 on Windows, could send local information to an external endpoint, putting users at risk.
CISA Mandates Swift Patching for Oracle Flaw
Don't wait - patch now! A critical Oracle flaw, scored 10.0, requires immediate attention to prevent low-complexity attacks that could give hackers complete access to your critical data.
Researchers Expose Chrome DevTools Protocol Hijacking Technique
Google warns that attackers are exploiting Chrome Remote Debugging to steal cookies, and now researchers have developed a new technique to activate DevTools inside a live browser, allowing for even easier cookie extraction. This technique uses a Beacon Object File to tap into the Chrome DevTools Protocol, posing a new threat to users.
HoneyMyte APT Group Upgrades CoolClient Backdoor with Kernel-Level Rootkit
Meet the upgraded CoolClient Backdoor, now packing a kernel-level rootkit courtesy of the sneaky HoneyMyte APT Group - and it's hiding in plain sight with a legit digital signature. This clever malware uses a Windows service and a kernel-mode driver to evade detection.
Microsoft patches LegacyHive zero-day vulnerability
Microsoft just patched a nasty zero-day vulnerability, known as LegacyHive, that could let hackers gain administrator privileges on your Windows PC - but thankfully, it's now fixed in the August Patch Tuesday updates.
Windows Plug and Play Feature Exploited for SYSTEM Access via Fake USB Devices
Imagine a scenario where hackers can gain SYSTEM access to a Windows computer without needing a single click or logged-in user - and even exploit it remotely over RDP with no hardware involved. Researchers have just revealed a chilling new class of attacks, dubbed "Plug and Pwn", that takes advantage of Windows' Plug and Play feature to execute malicious software with alarming ease.
Lazarus Exploits Windows Zero-Day with Post-Quantum Key Exchange Tactics
Lazarus hackers have taken a cutting-edge approach, using a post-quantum key exchange to secure their command channel before exploiting a Windows zero-day vulnerability in a targeted campaign against defense and aerospace companies. They leveraged Kyber/ML-KEM, a key encapsulation scheme designed to withstand quantum computer attacks, to generate fresh key material and evade detection.
Microsoft Patch Tuesday Disrupts 400 Vulnerabilities, Zero-Day Exploits
Microsoft's August Patch Tuesday update is a doozy, tackling a whopping 400 vulnerabilities, including an actively exploited zero-day threat that demands immediate attention from sysadmins. With high-risk impacts on confidentiality, integrity, and availability, these fixes should be top priority.
Microsoft Disrupts Hundreds of Flaws in Massive Patch Update
Microsoft just dropped a massive patch update to fix a whopping 398 security flaws in Windows and its software, including a critical vulnerability that's already being exploited by hackers. This crucial update tackles a range of weaknesses, from a zero-day privilege-escalation flaw in a key Windows driver to other publicly known vulnerabilities.
Microsoft Patches Zero-Day Windows Driver Flaw Under Active Attack
Microsoft just patched a high-severity Windows driver flaw, known as CVE-2026-68820, that was already being exploited by hackers in the wild. This zero-day vulnerability, with a CVSS score of 7.0, could be triggered by a race condition, allowing attackers to gain a foothold in targeted systems.
Passkey Defenses Targeted in Novel Attacks
Researchers at Black Hat USA 2026 revealed a shocking vulnerability in passkey defenses, demonstrating how attackers can bypass FIDO2 cryptography and exploit a flaw in Windows Event Logging Service (CVE-2026-34348) to defeat passkey protections. This security gap was found to allow unauthorized users to access and replay sensitive YubiKey signatures.
Phishing Campaign Exploits COLDCARD Vulnerability to Install Remote Access Tool
Worried COLDCARD owners are being targeted by a sneaky phishing campaign that masquerades as a security audit, tricking them into installing remote-access software on their Windows machines. Scammers are sending fake emails from a spoofed address, claiming a hardware audit is underway to verify the integrity of COLDCARD devices.
Malware Exploits Google Passkey Sync Flaws
Google's passkeys, touted as a secure alternative to passwords, have been found to have flaws that can be exploited by malware, allowing hackers to access sensitive information. Researchers have discovered three techniques, dubbed Pass-ta-key, that let attackers abuse Google Password Manager's synced passkeys on compromised Windows devices.
Russian Loader Service Exploits Browser Cache to Deliver Malware
Meet DOUBLECUP, a sneaky Russian loader service that's been hiding in plain sight since June 2026, using browser cache tricks to deliver malware to unsuspecting victims. Its clever ClickFix campaigns conceal malicious code within innocent-looking PNG images, deploying nasty payloads like CountLoader and DeviceManager RAT on Windows and macOS devices.