Server 2025 Archives

Tech Optimizer

August 26, 2026

How to Protect Against Ransomware: 13 Steps [2026]

Global ransomware attacks increased by 0.8% quarter-over-quarter in Q2 2026. The group Qilin has 279 confirmed victims, maintaining its position as the leading threat actor for four consecutive quarters. The rival group The Gentlemen saw a 62% increase in victims, reaching 269. Checkpoint Research's report indicates a shift in the ransomware landscape, challenging the narrative of declining attacks. IBM's analysis shows breaches within supply chains and third-party vendors have quadrupled over the past five years. Effective ransomware protection requires administrative access to endpoints, firewalls, and backup systems, along with specific software versions and tools. The 3-2-1-1-0 backup strategy is recommended, emphasizing offline, immutable backups. Organizations should implement multi-factor authentication (MFA) across all access points and actively patch known vulnerabilities. Network segmentation is crucial to limit ransomware spread, and canary files can provide early warnings of attacks. Regular phishing simulations and a well-documented incident response plan are essential for preparedness.

Winsage

August 25, 2026

Microsoft: August updates break printing, PDF export in WPF apps

Microsoft has acknowledged a significant issue with the .NET Framework updates from August 2026, causing disruptions in printing and PDF export functionalities in certain applications, particularly those using the Windows Presentation Foundation (WPF) UI framework. After installing the update, some WPF applications may encounter a System.IO.FileFormatException when printing or generating PDF/XPS content with specific fonts, including Calibri. This issue affects various platforms, including Windows 10, Windows 11, and Windows Server editions from 2012 to 2025. Microsoft has provided a temporary workaround involving the Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection AppContext switch, but cautions that it may expose systems to vulnerabilities. This situation is reminiscent of a similar incident in February 2021, where WPF applications and Visual Studio experienced crashes after Windows 10 cumulative updates. Additionally, on the same day, Microsoft offered a workaround for another issue caused by Windows 11 updates that led to crashes in certain games.

Winsage

August 20, 2026

ShieldBreak: The Windows Defender Zero-Day With No Patch — Detect It, Mitigate It, With Qualys

ShieldBreak, identified as CVE-2026-69414, is a zero-day vulnerability in the Microsoft Malware Protection Engine that allows low-privileged local attackers to escalate privileges to SYSTEM. The public proof of concept was released on August 12, 2026, and Microsoft recognized the CVE on August 14, 2026. No patch is currently available. ShieldBreak exploits an elevation-of-privilege vulnerability by manipulating file processing during the cloud-file hydration process in Microsoft Defender, allowing attackers to control processes with elevated privileges. The exploit is functional on Windows 11 25H2 and Windows Server 2025. Qualys VMDR can detect this vulnerability using a specific query, and organizations can use Qualys TruRisk™ Eliminate for mitigation until a patch is released.

Winsage

August 18, 2026

Microsoft Scrambles To Patch ShieldBreak Zero-Day Flaw In Windows Defender

A new exploit named ShieldBreak, developed by Nightmare-Eclipse, targets Microsoft Defender by allowing privilege escalation and bypassing previous security fixes related to the RoguePlanet vulnerability. ShieldBreak operates on Windows 11 25H2, its Canary channel, and Windows Server 2025, achieving a "100% success rate." Windows 10 may also be vulnerable, but the exploit is specifically designed for Windows 11. There is currently no patch for ShieldBreak, and users are advised to disable Microsoft Defender, implement two-factor authentication, and exercise caution with suspicious online activities. Malwarebytes has recommended its Premium Security antivirus as a temporary solution.

Winsage

August 18, 2026

CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed a privilege escalation vulnerability in the Windows Task Host, designated as CVE-2025-60710, which is being exploited by ransomware groups. Microsoft released a patch for this flaw on November 11, 2025, and CISA added it to its Known Exploited Vulnerabilities catalog on April 13. The vulnerability allows scheduled tasks to operate at the highest privilege level, enabling attackers to delete files and potentially gain full control over a machine. This access can lead to the extraction of credentials, manipulation of endpoint protection, and lateral movement across networks, culminating in widespread ransomware deployment. Security experts emphasize the critical nature of this vulnerability and urge organizations to address it promptly, as it poses significant risks to systems running Windows 11 and Server 2025.

