Threats Tagged 'windows'

Microsoft announced it will deprecate the Windows Deployment Services (WDS) server role starting with the next Windows Server release. [...]

Researchers demonstrated that file-change notification systems in Windows, Linux, Android, and macOS can be exploited to leak user activity such as keystroke timing, browsing habits, and media events without elevated privileges. The attacks rely on monitoring file system events accessible to unprivileged users or apps, revealing metadata like file names and event timing rather than file contents. On Windows, monitoring the system drive root can expose file paths in other users' profiles, enabling website fingerprinting. Linux kernel mitigations partially address the most severe issues, but no patches exist for Android or macOS. Microsoft considers the behavior by design and not a vulnerability. No in-the-wild exploitation is known, and proof-of-concept code is publicly available.

Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates. [...]

Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates. [...]

The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]

Microsoft warned that the September 2026 security updates may also break Always On VPN connections on some Windows 11 systems. [...]

ClosedQuorum is a newly identified Windows malware that leverages multiple AI models, including Google Gemini, DeepSeek, Qwen, and Mistral, to autonomously decide its actions during the post-compromise phase of an attack. This AI-driven approach allows the malware to adapt its behavior dynamically based on the environment and objectives. No specific affected software versions or exploitation details have been provided. There is no known exploit in the wild at this time, and no patch or remediation guidance is available.

CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek, Qwen, Mistral, and Google Gemini. The system operates through plurality voting among AI models to select actions for credential harvesting and crypto wallet theft, eliminating the need for continuous human operator involvement. The 16.4MB Go-compiled executable employs structured JSON schema to constrain LLM responses to executable attack choices. While containing placeholder credentials in public distribution, development builds demonstrate compile-time injection of operator-specific API keys and Discord webhooks. This architecture represents a significant shift toward effort displacement in cyber operations, where entire attack phases execute autonomously without human bottlenecks, though introducing new dependencies on commerci...

Microsoft has issued a warning that the File History backup feature in Windows may stop functioning on some systems after applying the September 2026 security updates. This issue affects the reliability of the built-in backup mechanism but does not indicate a security vulnerability or exploit. No specific affected versions or patch information have been provided.

Microsoft announced that Windows 11 version 24H2 Home and Pro editions will reach end of support on October 13, 2026. After this date, these editions will no longer receive security or non-security updates, including protections against the latest security threats. Customers are advised to upgrade to Windows 11 version 25H2 to continue receiving updates. Enterprise and Education editions of Windows 11 24H2 remain supported until October 2027. Systems not managed by IT will automatically upgrade to 25H2, with user control over restart timing.