Threats tagged 'windows'

Which Windows, SharePoint, and AD vulnerabilities are being exploited in July 2026, and how can organizations adapt to updates containing 500+ fixes?

Bitdefender researchers show how Windows bind links can create conflicting filesystem views to hide malware from endpoint security products. The post Windows Bind Link Attacks Can Hide Malware From EDR Tools appeared first on SecurityWeek .

Microsoft is blocking this month's Windows 11 security updates on some Dell devices because they are causing shutdowns and performance issues. [...]

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence. Nearly 60 of the bugs quashed in July’s Patch Tuesday earned a “critical” severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws, including two that are already being exploited in the wild. Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include CVE-2026-56155 — an Active Directory Federation Services bug — and CVE-2026-56164 , a Microsoft Sharepoint vulnerability. CVE-2026-50661 is a security feature bypass in Windows BitLocker that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation. In a blog post on July 9, Microsoft Executive Vice President Pavan Davuluri wrote that Windows users will notice “a higher volume of security updates included in each security release” as a result of AI aiding in the discovery of vulnerabilities. “The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis,” Davuluri wrote . Jack Bicer , director of vulnerability research at Action1 , called attention to CVE-2026-48561 , a remote code execution flaw in Microsoft Copilot (with a 9.6 CVSS threat score) that allows an unauthorized attacker to execute code over the network. Microsoft says an attacker could exploit this bug by hosting a malicious website that causes Microsoft Edge for Android to automatically send crafted prompts to Copilot when a user visits the site. As AI advances the state of vulnerability discovery and remediation, it is also making it easier for attackers to quickly devise working exploits for known software flaws. Microsoft has long labeled security bugs using its “exploitability index,” which is Redmond’s best guess as to how likely it is that attackers will be able to figure out a reliable way to exploit a given vulnerability. But Satnam Narang , senior staff research engineer at Tenable , argues that Microsoft’s exploitability index needs to do a better job of shifting with the machine speed of discovery. For example, Microsoft originally gave this month’s SharePoint zero-day an exploitability rating of “less likely,” although the flaw was added to CISA’s Known Exploited Vulnerabilities list on July 1. “Anthropic’s Red Team’s own findings for known vulnerabilities (n-days) revealed how fragile this system has become, with its Mythos Preview model being able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that were rated ‘Exploitation Less Likely’ or ‘Exploitation Unlikely,'” Narang said. “What this means is that our way of looking at Patch Tuesday has changed, because the exploitability index is centered around humans, not AI tools, and as these tools continue to improve, defense needs to improve alongside it.” Chris Goettl at Ivanti observed that the record patch numbers from Microsoft come as a number of other major software makers are increasing their patch cadence, including Adobe which announced today it is moving to twice-monthly security bulletins published on the 2nd and 4th Tuesday of each month (Adobe also cited AI for accelerating their patch cycles). Cisco , Mozilla and Oracle also are shipping updates more frequently, while Google’s patch batches in June 2026 totaled more t…

Microsoft released the Windows 10 KB5099539 extended security update, which includes the July 2026 Patch Tuesday fixes addressing 570 vulnerabilities, including two exploited and one publicly disclosed zero-day. This update is part of the extended security updates (ESU) program for Windows 10, now extended to October 12, 2027, for enrolled devices. It primarily contains security patches and bug fixes without new features, updating Windows 10 to build 19045.7548 and Windows 10 Enterprise LTSC 2021 to build 19044.7548. Notable fixes include resolving issues in OLE Automation, File Explorer, Recycle Bin, input hotkey behavior, Secure Boot status reporting, networking transport registration, and Remote Desktop security enhancements. Some legacy applications using unregistered TDI transports may stop working due to new security hardening. Microsoft recommends migrating to SHA-256 for RDP certificate thumbprints to avoid future disruptions.

Microsoft released Windows 11 cumulative updates KB5101650 and KB5099414 for versions 25H2/24H2 and 23H2 respectively. These updates address 571 security vulnerabilities, fix bugs, and introduce new features such as improved Bluetooth reliability, enhanced Widgets experience, and Point-in-Time restore functionality. The updates also include various performance and reliability improvements across system components including File Explorer, networking, printing, and accessibility. No new issues have been reported with these updates.

A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware. The post Network of 200 GitHub Repositories Used for Malware Infection appeared first on SecurityWeek .

Microsoft says Windows users should expect to see an increase in security updates as the company increasingly relies on artificial intelligence to discover vulnerabilities in its codebase. [...]

