AvisLoader is a newly identified Windows malware loader that employs encrypted peer-to-peer communications to protect its command-and-control infrastructure from disruption. It uses ClickFix delivery methods, shortcut-based persistence mechanisms, and supports remote command execution. This design aims to enhance the malware's resilience and operational stealth.
Microsoft has announced that Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will reach end of support in 30 days, after which these systems will no longer receive security updates.
Microsoft announced that devices running unsupported versions of Windows will stop receiving security updates following a Windows Update certificate rotation scheduled for next year. This change affects outdated Windows devices that no longer receive official support.
Microsoft's FORGE Lab is advancing AI-native vulnerability research, discovering and helping remediate numerous vulnerabilities across Windows and open-source projects including the Linux kernel. Their work from May to September 2026 led to 140 CVEs assigned for Windows and 155 validated reports for open-source projects. The research highlights challenges beyond discovery, emphasizing the need for scalable validation and remediation processes to keep pace with AI-generated findings. Key lessons include shifting focus from capability to scale, optimizing reasoning economics, and coordinating validation and remediation efforts. This approach aims to sustain vulnerability research at scale by integrating automated validation tools and human coordination.
Microsoft will block .msix and .msixbundle file attachments in Outlook Web and the new Outlook Windows client starting in November 2026. These file types, used for modern Windows installation packages, will be added to the default blocked attachments list in Exchange Online's OWA Mailbox policies. After the update, users will be unable to send, receive, open, or download these attachments by default. Administrators can whitelist these file types if necessary. This change is part of Microsoft's ongoing efforts to enhance security by blocking potentially unsafe file attachments that have been abused in attacks.
The Microsoft Windows KB5124010 preview update released in September 2026 causes crashes in some games and applications that use AC-3 (Dolby Digital) audio decoding. The issue affects legacy applications relying on Windows built-in audio decoding, leading to failures to launch or unexpected closures when audio features are used. Modern applications that use their own audio decoding components are generally not impacted. The update is optional unless automatic updates are enabled on Windows 11 24H2 devices. Microsoft is aware of the problem and working on a fix but has not provided a timeline.
Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2. [...]
Cisco Talos identified a China-nexus cyber espionage campaign named UAT-11587 targeting government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The campaign uses spear-phishing emails with tailored decoy documents to deliver a Rust-compiled Windows backdoor called Antino. Antino supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its command-and-control communication uniquely operates through Microsoft 365 applications using Microsoft Graph to interact with Outlook and OneDrive. The campaign has affected at least 16 institutional environments across eight Asian countries with approximately 350 compromised endpoints. Talos assesses this activity as an intelligence gathering operation with moderate to high confidence. No patch or remediation guidance is provided in the report.
Microsoft has released general availability of Linux container support in Windows Subsystem for Linux (WSL), enabling users to build, run, and deploy Linux containers directly on Windows. This new feature includes a command-line tool (wslc.exe) and an API for programmatic container management. It integrates with Microsoft Defender for Endpoint for enhanced security monitoring and with Microsoft Intune for administrative control over container usage. Additional features such as container restart, file copying, health checks, and network commands are now supported. Docker Compose-style support is in development. This release is a feature enhancement rather than a security vulnerability.
Signal has released version 8.30, completing the rollout of its secure backups feature across all supported platforms including iOS and desktop apps. This feature allows users to create end-to-end encrypted backups of their chats, either hosted by Signal or stored locally on the device. The backups require a recovery key for decryption, and hosted backups include an additional rotating key for enhanced security. The update introduces local encrypted backups to iOS and desktop, aligns Android backups to a cross-platform format, and improves media storage efficiency. The backup system excludes disappearing messages set to vanish within 24 hours. The new iOS client also supports direct encrypted iPhone-to-iPhone transfers via Wi-Fi Aware. This release marks the completion of Signal's first phase of its backups project.
Microsoft has released the Windows 11 2026 Update (26H2), which is an annual feature update delivered as a small enablement package for devices already running Windows 11 24H2 or 25H2. This update shares the same servicing branch and source code base as previous versions, meaning most features have been gradually introduced through monthly updates rather than being exclusive to 26H2. Devices running Windows 11 26H1 cannot upgrade directly to 26H2 due to a different Windows core. The update resets the Windows support lifecycle, providing 24 months of support for Home and Pro editions and 36 months for Enterprise and Education editions. There are no new security vulnerabilities or exploits associated with this update mentioned in the source content.
An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability extension. Some variants include browser data theft and camera/microphone recording functionality. The malware has been distributed through malicious npm packages and utilizes tailcat, an open-source Tailscale tool, to establish encrypted command-and-control communications that evade conventional network inspection and blocking. Earlier versions employed Tailscale VPN before transitioning to tailcat. Active since July based on VirusTotal and GitHub evidence, Kothamine features a plugin system for loading additional DLLs, UAC bypass capabilities in certain builds, and employs AES-GCM encryption for C2 communications. The malware achieves persistence through scheduled tasks and adds Windows Defender exclusions during installation.
The x47.c Windows botnet is a malware campaign that uses AI, specifically xAI Grok, to maintain persistence on infected systems. It offers capabilities including DDoS attacks, credential theft, SOCKS5 proxying, and an AI API draining attack that exhausts victims' paid AI service credits. The botnet is controlled via a command-and-control panel with multiple attack methods and fast-flux domain configurations to evade takedown. It includes modules for persistence, privilege escalation, rootkit-based removal of rival malware, and credential harvesting from browsers and other applications.
Researchers demonstrated that file-change notification systems in Windows, Linux, Android, and macOS can be exploited to leak user activity such as keystroke timing, browsing habits, and media events without elevated privileges. The attacks rely on monitoring file system events accessible to unprivileged users or apps, revealing metadata like file names and event timing rather than file contents. On Windows, monitoring the system drive root can expose file paths in other users' profiles, enabling website fingerprinting. Linux kernel mitigations partially address the most severe issues, but no patches exist for Android or macOS. Microsoft considers the behavior by design and not a vulnerability. No in-the-wild exploitation is known, and proof-of-concept code is publicly available.
Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates. [...]
Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates. [...]
The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]
ClosedQuorum is a newly identified Windows malware that leverages multiple AI models, including Google Gemini, DeepSeek, Qwen, and Mistral, to autonomously decide its actions during the post-compromise phase of an attack. This AI-driven approach allows the malware to adapt its behavior dynamically based on the environment and objectives. No specific affected software versions or exploitation details have been provided. There is no known exploit in the wild at this time, and no patch or remediation guidance is available.
