Tag

Microsoft Patch Tuesday

All articles tagged with #microsoft patch tuesday

security2 days ago•1 min saved

Microsoft Patches 1,259 Flaws, Including Actively Exploited Outlook Bug Leaking NTLMv2 Hashes

Microsoft released patches for 1,259 vulnerabilities in November 2026, including a Moderate-severity Outlook flaw (CVE-2026-124194) actively exploited in the wild. The bug allows unauthenticated attackers to spoof network connections via crafted email files, potentially exposing NTLMv2 hashes for user impersonation. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 24, 2026.

via The Hacker News|

#cisa-kev #cve-2026-124194 #microsoft-patch-tuesday

security2 months ago•15 min saved

Record 974-Patch Tuesday, LG TV Surveillance, and 150M ID Breach Define September Security Landscape

Microsoft’s September 2026 Patch Tuesday fixed a record 974 vulnerabilities, including two actively exploited zero-days, amid a broader industry surge in AI-assisted bug discovery. Simultaneously, Gamers Nexus revealed extensive data harvesting by LG smart TVs, while a breach of ID validation firm IDScan exposed 150 million U.S. driver’s license scans. Supply chain threats resurfaced with the return of the Shai-Halud NPM worm, and Adobe confirmed active exploitation of a critical Magento flaw. Boston Scientific continues to recover from a ransomware attack, and Microsoft announced plans to block unpatched Exchange servers from sending cloud emails.

via Hackaday|

#adobe-commerce-exploitation #idscan-breach #lg-smart-tv-privacy

cybersecurity3 months ago•3 min saved

Lazarus Weaponizes Windows Zero-Day in Global Defense Espionage Campaign

North Korea's Lazarus Group exploited a newly patched Windows zero-day vulnerability to gain SYSTEM-level access and deploy backdoors against defense and aerospace firms in Europe, Brazil, and India. The attack, part of the long-running 'Operation Dream Job,' uses fake job offers and trojanized PDF viewers to bypass security controls. CISA ordered federal agencies to patch the flaw by August 25, 2026, as it was the only confirmed actively exploited vulnerability in Microsoft's August Patch Tuesday release.

via The Hacker News|

#cisa #cve-2026-68820 #cybersecurity

cybersecurity3 months ago•2 min saved

Lazarus Group Weaponizes Windows Zero-Day in Global Defense Sector Campaign

North Korea’s Lazarus Group exploited a Windows zero-day vulnerability (CVE-2026-68820) to target defense, aerospace, and aviation firms in Europe, India, and South America. The attack, part of the 'Operation Dream Job' campaign, used fake job offers to deliver malware, including a new backdoor named Troy and an updated FudModule rootkit. Microsoft patched the flaw in August 2026, while attackers also compromised Roundcube servers using a new web shell called RelayShell.

via bleepingcomputer.com|

#check-point-research #cve-2026-68820 #cybersecurity

security3 months ago•3 min saved

North Korea Exploits Windows Zero-Day in New 'Dream Job' Campaign Amid 421-Patch Surge

Microsoft patched 421 vulnerabilities in its August 2026 release, including a zero-day in the Windows Ancillary Function Driver (afd.sys) actively exploited by North Korea’s Lazarus Group. The flaw, CVE-2026-68820, allows local privilege escalation to SYSTEM level and was used in the 'Operation Dream Job' campaign targeting defense sectors in Europe and India. While the patch volume is high due to AI-assisted discovery, experts warn that only one bug is confirmed exploited, urging prioritized rather than rushed deployment.

via The Register|

#ai-vulnerability-discovery #cve-2026-68820 #lazarus-group

technology3 months ago•0 min saved

Microsoft's August Patch Tuesday Fixes 421 Flaws, Including a Zero-Day Exploited by North Korea's Lazarus Group

Microsoft released its August 2026 security updates, fixing 421 vulnerabilities, including a zero-day in the Windows kernel driver afd.sys that is under active exploitation by North Korea's Lazarus Group. The release also addresses four critical, unauthenticated remote code execution flaws in Windows services and completes a two-part fix for a SharePoint chain. While AI has accelerated vulnerability discovery, experts emphasize that patching remains a human-centric process requiring careful testing and prioritization based on exploit status and service reachability.

via The Hacker News|

#cve-2026-68820 #lazarus-group #microsoft-patch-tuesday

cybersecurity3 months ago•2 min saved

Microsoft Patches 398 Flaws, Including Zero-Day Exploited by North Korea's Lazarus Group

Microsoft released its August 2026 Patch Tuesday updates, addressing 398 vulnerabilities across Windows and other software. The release includes a critical zero-day, CVE-2026-68820, which is under active exploitation by North Korea's Lazarus Group. While AI has accelerated the discovery of these flaws, experts warn that automated patching remains unreliable, requiring human oversight to ensure fixes do not introduce new weaknesses.

via Krebs on Security|

#ai-vulnerability-discovery #cve-2026-68820 #cybersecurity