Microsoft says the Windows settings backup and restore tool will be enabled by default on Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems after upgrading to Windows 11 26H2. [...]

Microsoft has begun testing the Cloud Rebuild recovery feature in the latest Windows 11 Insider Preview builds released for users in the Experimental channel. [...]

For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found ransomware on portions of its server environment and is assessing whether personal data was accessed or exfiltrated. Indra Group, a Spanish defense, aerospace, and technology contractor and NATO cyber coalition member, has confirmed a ransomware attack affecting one subsidiary. The Gentlemen ransomware gang threatened to leak allegedly stolen data, while Indra said the incident was contained and that service continuity was maintained. Check Point Threat Emulation and Harmony Endpoint provide protection against this threat Nidec, a Japanese electric motor and industrial manufacturer, has disclosed a ransomware attack affecting the network of its Taiwanese subsidiary, Nidec Chaun Choung Technology. BlackField group claimed responsibility and alleged theft of more than two terabytes of corporate data, including employee, financial, procurement, manufacturing, legal, and IT records. US insurance firm Aflac has disclosed a data breach affecting its Japan operations after attackers accessed its policyholder portal between June 15 and June 25. Personal and financial data of nearly 4.4 million customers was exposed, including policyholder information and premium payment account details. AI THREATS Check Point Research has demonstrated a browser-native ransomware technique generated by a large language model that abuses Chrome’s File System Access API. A fake image-enhancement page convinces users to grant folder access, then reads, exfiltrates, and encrypts photos inside the browser on Android and Windows. Researchers examined shell command injection weaknesses in open-source AI coding agents, finding that 10 out of 11 popular tools failed to block obfuscated destructive commands. Simple rewrites bypassed filters and enabled destructive actions, including file deletion, while only the Continue agent properly parsed commands. Researchers warned that attackers are exploiting LLM phantom squatting by registering AI-generated domains to hijack traffic and deliver phishing. They recorded 250,000 hallucinated domains and subsequent registrations, including an AI-built phishing kit, Montana Empire, using a postal-service domain for credential theft. VULNERABILITIES AND PATCHES Oracle E-Business Suite is affected by CVE-2026-46817, a critical remote code execution flaw reportedly exploited against about 950 internet-exposed instances worldwide. Successful exploitation can give attackers control over ERP systems. Check Point IPS provides protection against this threat (Oracle E-Business Suite Authentication Bypass (CVE-2026-46817)) Linux kernel maintainers patched CVE-2026-46242, a Bad Epoll privilege escalation flaw affecting Linux servers, desktops, and Android devices. The race-condition use-after-free vulnerability allows an unprivileged local user to gain root access, and a public exploit demonstrated reliable exploitation against vulnerable systems. Citrix has addressed CVE-2026-8451, a NetScaler ADC and NetScaler Gateway memory disclosure flaw affecting SAML Identity Provider configurations. Active exploitation was observed less than 24 hours after disclosure, with attacks able to leak session tokens from vulnerable appliances. Check Point IPS provides protection against this threat (Citrix NetScaler Out Of Bounds Read (CVE-2026-8451)) Progress has addressed CVE-2026-8037, a critical OS command injection flaw in Kemp LoadMaster load balancers with a CVSS score of 9.6. Exploitation attempts began on June 29 and could allow unauthenticated remote code execution against vulnerable systems. Check Point IPS provides protection against this threat (Progress Kemp LoadMaster Commad Injection (CVE-…

Windows Defender (MsMpEng.exe) - Race Condition

A look inside the reverse-engineering journey of building the first RDP client outside of Windows to support WebAuthn redirection. The post How We Added WebAuthn to a Browser-Based RDP Client appeared first on Unit 42 .

Microsoft has fixed a known issue causing the Copilot Chat or Copilot buttons in Classic Outlook to disappear for Windows users with the Copilot Chat (Basic) license. [...]

Microsoft has fixed the GIF functionality in the Emoji Panel for Windows 11 users after the provider shut down its service. [...]

