exploiting Archives

Winsage

August 18, 2026

Microsoft Scrambles To Patch ShieldBreak Zero-Day Flaw In Windows Defender

A new exploit named ShieldBreak, developed by Nightmare-Eclipse, targets Microsoft Defender by allowing privilege escalation and bypassing previous security fixes related to the RoguePlanet vulnerability. ShieldBreak operates on Windows 11 25H2, its Canary channel, and Windows Server 2025, achieving a "100% success rate." Windows 10 may also be vulnerable, but the exploit is specifically designed for Windows 11. There is currently no patch for ShieldBreak, and users are advised to disable Microsoft Defender, implement two-factor authentication, and exercise caution with suspicious online activities. Malwarebytes has recommended its Premium Security antivirus as a temporary solution.

Winsage

August 18, 2026

CISA: Windows Task Host flaw now exploited by ransomware gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs are exploiting a significant vulnerability in the Windows Task Host system, tracked as CVE-2025-60710. This high-severity flaw, affecting Windows 11 and Windows Server 2025, allows local attackers with basic user permissions to escalate their privileges to SYSTEM level. Microsoft patched this vulnerability in November 2025, but it poses a threat to unpatched devices. CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and provided Federal Civilian Executive Branch agencies with a two-week window to secure their systems. CISA warns that such vulnerabilities are frequent attack vectors for malicious actors and urges organizations to apply mitigations or discontinue the use of affected products. Additionally, CISA noted that ransomware groups are also exploiting a Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659), confirmed to be actively exploited in early July. Since November 2021, CISA has identified 383 actively exploited vulnerabilities across various Microsoft products, with 112 being used in ransomware attacks.

Winsage

August 17, 2026

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

A suspected advanced persistent threat (APT) group linked to China exploited a newly patched vulnerability in VMware vCenter (CVE-2026-59310), which has a critical CVSS score of 9.8, allowing for arbitrary code execution and the deployment of Babuk-derived ransomware. A recently patched vulnerability in Apple macOS (CVE-2026-65400) has been exploited to deploy a cryptocurrency miner, granting unauthorized root access. The Lazarus Group from North Korea exploited a zero-day vulnerability in Microsoft Windows, targeting defense and aerospace sectors. GeoServer patched a critical SQL injection vulnerability that was actively exploited. A new macOS malware, Amnesia Stealer, targets users through ClickFix attacks, stealing data and allowing real-time access to authenticated sessions. A novel attack technique named GhostSplice can manipulate AI coding assistants. Research revealed a method exploiting Chromium's DevTools Protocol for data theft. Noteworthy CVEs this week include CVE-2026-68820, CVE-2026-58231, and multiple others across various platforms. A high-severity command injection flaw in FileRun allows remote code execution. An advanced ClickFix attack has been reported, deploying sophisticated malware. A heap overflow vulnerability in Citrix NetScaler was patched after indications of exploitation. A new malware loader targeting Portuguese-speaking users has been identified. A significant reduction in exposed Automatic Tank Gauge systems has been observed. A phishing campaign targeting Brazil has been detected, and an F.B.I. agent faces charges for unauthorized crypto withdrawals. Authorities in Ukraine dismantled fraudulent call centers, and a North Carolina man was sentenced for cyber extortion. Unauthorized access to sensitive data by the ExfilSquad group has been confirmed. LightSpy activity linked to China has been detected in over 13 countries. A supply chain attack exposed over 2,500 companies, and an Azure exfiltration campaign has exposed millions of enterprise records.

AppWizard

August 17, 2026

Marvel Rivals players are messing with their config files ‘to cancel games with no consequence’ before they get a loss

Players are exploiting the cheating detection system in Marvel Rivals to manipulate match outcomes by canceling games when losing, using configuration files during gameplay. Streamer LytePk reported this issue on social media, stating he experienced it multiple times in one day. Evidence includes a player named Murder Rate leaving a game while at a disadvantage, leading to a cancellation attributed to cheating, with teammates expressing disbelief in the chat. NetEase has issued warnings about modded configurations, but penalties have been mild, mainly resulting in auto-cancellations without serious consequences. The community is calling for more stringent penalties to address this challenge to fair play.

