corruption

Winsage
June 11, 2025
The second Tuesday of each month is when Microsoft releases monthly security updates for Windows. A significant zero-day vulnerability, CVE-2025-3052, has been identified, affecting all Windows users and allowing a Secure Boot bypass. This vulnerability could compromise system integrity by enabling malware to infiltrate Windows PCs and servers. CVE-2025-3052 is classified as a memory corruption issue within a module signed with Microsoft’s third-party UEFI certificate and can execute unsigned code during the boot process, potentially allowing attackers to install bootkits.
Winsage
June 11, 2025
Microsoft's June updates address a significant vulnerability identified as CVE-2025-3052, which allows attackers to gain control over a PC via bootkit malware by bypassing the Secure Boot feature. This memory corruption issue enables unsigned code to run during the boot process, compromising the system's chain of trust. The vulnerability allows an attacker to sign a compromised UEFI application with Microsoft’s third-party certificates, granting it unrestricted execution rights. Although the flaw has not been exploited in real-world scenarios, it has been present since late 2022. Microsoft has released a patch for this flaw, and users of Windows 10 or 11 are advised to download the latest updates to protect their PCs. Additionally, June's Patch Tuesday addressed a total of 66 weaknesses, including another Secure Boot flaw (CVE-2025-4275) and a zero-day vulnerability (CVE-2025-33053).
Winsage
June 11, 2025
Microsoft has announced a significant update addressing 66 vulnerabilities, including a zero-day vulnerability disclosed on the same day. Ten critical patches have been identified, with two currently being exploited. Microsoft is also patching older platforms like Windows Server 2008 and Internet Explorer. One critical vulnerability, CVE-2025-33053, has been exploited by the Stealth Falcon hacking group since March, allowing remote code execution via the WebDAV extension. Another critical vulnerability, CVE-2025-5419, affects the Chromium V8 JavaScript engine in Microsoft Edge. CVE-2025-33073 is an escalation of privilege vulnerability in the Windows SMB Client, with a CVSS score of 8.8. Four critical vulnerabilities in Microsoft Office include CVE-2025-47162, CVE-2025-47164, CVE-2025-47167, and CVE-2025-47953. Four critical remote code execution vulnerabilities include CVE-2025-47172, CVE-2025-29828, CVE-2025-32710, and CVE-2025-33071. Two elevation-of-privilege flaws are CVE-2025-47966 and CVE-2025-33070. Adobe has prioritized fixes for Adobe Commerce and Adobe's Experience Manager, addressing 254 CVEs. Adobe Acrobat users will receive ten fixes, including four critical ones. Fortinet has patched CVE-2023-42788 in FortiAnalyzer 7.4. SAP resolved 14 issues, with CVE-2025-42989 being the only critical patch, associated with the NetWeaver Application Server and a CVSS score of 9.6.
AppWizard
June 4, 2025
June 2025 will feature several significant gaming events and PC game releases. Key dates include: - June 4: PlayStation's 40-minute State of Play showcase. - June 6: Summer Game Fest main showcase. - June 7: Latin American Games Showcase and Future Game Show. - June 8: Xbox Games Showcase and The Outer Worlds 2 Direct, along with the PC Gaming Show. - June 9: Black Voices in Gaming showcase. - June 9-16: Steam Next Fest, leading into the Steam Summer Sale starting June 26. Notable game releases in June include: - June 5: Deltarune Chapters 3 & 4 and Rune Factory: Guardians of Azuma. - June 10: MindsEye. - June 11: Stellar Blade. - June 13: Five Nights At Freddy's: Secret of the Mimic. - June 16: Gex Trilogy. - June 17: FBC: Firebreak, Date Everything!, and Shadowverse: Worlds Beyond. - June 19: Broken Arrow. - June 20: BitCraft Online and Gold Gold Adventure Gold. - June 26: Persona 5: The Phantom X. - Dates TBD: Cast n Chill and Hell Clock.
Winsage
May 31, 2025
A new strain of malware has been operating undetected on Windows systems for several weeks, utilizing advanced evasion techniques that corrupt its Portable Executable (PE) headers to avoid detection. Security researchers discovered this malware embedded in the memory of a compromised system during an investigation, using a 33GB memory dump that revealed its presence in a dllhost.exe process with process ID 8200. The malware, classified as a Remote Access Trojan (RAT) by Fortinet, employs batch scripts and PowerShell commands for its attack and has capabilities for screenshot capture, remote server functionality, and system service manipulation. Its command and control infrastructure uses encrypted communications, complicating detection efforts. The malware's distinctive feature is the deliberate corruption of DOS and PE headers, which hinders reverse engineering and complicates the reconstruction of the executable from memory dumps. Researchers had to manually locate the malware’s entry point and resolve complex import tables for it to function in a controlled environment.
Winsage
May 30, 2025
Microsoft's recent Patch Tuesday update for Windows 11 has faced significant issues, particularly affecting users on versions 22H2 and 23H2. The installation of the May 13 update is failing on some machines, especially in virtual environments, leading to recovery mode entries and boot errors. Users are advised to avoid the update temporarily. The error message indicates a problem with the ACPI.sys file, which is crucial for managing hardware resources. Windows 11 Home and Pro users are likely unaffected, as virtual machines are typically used in enterprise settings. Microsoft has not provided the number of impacted users or a workaround beyond uninstalling the patches, but engineers are working on a resolution. This incident follows previous patching challenges faced by Microsoft this year, including an emergency update for Windows 10 and issues with Remote Desktop sessions in earlier updates.
Winsage
May 28, 2025
File Explorer in Windows 11 has usability issues, particularly with sluggish search functionality and problems accessing networked drives. Users often experience drives disappearing after reboot, inaccessibility to files, and freezing of File Explorer, with error codes like c0000375 indicating deeper issues. The networked drive feature relies on outdated technology, as Microsoft has deprecated older protocols like SMBv1, complicating file sharing. Users can mitigate freezing by restarting File Explorer and ensuring network settings are correctly configured, such as setting Wi-Fi to private and enabling file sharing options. Excessive pinned items in Quick Access can cause crashes, and clearing the cache may resolve these issues. Alternatives to File Explorer, like XYplorer and File Pilot, can provide better access to networked drives. Overall, the challenges stem from outdated technology and the corruption of the Quick Access cache, with third-party solutions available for relief.
Search