privilege Archives

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

Tech Optimizer

August 22, 2026

Best Ransomware Protection 2026: Tested and Ranked

Ransomware protection is best approached as a layered strategy rather than relying on a single solution. The effectiveness of software is significantly enhanced by maintaining a well-managed backup that is disconnected during an attack. Five tools were evaluated based on their default settings, focusing on behavioral detection, protected folders, file rollback, and real-time protection. 1. Norton 360: Rated as the best overall ransomware protection, it offers comprehensive features including behavioral monitoring, protected folders with dual alert modes, and 50 GB of cloud backup within a single subscription. It has a perfect score in advanced threat assessments. 2. Bitdefender: Recognized for its file rollback and remediation capabilities, it provides an effective "undo" feature that restores files, although this feature is turned off by default. 3. Avast One Free: The best free ransomware protection option, it includes a dedicated shield on the free Windows tier and has achieved a perfect score in advanced threat assessments. 4. NordVPN Threat Protection Pro: Best for blocking the delivery route of ransomware, it prevents downloads before encryption starts but cannot stop the process once it has begun. 5. McAfee: Best for protecting multiple devices simultaneously, it offers unlimited device coverage on most plans with integrated ransomware defense in its scanning engine. Modern ransomware protection software has shifted from signature matching to focusing on monitoring the behavior of processes interacting with files. The four essential layers of protection include behavioral monitoring, protected folders, automatic file rollback, and backup. Most users do not need a separate anti-ransomware product, as these features are typically included in main antivirus suites, with the key consideration being whether these features are activated. The rankings of the tools were based on whether the ransomware protection layer is enabled by default, the extent of file recovery when intervention occurs, and the frequency of false positives during normal use. - Norton 360: Best overall, with protection enabled by default and a perfect score in advanced threat testing. - Bitdefender: Best for file rollback, but the rollback feature is disabled by default. - Avast One Free: Best free option, with a perfect score in advanced threat assessments but lacks rollback capabilities. - NordVPN Threat Protection Pro: Effective at blocking malware downloads but does not provide rollback or backup features. - McAfee: Suitable for families with multiple devices, offering automatic backup of flagged files but lacks user-configurable protected folder options. The effectiveness of ransomware protection tools is primarily assessed through behavioral responses rather than library matching. Backup remains a critical layer of defense, functioning even when other layers fail.

Winsage

August 20, 2026

ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys

ShieldBreak, identified as CVE-2026-69414, is a zero-day vulnerability in the Microsoft Malware Protection Engine that allows low-privileged local attackers to escalate privileges to SYSTEM. The public proof of concept was released on August 12, 2026, and Microsoft recognized the CVE on August 14, 2026. No patch is currently available. ShieldBreak exploits an elevation-of-privilege vulnerability by manipulating file processing during the cloud-file hydration process in Microsoft Defender, allowing attackers to control processes with elevated privileges. The exploit is functional on Windows 11 25H2 and Windows Server 2025. Qualys VMDR can detect this vulnerability using a specific query, and organizations can use Qualys TruRisk™ Eliminate for mitigation until a patch is released.

Winsage

August 18, 2026

Microsoft Scrambles To Patch ShieldBreak Zero-Day Flaw In Windows Defender

A new exploit named ShieldBreak, developed by Nightmare-Eclipse, targets Microsoft Defender by allowing privilege escalation and bypassing previous security fixes related to the RoguePlanet vulnerability. ShieldBreak operates on Windows 11 25H2, its Canary channel, and Windows Server 2025, achieving a "100% success rate." Windows 10 may also be vulnerable, but the exploit is specifically designed for Windows 11. There is currently no patch for ShieldBreak, and users are advised to disable Microsoft Defender, implement two-factor authentication, and exercise caution with suspicious online activities. Malwarebytes has recommended its Premium Security antivirus as a temporary solution.

Winsage

August 18, 2026

CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed a privilege escalation vulnerability in the Windows Task Host, designated as CVE-2025-60710, which is being exploited by ransomware groups. Microsoft released a patch for this flaw on November 11, 2025, and CISA added it to its Known Exploited Vulnerabilities catalog on April 13. The vulnerability allows scheduled tasks to operate at the highest privilege level, enabling attackers to delete files and potentially gain full control over a machine. This access can lead to the extraction of credentials, manipulation of endpoint protection, and lateral movement across networks, culminating in widespread ransomware deployment. Security experts emphasize the critical nature of this vulnerability and urge organizations to address it promptly, as it poses significant risks to systems running Windows 11 and Server 2025.

