All articles tagged with #windows security
A new ClickFix variant uses browser cache to bypass Windows Run character limits, while Ukrainian CERT-UA reports a surge in fake CAPTCHA attacks targeting Windows users via compromised sites.
Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, released a new proof-of-concept exploit called BigDiskBuster that prevents Microsoft Defender from installing platform and signature updates. The tool, published on September 19, 2026, works by filling available disk space to block update downloads on all supported Windows versions. While Defender remains active, its detection capabilities become stale. Microsoft has not issued a patch or CVE for this specific flaw, though it has addressed several other zero-days disclosed by Naceri in recent months. The exploit is part of an ongoing dispute between Naceri and Microsoft over his termination.
Microsoft’s September 2026 Patch Tuesday addresses 966 vulnerabilities across a wide range of products, including two zero-days. Flaws span .NET, ASP.NET Core, Windows components (DNS, Kerberos, HTTP.sys, Win32K, etc.), Office, Exchange Server, SQL Server, Azure services, PowerShell, Visual Studio, and more. Flaws include remote code execution, elevation of privilege, information disclosure, and denial-of-service vectors, with several critical issues affecting important attack surfaces. Organizations should apply these patches promptly to reduce risk from both the two zero-days and the large variety of other vulnerabilities disclosed.
Microsoft says Windows Security may display false ‘Defender is off’ alerts after Defender antivirus updates, even though Defender remains active. The issue affects all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025, and can appear at startup or intermittently. A fix will be released in a future Defender Antivirus update, with Microsoft noting similar post-update alert bugs have occurred previously.
A security researcher found that some Meccha Chameleon Steam Workshop maps secretly execute malware by auto-running a hidden batch file that launches a PowerShell script and attempts to fetch a second script from an external server. Valve has been alerted, and infected maps may be removed. To protect yourself, avoid downloading Meccha Chameleon maps from unknown Workshop pages, run antivirus scans, and check your Documents folder for suspicious .bat files.
Microsoft released patches for two Defender zero-days—CVE-2026-41091 (privilege escalation in Malware Protection Engine) and CVE-2026-45498 (DoS in Antimalware Platform)—to stop active exploits. The updates install automatically by default, but admins should verify the Malware Protection Engine and Antimalware Platform versions are current. CISA added these flaws to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by June 3 under BOD 22-01. The piece also notes mitigations for a Windows BitLocker flaw nicknamed YellowKey.
Docker Desktop patched a critical security flaw (CVE-2025-9074) that allowed containers to break out and control the host system, especially on Windows where Docker runs via WSL2, by exposing an open Engine API on a TCP port. The vulnerability could let malicious containers access or modify host files, escalate privileges, and compromise system security. Users are advised to update to version 4.44.3 immediately to close the exposed API and prevent potential attacks.
Ransomware is a serious threat, but Windows includes built-in protections through its Microsoft Defender antivirus software, which can be enabled by following a few steps in the Windows Security app. By turning on Controlled folder access and ensuring you're logged into OneDrive for automatic backups, you can add an extra layer of defense against ransomware attacks. While these measures may cause some inconvenience, they can significantly enhance the security of your files. Additionally, considering other antivirus software options and maintaining offline backups are recommended for comprehensive protection against online threats.
The hacking group TA577 has shifted to using phishing emails to steal NTLM authentication hashes, targeting employees in organizations worldwide. These hashes can be used for offline password cracking or "pass-the-hash" attacks, potentially enabling attackers to escalate privileges, hijack accounts, access sensitive information, and move laterally within a breached network. The phishing emails contain unique ZIP archives with HTML files that trigger automatic connections to steal the NTLM hashes. Security measures such as multi-factor authentication, firewall configurations, email filtering, and Windows 11 security features can help mitigate these attacks.
Ransomware is a serious threat, but Windows users can activate built-in protection through Microsoft Defender by enabling Controlled folder access and ensuring they are logged into OneDrive for automatic backups. While this may cause some inconvenience, such as blocking access to certain folders, it provides an additional layer of defense against ransomware attacks. Users can also consider upgrading their antivirus software for more comprehensive protection.
Threat actors are exploiting a patched security flaw in Microsoft Windows, CVE-2023-36025, to deploy Phemedrone Stealer, an open-source information stealer targeting web browsers, cryptocurrency wallets, and messaging apps. The flaw allows attackers to bypass Windows Defender SmartScreen by tricking users into clicking on malicious Internet Shortcut files, leading to the execution of a control panel file that ultimately downloads and executes the stealer. Despite being patched, threat actors continue to find ways to exploit the vulnerability and evade protections, highlighting the need for ongoing vigilance in cybersecurity.
Zero-day vulnerabilities in the Windows Installers for Atera's remote monitoring and management software have been discovered, posing a risk of privilege escalation attacks. The flaws, assigned CVE-2023-26077 and CVE-2023-26078, have been patched in Atera versions 1.8.3.7 and 1.8.4.9. The vulnerabilities allow for the execution of arbitrary code with elevated privileges and involve misconfigured Custom Actions running as NT AUTHORITY\SYSTEM. Exploitation of these weaknesses could lead to local privilege escalation attacks.