CISA’s BOD 26-04 changes how federal agencies patch and how security leaders must measure, justify, and communicate cyber risk to executives and boards. Key takeaways BOD 26-04 requires agencies to make and defend risk-based vulnerability prioritization decisions, including decisions to defer vulnerability remediation. This accountability requirement transforms vulnerability management from a technical operation into a governance discipline that demands audit-ready documentation. Traditional vulnerability management KPIs (total vulnerabilities patched, mean time to patch, percentage of systems scanned) do not measure what BOD 26-04 demands. The metrics that matter are coverage breadth and risk-tier remediation rates. Tenable’s analysis of customer telemetry shows that monitoring coverage breadth is a stronger predictor of risk posture than patch speed, a finding independently corroborated by research showing organizations can remediate only about 10% of open vulnerabilities per month regardless of size or maturity. The directive’s reach extends beyond federal agencies to thousands of federal contractors who must align with BOD 26-04 through contract compliance requirements. Organizations in the federal supply chain should treat the directive as an operational requirement, not advisory guidance. The shift from patching metrics to risk exposure metrics is not a federal-only phenomenon. Industry reporting standards, insurance underwriting models, and board-level accountability expectations are converging on the same demand: prove that you are reducing actual risk, not just closing tickets. The reporting mandate hiding inside CISA Binding Operational Directive (BOD) 26-04 Most coverage of CISA BOD 26-04 has focused on the operational requirements: the four-variable model, the 16-tier remediation matrix, the three-day BOD 26-04 patching timeline with mandatory forensic triage. These are significant, and Tenable has covered them in depth in our FAQ on BOD 26-04 . But buried in the directive’s requirements is a less-discussed obligation that may prove equally transformative: agencies must demonstrate how they prioritize vulnerabilities and justify their decisions, particularly in cases where they decide to defer remediation. Metrics are expected to evolve from simple counts of patched vulnerabilities to measures that reflect reduction in high-risk exposure. This is not a minor procedural update. It is a fundamental shift in how cybersecurity programs are measured, reported, and held accountable. For CISOs and security leaders, BOD 26-04 doesn’t just change the patching workflow. While the BOD 26-04 directive formally targets federal agencies, its framework is rapidly becoming the blueprint for the private sector as market forces align around risk-based accountability. Ultimately, it changes what corporate boards of directors need to hear. Why traditional vulnerability management metrics fail under BOD 26-04 For years, security leaders have measured vulnerability management programs by volume: Total vulnerabilities identified Total patches applied Percentage of systems scanned within a 30-day window Mean time to remediate. These metrics are easy to collect, easy to report, and easy to trend over time, but they are also increasingly disconnected from actual risk. Tenable’s own analysis of customer telemetry across our global customer base confirms what many security leaders suspect but cannot prove: breadth of monitoring coverage is a more robust, predictive risk signal than patch velocity. Unmonitored assets exist as a permanently open attack surface; they cannot generate findings, be prioritized, or be verified as remediated. Conversely, monitored assets still pass through the risk pipeline even if remediation isn’t operating at maximum speed. Independent industry research heavily corroborates the need to shift reporting from patching speed to monitoring coverage: The remediation ceiling - The Cyentia Institute’s Prioritization to Prediction research (analyzing 3.6 billion vulnerability observations) found that the typical organization can only remediate roughly 10% of open vulnerabilities per month, regardless of size, industry, or maturity. Because you cannot out-patch the growth rate of your backlog, prioritization, not speed, is the only lever that meaningfully reduces risk. The MTTR flaw - Standard mean-time-to-remediate (MTTR) calculations exclude open, unremediated vulnerabilities, which skews your metrics toward items that are easier to close quickly, which may not be the most critical, severe, or highest-risk issues. Asset composition skew - Remediation half-lives vary wildly across asset types, averaging 36 days for Microsoft Windows systems versus 369 days for network appliances. A strong MTTR often just means you have good visibility into automatically patching Windows assets, but this KPI may hide persistent exposure on edge devices and OT systems. BOD 26-04 makes this explicit: remediation priority is determined by the risk posed by a vulnerability if exploited, not by the total number of vulnerabilities identified. The directive’s deferral tier (fix on system upgrade) formalizes what the data has always shown: most vulnerabilities can wait. The ones that cannot are defined by exploitation evidence, exposure, automation potential, and impact severity. A CISO who reports, “We patched 95% of critical CVEs this quarter,” is reporting a metric that BOD 26-04 has rendered insufficient. The relevant question is: Of the vulnerabilities that posed real-world risk to mission-critical systems, what percentage did we remediate within the directive’s timeline, and how much of our attack surface was under observation when we made that assessment? The new security metrics: What BOD 26-04 demands The shift from volume-based to risk-based reporting requires new KPIs. Organizations implementing BOD 26-04 should consider metrics that reflect the directive’s four-variable prioritization model: Remediation compliance by BOD tier. What percentage of vulnerabilities in each BOD tier (three-day forensic triage, three-day, 14-day, 60-day, system upgrade) are remediated within the applicable timeline? This is the core compliance metric. It replaces “mean time to remediate” with a risk-weighted measurement that distinguishes between a 3-day critical and a deferrable low-risk finding. Coverage of actively exploited vulnerabilities. What percentage of KEV -listed vulnerabilities in the environment are remediated? This measures the response to the most dangerous known threats, not the total vulnerability population. Exposure surface reduction over time. What is the trend in assets classified as publicly exposed (BOD Variable 1)? Reducing the number of internet-facing assets directly shifts vulnerabilities from compressed timelines to the deferral tier. Tenable’s analysis of the full CISA Vulnrichment corpus found that removing an asset from public exposure can shift 76.7% of its associated CVEs to longer remediation windows. This makes exposure reduction the single highest-leverage compliance investment. Additional independent research reinforces why assessment coverage is a better indicator of risk outcomes than patch velocity. Joint analysis from XM Cyber and the Cyentia Institute, examining more than 60 million exposures across 10 million entities, found that 75% of security exposures do not put critical assets at risk: they are dead ends in the attack graph. Only 2% of exposures sit on “choke points,” the convergence nodes through which multiple attack paths transit en route to critical assets. This corroborates Tenable’s telemetry finding from a different angle: if your monitoring does not cover the entities where those choke points exist, your remediation speed on the other 98% is noise in the risk signal. The metric that matters is not how fast you patch, but whether your visibility extends to the places where attack paths converge. Forensic triage completion rate. For vulnerabilities in the highest-risk tier (KEV + total control), what percentage received the required BOD 26-04 forensic triage guidelines within the three-day window? This measures compliance with the directive’s most novel and operationally demanding requirement. Deferral justification documentation rate. For vulnerabilities placed in the “fix on system upgrade” tier, what percentage have documented risk acceptance decisions? BOD 26-04 requires agencies to justify deferral decisions, which means every deferred vulnerability needs an auditable rationale. Mean time from KEV addition to remediation. How quickly does the organization respond when a CVE is added to the KEV catalog and its BOD timeline compresses? This measures the speed of the organization’s response to dynamic timeline changes. These metrics share a common characteristic: they measure risk reduction outcomes, not activity volume. A security program that patches fewer total vulnerabilities but remediates 100% of the 3-day tier within three days is performing better under BOD 26-04 than one that patches twice as many total CVEs but misses the critical timelines. The accountability requirement: Justifying decisions to defer vulnerability remediation BOD 26-04 introduces something federal vulnerability management has never had: a formal requirement to justify prioritization decisions. When an agency defers remediating a vulnerability to the next system upgrade cycle, that decision must be documented and defensible. This creates an audit trail requirement. For every deferred vulnerability, the organization needs to demonstrate: Which of the four variables were assessed What combination placed the vulnerability in the deferral tier Why the agency is confident the deferral does not create unacceptable risk If any of the four variables change (a CVE added to the KEV, an asset newly exposed to the internet), the deferral decision must be reassessed. For CISOs, this means the vulnerability management pro