Tech Optimizer

August 18, 2026

Migrate Amazon Aurora PostgreSQL across major versions with active Debezium CDC connectors using native logical replication

Organizations using Debezium Change Data Capture (CDC) connectors on Amazon Aurora PostgreSQL-Compatible Edition face challenges during major database version upgrades. In-place upgrades require downtime, while blue/green deployments disrupt CDC event pipelines. A method using PostgreSQL's native logical replication allows migration between a source cluster (current version) and a target cluster (new major version) without a full connector re-snapshot. This approach minimizes risks of data loss and allows existing Debezium connectors to operate on the source during synchronization. The cutover process involves disabling the replication subscription, synchronizing sequences, creating a new Debezium replication slot on the target, and redirecting the connector, resulting in a brief pause for Kafka consumers. Prerequisites for this method include enabling logical replication on the source cluster, ensuring the target cluster is provisioned in the same VPC, and confirming that tables participating in CDC have primary keys. The process involves configuring parameter groups, creating publications, and establishing subscriptions for logical replication. During cutover, application writes are halted, and replication lag must be monitored to ensure it reaches zero before proceeding. After the cutover, ongoing monitoring of replication health and Kafka consumer offsets is necessary. Common failure scenarios include Aurora writer failover, Debezium connector stalls, large messages exceeding Kafka limits, DDL changes during synchronization, and long-running transactions blocking lag drain. Each scenario has specific symptoms, detection methods, and resolutions. Post-migration, organizations should establish monitoring for replication lag growth and Kafka consumer offset divergence. Automation can streamline the migration process for organizations managing multiple clusters, utilizing AWS Cloud Development Kit (CDK) constructs for cluster provisioning, schema replication, and cutover orchestration. After verifying stable operation on the target cluster, the old Debezium connector and source cluster can be decommissioned. Limitations include the absence of failover slots on Aurora PostgreSQL 17 and the need to handle TOAST columns appropriately.

Winsage

August 16, 2026

LeakWatch CW 33/2026: Windows Zero-Day, AMD, Intel and Malware

- The August Patch Tuesday release included 421 vulnerabilities, with 236 affecting Windows, highlighting CVE-2026-68820, a critical use-after-free vulnerability that allows privilege escalation to SYSTEM level without user interaction. - CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation. - AMD's Ryzen Master software has vulnerabilities, including CVE-2025-54512 (DLL hijacking) and CVE-2026-0465 (use-after-free), which could allow code execution with elevated privileges. - AMD's advisory on CVE-2026-6726 and CVE-2026-6727 indicates vulnerabilities in the TPM 2.0 reference code affecting Ryzen platforms, leading to potential information disclosure. - Intel's advisories included updates for microcode, Wi-Fi software, and NPU drivers, with CVE-2026-20760 addressing privilege escalation risks. - Google’s Chrome update on August 11 fixed five high-severity vulnerabilities, including use-after-free flaws. - Gunra malware has evolved into a ransomware-as-a-service model using a double-extortion strategy. - WindRelay malware combines SpyNote RAT with an NFC relay component, allowing attackers to relay NFC communication between a victim's bank card and a remote device. - The findings emphasize the need to view vulnerabilities as part of potential attack chains, highlighting the complexity of modern cybersecurity threats.

Winsage

August 15, 2026

Windows 11 is dangerously close to letting you move the taskbar

Windows 11 users can now reposition the taskbar to the top or either side of the screen in the latest Insider Preview builds. This feature is currently available to Windows Insiders in the Release Preview Channel, with a broader rollout expected with the September Patch Tuesday update. Additional enhancements include a more customizable Start menu, improved Windows Search, and a faster File Explorer. Users can choose between small or large Start menu sizes, recent items are highlighted, and search functionality has been refined for better clarity. File Explorer now launches more quickly and supports touch scrolling. Updated progress indicators and enhanced security features for administrators are also included in the updates.

Winsage

August 15, 2026

After years of requests, Windows 11 is dangerously close to bringing back full taskbar freedom — top, left, right, or bottom

Windows 11 users can now relocate the taskbar to the top or sides of the screen with the latest Insider Preview builds. This feature will be included in the September Patch Tuesday update, but is available immediately to those in the Release Preview Channel. The update also allows for a smaller taskbar option, enhancing screen space for smaller devices. Key features in Build 26100.9267/26200.9267 include: - Taskbar customization with new positioning options and a smaller taskbar option. - Enhanced Start menu with size options, renaming of the Recommended section to Recent, and a redesigned settings page. - Improvements to Windows Search, including a simplified interface and automatic indexing of frequently used folders. - Updates to File Explorer for faster launch times and touch scrolling support. - General design updates with modernized progress indicators. - New Windows Share feature for discovering apps from the share window. - Enhanced security with just-in-time privileges for administrative tasks. - Improved responsiveness when switching between virtual desktops. - Updates for display settings and brightness reliability. - Reliability improvements for Task Manager and Windows Update behavior. - Network improvements for VPN-related issues. - Enhanced typing reliability with the Japanese IME. - Introduction of the ML-KEM algorithm for TLS key exchange. - Removal of the Windows Management Instrumentation Command-line utility in future versions.

Winsage

August 14, 2026

August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Users can connect to SMB shares with features like RDMA, leases, and Continuous Availability, allowing efficient data transfer and session management. Hyper-V users can create, checkpoint, and export Generation 2 virtual machines, enable virtual TPM and BitLocker, and connect USB storage and MIDI devices. MSI package management has improved, allowing easy installation, repair, and uninstallation with UAC prompts. TAPI has 11 entries focused on parity fixes, with enhancements in TCP/IP, HTTP.sys, Windows Firewall, Bluetooth, wired 802.1X, and message queuing. Users can verify TAPI line status, HTTP.sys functionality across protocols, and confirm TCP/IP IPsec tunnels. Office updates include client updates for MSI Office 2016 and SharePoint Server updates for 2016, 2019, and Subscription Edition, requiring attention to browser-based editing functionality. On-premises Exchange Server receives a security update addressing seven CVEs, including one critical elevation of privilege vulnerability and six important issues.