Tech Optimizer

August 16, 2026

4 Outdated Cybersecurity Tips That No Longer Keep You Safe

Creating strong passwords and storing them securely in a password manager is essential. Utilizing multi-factor authentication (MFA) adds an extra layer of security, with passwordless options like passkeys and security keys enhancing convenience and security. Public Wi-Fi networks pose significant risks, as hackers can use Man-in-the-Middle (MitM) attacks to intercept data. Using a Virtual Private Network (VPN) can enhance security by encrypting data. Traditional antivirus software may struggle against adaptive malware, which uses machine learning to evade detection. Companies like Bitdefender have integrated machine learning into their antivirus solutions. Two-factor authentication (2FA) is commonly used but can be bypassed by hackers. Transitioning to passkeys and security keys can improve protection against unauthorized access.

Tech Optimizer

August 15, 2026

4 Outdated Cybersecurity Tips That No Longer Keep You Safe

Creating robust passwords and storing them securely in a password manager is essential. Utilizing multi-factor authentication (MFA) is recommended for added security. Passwordless options like passkeys and security keys enhance convenience and security. Public Wi-Fi networks pose significant security risks, and caution is necessary when connecting. Hackers often use Man-in-the-Middle (MitM) attacks to intercept data on unsecured networks. Using a Virtual Private Network (VPN) can safeguard data by encrypting it before transmission. VPN routers can encrypt data for devices that cannot install a VPN. Traditional antivirus software may struggle against adaptive malware, which uses machine learning to evolve and evade detection. Companies are integrating machine learning into their antivirus solutions. Two-factor authentication (2FA) is commonly used but has diminished effectiveness due to new tactics employed by cybercriminals. Users should consider transitioning to passkeys and security keys for better protection against unauthorized access.

Tech Optimizer

August 14, 2026

‘This one just needs a script’: Researchers find ultimate Windows kill switch which can disable antivirus with almost no user interaction

Researchers have identified a significant vulnerability in consumer DDR4 and DDR5 memory modules, known as the “Download more RAM” flaw, which allows attackers to bypass advanced Windows security features, including Virtualization-Based Security (VBS) and Hypervisor Code Integrity (HVCI). This vulnerability enables the manipulation of configuration reports from RAM, misleading the system about its actual memory capacity, which can disable antivirus protections and allow the reintroduction of outdated drivers. The exploit can be executed via a single-click script, leading to security failures. Microsoft has released a patch for CVE‑2026‑23670 to enhance memory write protection against such exploits.

Winsage

August 12, 2026

After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

A security researcher named Nightmare Eclipse has discovered a vulnerability in Windows, called ShieldBreak, which allows hackers to gain system-wide access to users' devices and sensitive data by exploiting a flaw in Windows Defender. The vulnerability affects Windows 10, Windows 11 (including version 25H2), and Windows Server 2025. A proof-of-concept exploit has been provided, requiring users to run a Windows application to trigger the vulnerability. Security researcher Will Dormann confirmed that Windows Defender must be enabled for the exploit to work. Microsoft has not yet released a patch for ShieldBreak, which is classified as a zero-day vulnerability. This discovery follows previous vulnerabilities disclosed by Nightmare Eclipse, including RoguePlanet, for which Microsoft issued an inadequate patch. The situation has heightened tensions between the researcher and Microsoft regarding the handling of bug reports, especially after Microsoft threatened legal action against researchers disclosing zero-days outside established protocols. The disclosure of ShieldBreak occurred shortly after Microsoft's monthly security patch releases, which have been increasing in number.

Winsage

August 7, 2026

Microsoft Flags BNB Chain Malware Campaign Targeting Windows Users

Microsoft has identified a sophisticated malware campaign that uses the infrastructure of BNB Chain to spread harmful code through compromised websites. The attackers deceive visitors into executing malicious commands disguised as standard security checks, exploiting vulnerabilities in conventional website security measures. This campaign affects both businesses and individual users, utilizing ClickFix lures and EtherHiding techniques. An injected Base64-encoded JavaScript communicates with a BNB Smart Chain RPC gateway to facilitate these malicious operations.

Winsage

August 7, 2026

This ‘classic’ decades-old SQL injection flaw could let hackers take over entire Windows servers, thanks to a nifty database trick

Security researchers from Huntress discovered a sophisticated SQL Injection (SQLi) attack that led to the deployment of a rare toolkit called Khunt. The attackers exploited a public-facing application backed by an Oracle database by failing to validate user input, allowing malicious SQL commands to be executed. The Khunt toolkit enabled activities such as executing operating system commands, stealing credentials, and exfiltrating registry hive data. Experts recommend robust defense mechanisms, including input sanitation, regular security audits, and the implementation of web application firewalls to protect against such attacks.