The BlueHammer vulnerability (CVE-2026-33825) is a high-severity local privilege escalation flaw in Microsoft Defender that allows authorized local attackers to elevate privileges to SYSTEM by accessing the Security Account Manager (SAM) database. Initially exploited as a zero-day, it has now been confirmed by CISA to be actively exploited by ransomware gangs. Microsoft patched the vulnerability on April 14, 2026, and CISA has mandated federal agencies to apply the patch promptly. The flaw was publicly disclosed with proof-of-concept code by a security researcher in April 2026.

Microsoft has extended Windows Server 2022 hotpatching until October 2027, one year after the mainstream end date of October 2026. [...]

An intrusion was investigated that began with exploitation of CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM software. The threat actor obtained unauthorized technician access and deployed two previously undocumented malware samples: TaskWeaver and Djinn Stealer. TaskWeaver is a heavily obfuscated Node.js loader that establishes encrypted communications and delivers additional payloads. Djinn Stealer targets credentials across Windows, macOS, and Linux systems, collecting authentication data for cloud platforms, source control, package registries, AI development assistants, browsers, SSH keys, and cryptocurrency wallets. The attacker leveraged legitimate RMM capabilities to transfer files and execute commands across managed systems. Stolen AI assistant tokens provided extensive access to repositories, databases, and cloud accounts. The intrusion demonstrated how a single authentication bypass in trusted management infrastructure can enable widespread credential theft and p...

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates until October 12, 2027. [...]