vulnerabilities Archives

Winsage

August 14, 2026

Microsoft warns users to install Windows 11’s latest update within 3 days, 400+ security bugs fixed

Windows 11's August 2026 Patch Tuesday update has been released, addressing 421 security vulnerabilities, including 400 specific to the Patch Tuesday release. The update rectifies at least 37 remote code execution bugs and five elevation-of-privilege vulnerabilities. Microsoft advises users to implement the update within three days for security. The update includes fixes for other Microsoft products like Entra, Office, and Teams. Users should verify their Windows 11 build number, with recommended versions being 26200.9168 for 25H2 and 26100.9168 for 24H2. The update is identified as KB5121003 and may require up to two reboots to apply fully. Key areas of focus in the update include the kernel, Remote Desktop, DNS, DHCP, SMB, and Windows Defender Firewall. Microsoft emphasizes the importance of timely updates and recommends limiting the deferral period for quality updates to less than three days.

Winsage

August 13, 2026

Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

Nightmare Eclipse has released a new zero-day exploit called ShieldBreak, which can bypass Microsoft's RoguePlanet patch (CVE-2026-50656) and allow attackers to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit has been confirmed by security expert Kevin Beaumont, who provided detection methods for it. ShieldBreak is the tenth zero-day from Nightmare Eclipse since April and was released shortly after Microsoft's monthly Patch Tuesday. The exploit allows local privilege escalation and has a 100% success rate on the latest version of Windows 11 and Windows Server 2025, while Windows 10 remains vulnerable. Microsoft is aware of the vulnerability and is investigating it, emphasizing the importance of coordinated vulnerability disclosure. Previous exploits from Nightmare Eclipse include LegacyHive and GreatXML, with earlier vulnerabilities having been patched but recent ones still unaddressed. Microsoft had threatened legal action against Nightmare Eclipse in May but later reconsidered its approach to vulnerability disclosure.

Winsage

August 13, 2026

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

Security researcher Nightmare Eclipse has released a zero-day exploit named ShieldBreak that allows privilege escalation on Windows by targeting a vulnerability in Microsoft Defender. This exploit, designated as CVE-2026-50656, is categorized as a race condition vulnerability and affects the latest versions of Windows 11 and Windows Server 2025, with potential impacts on Windows 10. The exploit was disclosed on June 9, 2026, and Microsoft acknowledged the issue on June 16, rolling out fixes by July 9. The mechanics of ShieldBreak involve manipulating Defender’s scan path and executing a scheduled task to gain System-level privileges. Experts have noted differences between ShieldBreak and the previously known RoguePlanet exploit, emphasizing that ShieldBreak requires Defender to be active to function.

Winsage

August 13, 2026

Windows 10’s latest patch keeps your Secure Boot certificates on track

A recent update has been released, addressing security vulnerabilities and improving system functionality. Key improvements include a fix for the Backup feature, resolving an "invalid credentials" error that caused automatic backups to fail when using Server Message Block (SMB). The update also enhances the Secure Boot feature by introducing high-confidence device targeting data, allowing more devices to receive new Secure Boot certificates. This update addresses outdated Secure Boot certificates for Windows 11 and Windows 10 users. The update, identified as KB5120249, is under 1 GB and is available only to PCs enrolled in the Extended Security Updates (ESU) program, which ensures Windows 10 PCs receive security updates until at least October 2027. Non-enrolled PCs lost security update support in October 2025.

Winsage

August 13, 2026

Researcher threatened by Microsoft finds new critical bug in Windows | Researcher had accused Microsoft of mistreatment

A vulnerability in Microsoft Defender, named ShieldBreak, has been revealed by security researcher Nightmare Eclipse, allowing malicious actors to gain complete system-level access to a user's device. Microsoft has previously warned against public disclosure of vulnerabilities and suggested potential legal repercussions for researchers who do so outside its protocols. Users of Microsoft Defender are advised to remain vigilant regarding this vulnerability.

Winsage

August 13, 2026

Microsoft’s August update fixes a Windows flaw that’s already being attacked

The upcoming Patch Tuesday is scheduled for September 8th, 2026, during which Microsoft will address over 200 vulnerabilities across Windows platforms, including Windows 10, Windows 11, and Windows Server. Windows 10 users in the Extended Security Updates (ESU) program will receive updates until October 2027. Among the vulnerabilities, CVE-2026-68820 allows attackers to gain elevated privileges through the Windows auxiliary function driver for Winsock. Microsoft has identified 18 vulnerabilities as critical, including CVE-2026-62878, an RCE vulnerability in the Windows DNS server that can lead to a buffer overflow and code execution without user interaction. Another critical issue is CVE-2026-62893, a UAF vulnerability in the TFTP server of Windows Deployment Services, which allows code injection through UDP port 69. Additionally, CVE-2026-62815, an RCE vulnerability in Quick UDP Internet Connections (QUIC), permits code execution without user interaction, while CVE-2026-59124, although high risk, is not classified as critical due to the HPC Pack not being enabled by default.

Winsage

August 12, 2026

Microsoft fixes 421 bugs and a Windows zero-day in August Patch Tuesday

Microsoft's August Patch Tuesday update addressed 421 vulnerabilities across various products, including multiple versions of Windows (11 25H2/24H2, 11 23H2, and 10). A critical zero-day flaw, the "Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability," allows attackers with lower-level access to gain system privileges without user interaction. Additionally, the update addresses two other zero-day flaws, including the "Windows User Profile Service Elevation of Privilege Vulnerability," which has not yet been exploited but was publicly disclosed. The update is mandatory and should automatically install on supported PCs, with users encouraged to verify its application. The update also includes minor improvements to Windows features, such as enhancements to File Explorer, Windows Hello, Voice Access, and touchpad controls.

Winsage

August 12, 2026

After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

A security researcher named Nightmare Eclipse has discovered a vulnerability in Windows, called ShieldBreak, which allows hackers to gain system-wide access to users' devices and sensitive data by exploiting a flaw in Windows Defender. The vulnerability affects Windows 10, Windows 11 (including version 25H2), and Windows Server 2025. A proof-of-concept exploit has been provided, requiring users to run a Windows application to trigger the vulnerability. Security researcher Will Dormann confirmed that Windows Defender must be enabled for the exploit to work. Microsoft has not yet released a patch for ShieldBreak, which is classified as a zero-day vulnerability. This discovery follows previous vulnerabilities disclosed by Nightmare Eclipse, including RoguePlanet, for which Microsoft issued an inadequate patch. The situation has heightened tensions between the researcher and Microsoft regarding the handling of bug reports, especially after Microsoft threatened legal action against researchers disclosing zero-days outside established protocols. The disclosure of ShieldBreak occurred shortly after Microsoft's monthly security patch releases, which have been increasing in number.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

Winsage

August 12, 2026

Microsoft Windows 0-Day Attack Deploys Lazarus Rootkit—Patch Now

Microsoft released a patch for a zero-day vulnerability, CVE-2026-68820, which is being exploited by cybercriminals, specifically the North Korean hacking group Lazarus. This vulnerability allows unauthorized attackers to elevate their privileges locally, posing a significant risk to affected systems. The August 2026 Patch Tuesday update addressed 421 vulnerabilities, including three zero-days, with CVE-2026-68820 being the only one confirmed to be actively exploited. The vulnerability's impacts on confidentiality, integrity, and availability are rated as High. Users of Microsoft Windows 10, Windows 11, and various versions of Windows Server should prioritize deploying the patch for this vulnerability.