This is an informational update from Microsoft Security detailing new capabilities and tools introduced in August 2026 to enhance security management, particularly around AI agents and cloud-native environments. The update highlights improvements in Microsoft Defender Experts MDR, Microsoft Entra Tenant Governance, Microsoft Intune, Microsoft Purview auto-labeling, and Microsoft Security Exposure Management. These enhancements aim to provide better visibility, governance, and protection against threats in AI-powered and multi-tenant environments. No specific vulnerabilities or exploits are described.
Microsoft has released a permanent fix for a known issue causing system crashes and gaming problems on Windows 11 devices, specifically related to the inpoutx64.sys driver used by peripherals with RGB lighting. The issue caused games such as ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals to fail launching or freeze with access violation errors. The fix disables the inpoutx64 driver on affected devices and is rolling out to consumer and business Windows 11 systems, requiring a restart. For enterprise-managed devices, Microsoft provides a registry-based workaround to disable the driver manually. The fix will also be included in the September 2026 Windows updates.
The installer for the Windows version of the Rakuten Kobo Desktop Application may insecurely load Dynamic Link Libraries (DLLs). This behavior can potentially allow malicious DLLs to be loaded during installation, which could lead to security risks. No specific affected versions or patch information is provided.
Microsoft is testing new privacy controls in Windows 11 that allow users to manage which desktop applications can access sensitive resources such as the camera, microphone, and precise location. This initiative aims to enhance user privacy by providing more granular control over app permissions. The feature is currently in testing and no security vulnerability or exploit is reported in this context.
This content discusses the shrinking timeframe between vulnerability disclosure and remediation, highlighting the increasing difficulty defenders face in patching systems before attackers exploit vulnerabilities. It emphasizes that traditional vulnerability management models are no longer sufficient due to the rapid pace of modern attacks and complex enterprise environments. The article also notes that AI accelerates both defensive analysis and offensive exploitation, further compressing the patch window. It calls for a new approach to security that addresses the critical period between awareness and patch deployment.
Microsoft PowerToys 0.101.2362.0 introduces a new utility called Window Hopper that allows users to switch between windows of the currently focused app using a configurable keyboard shortcut. This feature enhances user productivity by limiting window switching to a single application context. The update also includes other usability improvements and new features but does not describe any security vulnerabilities or threats.
Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication. [...]
Microsoft says ongoing issues causing games to crash or fail to launch after installing the August 2026 Windows updates may be caused by peripherals with RGB lighting. [...]
Threat actors are abusing FTP server banners to deliver two previously undocumented remote access trojans (RATs) named E4del and PINHOLE. These malware samples are distributed by embedding commands within FTP banners, a technique that leverages the FTP protocol's banner messages to hide malicious payload delivery. The malware targets Windows systems and enables remote access capabilities for attackers.
This research reveals how the Windows Defender Boot-Time Removal driver (BTR.sys), a legitimate Microsoft-signed remediation component, can be repurposed as a powerful kernel operation primitive. The driver uses an encrypted configuration stored in an Alternate Data Stream and executes a list of file and registry operations at kernel level. The study demonstrates how this trusted driver can be weaponized to bypass endpoint detection and response (EDR) and antivirus (AV) solutions without exploiting vulnerabilities or memory corruption. The driver is dropped with randomized filenames and service names, loads once to perform its tasks, and then self-unloads. The research includes a tool, BTR_CLI, that safely exercises the driver's functionality to demonstrate its capabilities and potential misuse. This case highlights risks where defensive technology can be leveraged offensively due to undocumented or unintended functionality.
UAT-10147 is a sophisticated Chinese-speaking intrusion actor deploying a cross-platform backdoor named SPECTRE targeting IIS and Linux servers. SPECTRE integrates advanced post-exploitation features including process injection, credential theft, anti-analysis, and kernel-level EDR bypass via Bring Your Own Virtual Driver (BYOVD) techniques. The campaign combines SEO fraud monetization with custom malware, open-source tools, and AI-assisted development workflows. The Windows variant of SPECTRE uses runtime API resolution and string encryption to evade static detection and includes a comprehensive command set for system control and persistence. The Linux variant incorporates a kernel rootkit with similar advanced capabilities. The actor also uses in-memory web shells and sophisticated evasion methods. No patch or remediation is indicated in the available data.
Cisco Talos identified a Chinese-speaking cybercrime group, UAT-10147, conducting large-scale attacks against Windows and Linux web servers globally. The group exploits publicly disclosed vulnerabilities to gain initial access and integrates AI-driven tools to automate exploitation, reconnaissance, payload generation, validation, and persistence. Targets include organizations in government, education, media, technology, and gaming sectors across Brazil, Bolivia, China, Canada, and Vietnam. The actor deploys malware for SEO fraud and data theft, using multiple open-source offensive frameworks and privilege escalation tools. The infection chains involve multi-stage scripts that evade detection and establish persistence via backdoors and rogue accounts. Talos assesses this as a financially motivated campaign leveraging semi-autonomous AI orchestration to scale complex intrusions efficiently.
Microsoft is investigating issues caused by the August 2026 Windows updates (notably KB5121003) that may prevent some games from launching or cause them to crash on Windows 11 systems, specifically versions 24H2 and 25H2. Affected users report symptoms such as games freezing, closing unexpectedly, EXCEPTION_ACCESS_VIOLATION errors, and system restarts. Microsoft has acknowledged the problem and is currently investigating the root cause. Users experiencing these issues are encouraged to report them via the Feedback Hub. No official patch or fix has been announced yet.
Microsoft resolved a bug in Windows Defender that caused crashes and 0xc0000005 access violation errors after a recent security update. The issue affected Windows 10 and Windows 11 devices, causing Defender scans to fail and the threat service to stop unexpectedly. The problem was addressed via a Microsoft Defender Antivirus signature update (version 1.457.236.0 or later), which is applied automatically or can be installed via Windows Update.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component. [...]
Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. [...]
