escalation Archives

Winsage

August 16, 2026

LeakWatch CW 33/2026: Windows Zero-Day, AMD, Intel and Malware

- The August Patch Tuesday release included 421 vulnerabilities, with 236 affecting Windows, highlighting CVE-2026-68820, a critical use-after-free vulnerability that allows privilege escalation to SYSTEM level without user interaction. - CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation. - AMD's Ryzen Master software has vulnerabilities, including CVE-2025-54512 (DLL hijacking) and CVE-2026-0465 (use-after-free), which could allow code execution with elevated privileges. - AMD's advisory on CVE-2026-6726 and CVE-2026-6727 indicates vulnerabilities in the TPM 2.0 reference code affecting Ryzen platforms, leading to potential information disclosure. - Intel's advisories included updates for microcode, Wi-Fi software, and NPU drivers, with CVE-2026-20760 addressing privilege escalation risks. - Google’s Chrome update on August 11 fixed five high-severity vulnerabilities, including use-after-free flaws. - Gunra malware has evolved into a ransomware-as-a-service model using a double-extortion strategy. - WindRelay malware combines SpyNote RAT with an NFC relay component, allowing attackers to relay NFC communication between a victim's bank card and a remote device. - The findings emphasize the need to view vulnerabilities as part of potential attack chains, highlighting the complexity of modern cybersecurity threats.

Winsage

August 13, 2026

Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

Nightmare Eclipse has released a new zero-day exploit called ShieldBreak, which can bypass Microsoft's RoguePlanet patch (CVE-2026-50656) and allow attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit has been confirmed by security expert Kevin Beaumont, who provided detection methods for it. ShieldBreak is the tenth zero-day from Nightmare Eclipse since April and was released shortly after Microsoft's monthly Patch Tuesday. The exploit allows local privilege escalation and has a 100% success rate on the latest version of Windows 11 and Windows Server 2025, while Windows 10 remains vulnerable. Microsoft is aware of the vulnerability and is investigating it, emphasizing the importance of coordinated vulnerability disclosure. Previous exploits from Nightmare Eclipse include LegacyHive and GreatXML, with earlier vulnerabilities having been patched but recent ones still unaddressed. Microsoft had threatened legal action against Nightmare Eclipse in May but later reconsidered its approach to vulnerability disclosure.

Winsage

August 13, 2026

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

Security researcher Nightmare Eclipse has released a zero-day exploit named ShieldBreak that allows privilege escalation on Windows by targeting a vulnerability in Microsoft Defender. This exploit, designated as CVE-2026-50656, is categorized as a race condition vulnerability and affects the latest versions of Windows 11 and Windows Server 2025, with potential impacts on Windows 10. The exploit was disclosed on June 9, 2026, and Microsoft acknowledged the issue on June 16, rolling out fixes by July 9. The mechanics of ShieldBreak involve manipulating Defender’s scan path and executing a scheduled task to gain System-level privileges. Experts have noted differences between ShieldBreak and the previously known RoguePlanet exploit, emphasizing that ShieldBreak requires Defender to be active to function.

Winsage

August 12, 2026

Microsoft fixes 421 bugs and a Windows zero-day in August Patch Tuesday

Microsoft's August Patch Tuesday update addressed 421 vulnerabilities across various products, including multiple versions of Windows (11 25H2/24H2, 11 23H2, and 10). A critical zero-day flaw, the "Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability," allows attackers with lower-level access to gain system privileges without user interaction. Additionally, the update addresses two other zero-day flaws, including the "Windows User Profile Service Elevation of Privilege Vulnerability," which has not yet been exploited but was publicly disclosed. The update is mandatory and should automatically install on supported PCs, with users encouraged to verify its application. The update also includes minor improvements to Windows features, such as enhancements to File Explorer, Windows Hello, Voice Access, and touchpad controls.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

Winsage

August 12, 2026

Microsoft Windows 0-Day Attack Deploys Lazarus Rootkit—Patch Now

Microsoft released a patch for a zero-day vulnerability, CVE-2026-68820, which is being exploited by cybercriminals, specifically the North Korean hacking group Lazarus. This vulnerability allows unauthorized attackers to elevate their privileges locally, posing a significant risk to affected systems. The August 2026 Patch Tuesday update addressed 421 vulnerabilities, including three zero-days, with CVE-2026-68820 being the only one confirmed to be actively exploited. The vulnerability's impacts on confidentiality, integrity, and availability are rated as High. Users of Microsoft Windows 10, Windows 11, and various versions of Windows Server should prioritize deploying the patch for this vulnerability.

