exploitation Archives

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Winsage

July 23, 2026

Windows 10 has almost three times as many active vulnerabilities as Windows 11, according to researchers

Windows 11 is installed on 78.8% of Windows computers, while 16.9% of users remain on Windows 10. Microsoft ended support for Windows 10 in October 2025, with an extension until 2027. Windows 10 has 1,903 active Common Vulnerabilities and Exposures (CVEs), 2.9 times more than Windows 11, which has 652 CVEs. Of the active CVEs on Windows 10, 66.6% are classified as high or critical risk, with 2.4% actively exploited. Small businesses show the most significant lag in upgrading, with 21.4% still using Windows 10, while two-thirds of large enterprises have moved to Windows 11. The cost of upgrading is a primary barrier for smaller companies.

Winsage

July 22, 2026

One in six Windows PCs still runs Windows 10, and the vulnerabilities are piling up

Approximately 17% of all Windows client devices are still running Windows 10, equating to about one in six machines. Windows 11 accounts for 78% of Windows devices, with third-party trackers indicating it surpassed 70% of desktop share as of February 2026. Official support for Windows 10 ended in October 2025, but Microsoft’s Extended Security Updates (ESU) program will provide patches until October 2027 for eligible devices. A typical Windows 10 device has an average of 1,903 active security vulnerabilities, nearly three times the 652 CVE-tracked flaws found on a Windows 11 machine. 66% of Windows 10 vulnerabilities are classified as "high" or "critical." Small and medium enterprises have 21.4% of their Windows devices still on Windows 10, while larger enterprises have 16.6%. The healthcare and pharmaceuticals sectors have 23% of devices on Windows 10, followed by consumer and retail at 22%, and manufacturing at 18%. Lansweeper is urging organizations to enroll in the ESU program and address reasons for remaining on Windows 10 as 2026 approaches.

Winsage

July 18, 2026

Windows 10 devices carry 3 times the risk of Windows 11, data shows

Approximately 16.9% of Windows client devices are still using Windows 10, which has three times more active Common Vulnerabilities and Exposures (CVEs) than Windows 11, totaling 1,903 compared to 652. Two-thirds of the vulnerabilities in Windows 10 are classified as high or critical, with an exploitable rate 1.7 times greater than in Windows 11. Migration to Windows 11 is not primarily hindered by technical limitations, as only a small fraction of Windows 10 devices do not meet the hardware requirements. Additionally, nearly 20% of monitored Windows devices are running end-of-life operating systems, including Windows 7, 8.1, and XP.

Winsage

July 16, 2026

Windows Netlogon Flaw CVE-2026-41089: CVSS 9.8 [2026]

CVE-2026-41089 is a critical vulnerability in the Windows Netlogon service, rated 9.8 on the CVSS scale, allowing unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on domain controllers. It affects all supported versions of Windows Server configured as domain controllers, from Windows Server 2012 R2 to the latest release. Microsoft addressed this vulnerability on May 12, 2026, during a broader update that included 138 fixes, but it went largely unnoticed until early June when active exploitation was confirmed. The vulnerability is characterized as a stack-based buffer overflow and is considered "wormable" due to its ability to self-propagate across systems without user intervention. Organizations are advised to patch all domain controllers and audit network access to mitigate exposure.

Winsage

July 16, 2026

Microsoft’s July patches fix over 600 flaws, shattering last month’s record

Microsoft has released its July 2026 Patch Tuesday updates, addressing 570 new security vulnerabilities, bringing the total for the month to over 620. The cumulative count of vulnerabilities patched this year has reached 1,380, exceeding the total of 1,250 for the entire year of 2020. Over 400 vulnerabilities are related to various versions of Windows, and the Windows 10 Extended Security Update program has been extended until October 12, 2027. Notable vulnerabilities include CVE-2026-56155 in Active Directory Federation Services, which allows attackers to gain administrator rights, and several critical Remote Code Execution vulnerabilities, including CVE-2026-57092 in Hyper-V and CVE-2026-56190 in Remote Desktop Protocol. Microsoft has also patched 97 vulnerabilities in Office products, with 17 classified as critical RCE vulnerabilities, and four vulnerabilities in Exchange Server, including CVE-2026-55008. The latest Microsoft Edge update addresses 27 vulnerabilities related to Chromium, and a vulnerability in Minecraft Bedrock servers has been patched.

AppWizard

July 16, 2026

Big Changes Are Coming To Android’s Google Play Store This Month

In October 2024, a judge ordered Google to allow third-party app stores on the Android platform. Google has now decided to comply with this ruling, retracting its motion to amend the injunction. Changes are set to be implemented starting July 22, 2026, allowing third-party app stores to operate within the Play Store in the U.S. Developers' app listings will automatically be available to these stores unless they opt out. Third-party stores can offer apps from the Play Catalog if they pay an annual fee and meet certain criteria. However, questions remain regarding the integration of Play Protect security features and the assessment of third-party store security.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

Winsage

July 14, 2026

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Microsoft's July 2026 security update addresses 622 vulnerabilities, with 57 classified as "critical." Two critical vulnerabilities, CVE-2026-56155 (Active Directory Federation Services) and CVE-2026-56164 (Microsoft SharePoint Server), have been exploited in the wild. The critical vulnerabilities include 48 remote code execution (RCE) vulnerabilities, seven elevation of privilege (EoP) vulnerabilities, one spoofing vulnerability, and one security feature bypass vulnerability. RCE vulnerabilities affect various Microsoft services, including Windows Media, Microsoft Office, and SQL Server, with eleven rated as "more likely" to be exploited. Additional important vulnerabilities include CVE-2026-49170, CVE-2026-49795, and CVE-2026-50325. Talos is releasing a new Snort ruleset to detect these vulnerabilities, and Cisco Security Firewall customers are advised to update their ruleset.