Defender Update Archives

Winsage

September 8, 2025

Windows Defender Vulnerability Allows Service Hijacking and Disablement via Symbolic Link Attack

A vulnerability in the Windows Defender update process allows users with administrator privileges to disable the security service and manipulate its files. This flaw enables attackers to create a symbolic link (symlink) with a higher version number that redirects the Defender service to a folder they control. The attacker can then execute malicious actions, such as introducing harmful code or deleting executable files, effectively disabling the service and exposing the system to threats.

Winsage

August 18, 2025

Latest Windows update is borking storage drives for some users

Recent updates for Windows 11 and Windows 10 have caused significant stability issues linked to a bug in the Microsoft Defender update, making some solid-state drives (SSDs) and hard drives (HDDs) unreadable. The issue was first reported by a user on Twitter and affects drives that contain the Windows operating system, leading to potential system failures. The problem is particularly prevalent in the latest 24H2 versions of Windows 11 and several updates for Windows 10. It appears to be associated with certain drives using a specific NAND controller from Phison. The bug is triggered during heavy write sessions to NVMe SSDs and HDDs, especially when writing or backing up data exceeding 50 gigabytes. The range of affected drive models is unclear, and users are uncertain about potential solutions, including firmware updates.

Winsage

August 18, 2025

Windows 11 24H2 Security Update Causes SSD/HDD Failures and Potential Data Corruption

A significant security update from Microsoft, Windows 11 24H2 (KB5063878), is causing issues for users, making SSDs and HDDs inaccessible and potentially corrupting user data. Users have reported installation failures with error code 0x80240069, and despite a hotfix, the update has led to storage drives disappearing from the Windows environment, particularly during large sequential write operations. Recovery attempts are often unsuccessful, putting user files at risk. Microsoft has not provided an official fix, and users are advised to avoid the update and ensure routine data backups. Unplugging and reconnecting the affected drive may temporarily restore visibility but does not guarantee data safety.

Winsage

May 26, 2025

Microsoft releases an update to tackle a built-in issue in Windows images, but who is it for?

Microsoft encourages users to adopt the latest version of Windows or a version eligible for monthly security updates to protect against security threats. Older Windows ISOs are vulnerable due to outdated security updates and antimalware software. Microsoft has released an update for Microsoft Defender to enhance the security of these older Windows images. This update includes the latest Microsoft Defender binaries, which must be applied offline to WIM and VHD files for Windows 11, Windows 10 (Enterprise, Pro, Home), Windows Server 2022, 2019, and 2016. The update improves both the anti-malware client and engine, with package sizes of 78.2 MB for ARM64, 128 MB for x86, and 132 MB for x64 systems. Users need a 64-bit version of Windows 10 or later, PowerShell 5.1 or later, and specific modules to implement the update. Regular updates every three months are recommended for optimal security.

Winsage

August 12, 2024

Microsoft quietly updated Defender for Windows 11/10/Server install images

Microsoft has released several updates to enhance the security and performance of its Windows operating systems, including KB5001716 to enforce updates on Windows PCs and updates KB5041979 and KB5041178 for Windows 11 24H2. A new Defender update has been introduced for Windows installation images in WIM and VHD formats, applicable to Windows 11, Windows 10, and various server editions, including Server 2016. This update addresses vulnerabilities from outdated anti-malware definitions and software binaries in older installation images. The latest security definitions are delivered through security intelligence update version 1.413.494.0, with Defender package version 1.413.494.0. The update improves the anti-malware client, engine, and signature versions, specifically: platform version 4.18.24060.7, engine version 1.1.24060.1, and security intelligence version 1.413.494.0. The security intelligence update enhances threat detection against various types of malicious software, with the latest intelligence update being version 1.417.71.0.