code execution Archives

Winsage

July 18, 2026

Windows 11’s massive July 2026 update fixes 570 vulnerabilities and shows how AI is quietly reshaping Patch Tuesday itself

Microsoft's July 2026 Patch Tuesday update for Windows 11, identified as KB5101650, addresses 570 vulnerabilities and upgrades Windows 11 to version 25H2 (build 26200.8875) and version 24H2 (build 26100.8875). The update includes critical fixes for BitLocker and File Explorer, targeting vulnerabilities that could enable remote code execution. Microsoft's MDASH tool, which uses AI for vulnerability analysis, has helped uncover 16 vulnerabilities in networking and authentication components. The update also introduces non-security enhancements like Point-in-time restore and improved Bluetooth reliability. Microsoft emphasizes the need for users to install updates quickly due to the rapid evolution of AI technology that benefits malicious actors.

Winsage

July 16, 2026

Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

A security researcher known as Nightmare Eclipse has revealed a new unpatched vulnerability in Windows, named LegacyHive, which is a local privilege escalation flaw in the Windows User Profile Service. This vulnerability allows attackers to access and load user hives of other accounts, including administrators. Nightmare Eclipse has provided proof-of-concept exploit code that works on systems with Microsoft's July 2026 patches. The exploit initially did not require user credentials but now necessitates them for accessing other hives. Nightmare Eclipse has previously disclosed over half a dozen zero-day vulnerabilities affecting Microsoft products. Microsoft has not yet acknowledged the LegacyHive exploit.

Winsage

July 16, 2026

Windows Netlogon Flaw CVE-2026-41089: CVSS 9.8 [2026]

CVE-2026-41089 is a critical vulnerability in the Windows Netlogon service, rated 9.8 on the CVSS scale, allowing unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on domain controllers. It affects all supported versions of Windows Server configured as domain controllers, from Windows Server 2012 R2 to the latest release. Microsoft addressed this vulnerability on May 12, 2026, during a broader update that included 138 fixes, but it went largely unnoticed until early June when active exploitation was confirmed. The vulnerability is characterized as a stack-based buffer overflow and is considered "wormable" due to its ability to self-propagate across systems without user intervention. Organizations are advised to patch all domain controllers and audit network access to mitigate exposure.

Winsage

July 16, 2026

Microsoft’s July patches fix over 600 flaws, shattering last month’s record

Microsoft has released its July 2026 Patch Tuesday updates, addressing 570 new security vulnerabilities, bringing the total for the month to over 620. The cumulative count of vulnerabilities patched this year has reached 1,380, exceeding the total of 1,250 for the entire year of 2020. Over 400 vulnerabilities are related to various versions of Windows, and the Windows 10 Extended Security Update program has been extended until October 12, 2027. Notable vulnerabilities include CVE-2026-56155 in Active Directory Federation Services, which allows attackers to gain administrator rights, and several critical Remote Code Execution vulnerabilities, including CVE-2026-57092 in Hyper-V and CVE-2026-56190 in Remote Desktop Protocol. Microsoft has also patched 97 vulnerabilities in Office products, with 17 classified as critical RCE vulnerabilities, and four vulnerabilities in Exchange Server, including CVE-2026-55008. The latest Microsoft Edge update addresses 27 vulnerabilities related to Chromium, and a vulnerability in Minecraft Bedrock servers has been patched.

Winsage

July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

Winsage

July 14, 2026

Microsoft Just Patched a Record 570 Flaws in Windows

Microsoft's July Patch Tuesday update addresses 570 vulnerabilities, including three critical zero-days. The vulnerabilities include 254 elevation-of-privilege flaws, 17 security feature bypasses, 145 remote-code-execution issues, 102 information disclosures, 16 spoofing vulnerabilities, and 35 denial-of-service vulnerabilities. Among these, 59 bugs are classified as "critical." The three zero-days patched are CVE-2026-56155 (elevation of privilege in Active Directory Federation Services), CVE-2026-56164 (elevation of privilege in Microsoft SharePoint Server), and CVE-2026-50661 (security bypass in Windows BitLocker). The update is recommended to be installed as soon as possible, and users can check for updates through the Windows Update settings.

Winsage

July 14, 2026

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Microsoft's July 2026 security update addresses 622 vulnerabilities, with 57 classified as "critical." Two critical vulnerabilities, CVE-2026-56155 (Active Directory Federation Services) and CVE-2026-56164 (Microsoft SharePoint Server), have been exploited in the wild. The critical vulnerabilities include 48 remote code execution (RCE) vulnerabilities, seven elevation of privilege (EoP) vulnerabilities, one spoofing vulnerability, and one security feature bypass vulnerability. RCE vulnerabilities affect various Microsoft services, including Windows Media, Microsoft Office, and SQL Server, with eleven rated as "more likely" to be exploited. Additional important vulnerabilities include CVE-2026-49170, CVE-2026-49795, and CVE-2026-50325. Talos is releasing a new Snort ruleset to detect these vulnerabilities, and Cisco Security Firewall customers are advised to update their ruleset.

Tech Optimizer

July 11, 2026

Microsoft closes RoguePlanet vulnerability in Defender: SYSTEM privileges via the antivirus engine

A vulnerability known as RoguePlanet was identified in Microsoft Defender, tracked as CVE-2026-50656. This flaw allows local privilege escalation to the NT AUTHORITYSYSTEM account, requiring an attacker to have local code execution capabilities. It can be exploited through methods such as opening malicious email attachments. The vulnerability is categorized under CWE-59: “Improper Link Resolution Before File Access” and involves a race condition that affects the Defender engine's operations. RoguePlanet was disclosed by security researcher Nightmare-Eclipse on June 10, 2026, and confirmed by various security firms. Microsoft released a fix in version 1.1.26060.3008 of the Microsoft Malware Protection Engine, which should be installed automatically in standard Windows configurations. Users can verify their engine version using PowerShell. The vulnerability affects both Windows 10 and Windows 11 systems with the June 2026 security updates, and disabling real-time protection does not reliably mitigate it.

Winsage

July 4, 2026

Ex-Microsoft engineer rebuilds Notepad in 2.5KB using nothing but stuff Windows already had

Dave Plummer, a former Microsoft engineer, is recreating Notepad in 2.5 kilobytes with a project called TinyRetroPad, which includes features like Open, Save, Find and Replace, printing, font selection, word wrap, and unsaved changes prompt. TinyRetroPad leverages existing Windows infrastructure, utilizing built-in resources to function efficiently. It is based on Matt Power’s Dave’s Tiny Editor and operates as a wrapper around RICHEDIT50W. The size of TinyRetroPad increased with each feature added, reaching 2,476 bytes with printing. The project uses Crinkler, a compression linker, to optimize the executable. TinyRetroPad currently lacks a dedicated Releases page and may trigger false positives from antivirus software. Users have reported issues such as excessive memory usage and compatibility problems with older Windows versions. In contrast, the modern Notepad in Windows 11 has grown to approximately 352KB, with a total disk footprint nearing 5MB, leading to user backlash over its complexity. Windows 11 LTSC retains the classic Notepad, while TinyRetroPad aims to demonstrate the potential of leveraging existing OS capabilities rather than adding unnecessary features.