system access Archives

Winsage

September 23, 2026

New Windows Defender zero-day blocks Microsoft antivirus updates

Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, released a zero-day exploit called BigDiskBuster that targets Microsoft Defender, preventing antivirus updates and leaving systems vulnerable. BigDiskBuster operates across all supported Windows versions and must run in the background to block updates. Naceri has previously released a similar exploit called UnDefend and has a history of releasing multiple zero-day exploits since April 2026 amid a dispute with Microsoft. Two weeks before BigDiskBuster, he introduced another exploit named ShieldCrash, which grants SYSTEM access and circumvents a patched flaw. Naceri's recent exploits include tools like LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, and MiniPlasma, all targeting Microsoft Defender and other Windows components. Microsoft has warned of potential legal action against malicious activities but has not commented on BigDiskBuster.

AppWizard

September 23, 2026

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

A newly identified strain of Android malware, RatHat, utilizes generative AI to manipulate infected devices in real time. It is linked to threat actors believed to be operating out of China. RatHat serializes the device’s live Accessibility tree into XML format and communicates with a generative AI assistant to return screen coordinates, identify text, and issue navigation commands. The malware employs WebView-based HTML overlays to capture login credentials from banking and cryptocurrency applications and can infiltrate payment apps like WeChat and Alipay to extract PINs. It also features an SMS receiver and notification listener to intercept OTPs and 2FA codes. RatHat is disseminated through smishing, malvertising campaigns, and misleading third-party forums. It employs anti-analysis techniques such as container tampering, manifest bombing, DEX bytecode poisoning, string encryption, and anti-debugging. Once installed, it gains Accessibility access, activates Developer Options, and enables Wireless Debugging, allowing it to connect to the device's local ADB service and launch control agents with shell-level privileges. The malware captures raw touch coordinates to reconstruct PINs and unlock patterns, bypassing screenshot protections. It also includes persistence mechanisms that prevent uninstallation by presenting a fake Google Play failure overlay and automatically reinstalling itself if removed.

BetaBeacon

September 20, 2026

MuMu Player vs GameLoop vs KOPLAYER: Android 15 Gap

Android emulators for PC have become a crowded market with close to a dozen actively maintained clients. Tencent and NetEase have first-party products like GameLoop and MuMu Player to control the PC on-ramp to their mobile catalogs. Independent players like BlueStacks and LDPlayer focus on platform-agnostic performance and feature breadth. KOPLAYER appears to be abandoned in 2026 with no updates, functioning website, or active development. MuMu Player supports Android 15, offering newer features for mobile games. GameLoop is focused on Tencent's mobile titles with updated documentation. MuMu Player and GameLoop are free, while KOPLAYER is also historically free. MuMu Player and GameLoop have ongoing updates and security, while KOPLAYER's lack of updates poses a security risk.

Winsage

September 10, 2026

CVE-2026-85880 and CVE-2026-81963: Microsoft Patches Two Actively Exploited Windows Zero-Days

Microsoft's Patch Tuesday on September 8, 2026, addressed two critical Windows privilege escalation vulnerabilities: CVE-2026-85880 and CVE-2026-81963, both with a CVSS score of 7.8. CVE-2026-85880 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC), allowing attackers with low-privilege local access to escalate privileges to SYSTEM. CVE-2026-81963 involves improper link resolution in the Windows Update Stack, enabling similar privilege escalation. Both vulnerabilities require no user interaction and have been actively exploited prior to the patch release. CISA added them to its Known Exploited Vulnerabilities catalog on September 8, 2026, with a remediation deadline of September 22 for U.S. federal agencies. CVE-2026-85880 affects various Windows 10 and Server versions but excludes Windows 11 and Windows Server 2025. CVE-2026-81963 impacts newer Windows platforms, including Windows 11 and Windows Server 2025. Microsoft released security updates for both vulnerabilities on September 8, 2026, and organizations are advised to prioritize these updates. Security teams should monitor for signs of privilege escalation and unusual SYSTEM-level activities related to these vulnerabilities.