AppWizard

August 12, 2026

Russia charges Telegram CEO Pavel Durov with aiding terrorism

Russian authorities have charged Pavel Durov, the founder and CEO of Telegram, with aiding terrorism and placed him on an international wanted list. The Federal Security Service (FSB) alleges that Telegram facilitates criminal activities and operations related to Ukrainian intelligence, classifying it as a facilitator of "acts of sabotage and terrorism, mass murder, and cyber fraud." Instead of targeting the platform with fines or restrictions, Russian authorities are pursuing Durov personally. If convicted in Russia, he faces the possibility of life imprisonment. This case reflects a broader trend of governments holding technology executives accountable for content and activities on their platforms, with similar legal pressures observed on other platforms like Meta, TikTok, Snap, and YouTube.

Winsage

August 6, 2026

What Happens To Your Computer If You Skip Windows Updates

Windows operating systems have hidden functionalities and privacy enhancements introduced through regular updates, which are crucial for maintaining system security. Neglecting updates leaves known vulnerabilities open to exploitation by malicious actors, as Microsoft typically addresses security flaws only after they are identified. Windows Update is the primary mechanism for addressing these vulnerabilities. Unpatched systems become targets for cyber threats, leading to severe consequences such as remote code execution, privilege escalation, ransomware attacks, and boot-level compromises. The PrintNightmare vulnerability (CVE-2021-34527) was acknowledged by Microsoft after active exploitation was detected, leading to the release of patches. The WannaCry cyberattack in May 2017 affected over 300,000 computers due to an unpatched SMB flaw, highlighting the risks of outdated systems. Timely updates can prevent vulnerabilities that may lead to ransomware, credential theft, and other compromises. Users are advised to install updates promptly and avoid connecting unsupported versions to the internet.

AppWizard

July 31, 2026

Russia Designates Telegram Founder Pavel Durov As A ‘Terrorist’

Pavel Durov, the founder of Telegram, was designated as a "terrorist" and "extremist" by Russia's FSB on July 29, ahead of parliamentary elections in September, due to claims that Ukrainian intelligence services extensively use Telegram. Durov, who has dual citizenship in France and the UAE, publicly expressed defiance against this classification by sharing content emphasizing "freedom of expression." This designation aligns him legally with Aleksei Navalny, though it does not extend to the Telegram platform itself. Telegram remains popular in Russia despite regulatory challenges and has been used by Russian intelligence services. Durov has resisted government pressure to allow access to the app's security infrastructure. The FSB is attempting to tighten control over Telegram, but its significance for political mobilization complicates these efforts. Additionally, Durov faces legal threats in Europe related to content moderation on Telegram.

AppWizard

July 30, 2026

Russia accuses Telegram CEO Pavel Durov of aiding terrorism in its latest digital crackdown

Russian authorities have charged Pavel Durov, the founder and CEO of Telegram, with aiding terrorism, amid a crackdown on online freedoms since Russia's invasion of Ukraine in 2022. The Federal Security Service (FSB) accused Telegram of failing to remove channels used by Ukrainian intelligence and extremist groups, leading to human casualties. Durov, residing abroad, is on international wanted lists and could face a life sentence if convicted. Telegram has over 1 billion global users and has not commented on the charges. Under President Putin, Russia has enforced strict internet censorship, banning major social media platforms and blocking messaging apps like Signal and Viber. Despite restrictions, many Russian officials still use Telegram. Durov was also arrested in Paris in 2024 for allegedly allowing illicit activities on the platform, and he remains under investigation in France. Additionally, Russia has been accused of using Telegram for its own recruitment efforts related to sabotage.