Winsage

August 18, 2026

CISA: Windows Task Host flaw now exploited by ransomware gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs are exploiting a significant vulnerability in the Windows Task Host system, tracked as CVE-2025-60710. This high-severity flaw, affecting Windows 11 and Windows Server 2025, allows local attackers with basic user permissions to escalate their privileges to SYSTEM level. Microsoft patched this vulnerability in November 2025, but it poses a threat to unpatched devices. CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and provided Federal Civilian Executive Branch agencies with a two-week window to secure their systems. CISA warns that such vulnerabilities are frequent attack vectors for malicious actors and urges organizations to apply mitigations or discontinue the use of affected products. Additionally, CISA noted that ransomware groups are also exploiting a Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659), confirmed to be actively exploited in early July. Since November 2021, CISA has identified 383 actively exploited vulnerabilities across various Microsoft products, with 112 being used in ransomware attacks.

Winsage

August 17, 2026

Windows Server 2022 reaches end of mainstream support in 60 days

Microsoft has announced that the mainstream end date for Windows Server 2022 is set for October 13, 2026, after which it will enter extended support until October 14, 2031. Windows Server 2022 became generally available in September 2021 and is part of the Long-Term Servicing Channel (LTSC) offering, which guarantees a decade of support. Microsoft recommends upgrading to Windows Server 2025, which will be generally available in November 2024, and will reach its end of support on November 13, 2029, with five years of extended support until November 14, 2034. A free 180-day trial of Windows Server 2025 is available. Additionally, hotpatching for Windows Server 2022 will be extended until October 2027 for Datacenter: Azure Edition systems. The free Windows 10 Extended Security Updates (ESU) program has been extended by an additional year, and Windows 11 23H2 Enterprise and Education editions will end updates on November 10, 2026, with a recommendation to upgrade to Windows 11 25H2.

Winsage

August 16, 2026

Microsoft threatened legal action, and this researcher just dropped a new Windows bug anyway

Microsoft has faced legal warnings regarding the disclosure of vulnerabilities, but security researcher Nightmare Eclipse has revealed a new exploit called ShieldBreak that targets Windows Defender. This vulnerability allows attackers to escalate privileges from a low-level user account to full system access on Windows 10, Windows 11, and Windows Server 2025. The proof of concept for ShieldBreak is available as a downloadable application, requiring execution to activate the exploit. Security expert Will Dormann confirmed that Windows Defender must be activated for the attack to succeed. ShieldBreak builds upon a previous exploit named RoguePlanet, which Microsoft patched inadequately, allowing ShieldBreak to bypass the fix. Microsoft is currently investigating the reported vulnerability, but no patch has been released yet.

Winsage

August 15, 2026

Windows 11 24H2, Windows Server 2022, Windows 10 Ent. LTSB 2016 get 60-day cut off warnings

Microsoft has issued a 60-day notice regarding the end-of-life dates for several products, following a previous 90-day warning. Mainstream support for Windows Server 2022 will end on October 13, 2026, affecting all editions. Users of Windows 11 version 24H2 Home and Pro, as well as Windows 10 Enterprise LTSB 2016, will stop receiving updates. Microsoft recommends upgrading to Windows Server 2025, with an extended support phase lasting until October 14, 2031, for those unable to upgrade immediately. Windows 11 version 24H2 users must upgrade to version 25H2 to continue receiving updates, while Enterprise and Education variants will have a grace period until October 2027. Organizations using Windows 10 Enterprise LTSB 2016 should transition to Windows 11 Enterprise LTSC 2024, with Extended Security Updates available for purchase for those who remain on the older system. A 180-day evaluation build of Windows Server 2025 can be downloaded for compatibility testing.

Winsage

August 13, 2026

Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

Nightmare Eclipse has released a new zero-day exploit called ShieldBreak, which can bypass Microsoft's RoguePlanet patch (CVE-2026-50656) and allow attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit has been confirmed by security expert Kevin Beaumont, who provided detection methods for it. ShieldBreak is the tenth zero-day from Nightmare Eclipse since April and was released shortly after Microsoft's monthly Patch Tuesday. The exploit allows local privilege escalation and has a 100% success rate on the latest version of Windows 11 and Windows Server 2025, while Windows 10 remains vulnerable. Microsoft is aware of the vulnerability and is investigating it, emphasizing the importance of coordinated vulnerability disclosure. Previous exploits from Nightmare Eclipse include LegacyHive and GreatXML, with earlier vulnerabilities having been patched but recent ones still unaddressed. Microsoft had threatened legal action against Nightmare Eclipse in May but later reconsidered its approach to vulnerability disclosure.