Winsage

August 18, 2026

CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed a privilege escalation vulnerability in the Windows Task Host, designated as CVE-2025-60710, which is being exploited by ransomware groups. Microsoft released a patch for this flaw on November 11, 2025, and CISA added it to its Known Exploited Vulnerabilities catalog on April 13. The vulnerability allows scheduled tasks to operate at the highest privilege level, enabling attackers to delete files and potentially gain full control over a machine. This access can lead to the extraction of credentials, manipulation of endpoint protection, and lateral movement across networks, culminating in widespread ransomware deployment. Security experts emphasize the critical nature of this vulnerability and urge organizations to address it promptly, as it poses significant risks to systems running Windows 11 and Server 2025.

Winsage

August 16, 2026

Microsoft threatened legal action, and this researcher just dropped a new Windows bug anyway

Microsoft has faced legal warnings regarding the disclosure of vulnerabilities, but security researcher Nightmare Eclipse has revealed a new exploit called ShieldBreak that targets Windows Defender. This vulnerability allows attackers to escalate privileges from a low-level user account to full system access on Windows 10, Windows 11, and Windows Server 2025. The proof of concept for ShieldBreak is available as a downloadable application, requiring execution to activate the exploit. Security expert Will Dormann confirmed that Windows Defender must be activated for the attack to succeed. ShieldBreak builds upon a previous exploit named RoguePlanet, which Microsoft patched inadequately, allowing ShieldBreak to bypass the fix. Microsoft is currently investigating the reported vulnerability, but no patch has been released yet.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

Winsage

July 26, 2026

How I stopped being my parents’ emergency IT hotline — The complete list of Windows Security settings I made them fix once and for all

A family member inquired about the necessity of a password manager, reflecting growing cybersecurity concerns. A parent received a suspicious "tech support" message, indicating potential security risks. Windows Hello allows users to log in with a PIN, fingerprint, or facial recognition on Windows 11 PCs. Users can set it up via Settings > Accounts > Sign-in options. Regular updates through Windows Update are essential for security, and users can check their status in Settings > Windows Update. Windows Defender is the built-in antivirus for Windows 11, typically enabled by default, but users should verify its status in Settings > Privacy & security > Windows Security > Virus & threat protection. The 'Find My Device' feature can be enabled in Settings > Privacy & security > Find my device to track and lock a lost or stolen laptop. Switching from a local account to a Microsoft account with two-factor authentication (2FA) enhances security, accessible via Settings > Accounts > Your info. Device encryption can protect sensitive data, available in Settings > Privacy & security > Device encryption for Home versions and BitLocker for Pro versions. Using a Standard account instead of an Administrator account reduces malware risks, managed through Settings > Accounts > Family. Password managers like NordPass, 1Password, and Bitwarden help generate strong, unique passwords for accounts. Users should learn to spot phishing scams, be cautious of unsolicited tech support calls, and avoid installing software suggested by unknown callers to maintain cybersecurity.

Winsage

July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.

Winsage

June 10, 2026

Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows

An anonymous researcher known as Chaotic Eclipse has released a proof-of-concept exploit called RoguePlanet, targeting a zero-day vulnerability in Microsoft Defender. The exploit, which is a race condition, has a variable success rate, achieving 100% success on some machines while being less effective on others. When successful, it grants attackers SYSTEM-level privileges on Windows 10 and 11 systems with the June 2026 Patch Tuesday updates. The exploit does not work on Windows Server due to restrictions on mounting ISO images. Chaotic Eclipse has criticized Microsoft's defenses against path redirection attacks and claims to have found multiple vulnerabilities within Defender and other Microsoft software components. The researcher has expressed dissatisfaction with Microsoft's handling of vulnerability disclosures, particularly after losing access to the Microsoft Security Response Center account. Microsoft has condemned the public disclosure of vulnerabilities as unjustifiable, stating it puts customers at unnecessary risk, and has removed Chaotic Eclipse's GitHub and GitLab accounts. Microsoft clarified that it does not intend to pursue legal action against individuals conducting security research but will collaborate with law enforcement against malicious activities.