NewApp Digest
search bot

vulnerability

Bitdefender is now offering a 1-year subscription for $20
Tech Optimizer
July 3, 2026

Bitdefender is now offering a 1-year subscription for $20

A 1-year subscription to Bitdefender Antivirus Plus is available for .99, reduced from its regular price of .99. The software provides real-time protection against various threats, including viruses and ransomware, and includes features like a built-in VPN with 200 MB of encrypted traffic daily, a vulnerability scanner, and anti-tracking capabilities. It is designed for easy setup and light performance impact, with automatic updates and a user-friendly dashboard. This offer is available to new and existing users in the United States and Canada.
A critical Windows 11 and Windows 10 flaw turns Microsoft Defender into a hacker's best friend
Winsage
June 30, 2026

A critical Windows 11 and Windows 10 flaw turns Microsoft Defender into a hacker’s best friend

Chaotic Eclipse, also known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft left a backdoor in the system. Following this, Microsoft patched three zero-day exploits named YellowKey, GreenPlasma, and MiniPlasma. Nightmare-Eclipse then revealed another zero-day vulnerability called RoguePlanet, which affects Microsoft Defender on Windows 10 and 11, potentially allowing attackers full control over compromised systems. Microsoft is tracking this vulnerability as CVE-2026-50656 and is working on a security update. Nightmare-Eclipse provided a proof-of-concept exploit and described it as a race condition with variable success rates. Microsoft has promoted Windows Defender as adequate for most users but acknowledged that third-party tools can offer additional protection. The company initially threatened legal action against Nightmare-Eclipse but later decided not to pursue lawsuits against researchers sharing their findings.
A critical exploit bypasses Microsoft Defender in Windows 11 and Windows 10 — so much for "everyday risk protection without additional software"
Winsage
June 30, 2026

A critical exploit bypasses Microsoft Defender in Windows 11 and Windows 10 — so much for “everyday risk protection without additional software”

Security researcher Chaotic Eclipse, known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft intentionally included a backdoor in the feature. Microsoft responded by patching three zero-day exploits disclosed by Nightmare-Eclipse: YellowKey, GreenPlasma, and MiniPlasma, and is monitoring another exploit called RoguePlanet, cataloged as CVE-2026-50656. The RoguePlanet exploit is a race condition with varying success rates on different machines, achieving a 100% success rate on some devices. Microsoft acknowledged that while Windows 11's Defender is generally sufficient for most users, third-party tools can offer additional security features. Tensions between Nightmare-Eclipse and Microsoft have risen, with the company previously considering legal action but now indicating it will not pursue lawsuits against researchers sharing their findings.
Windows Defender 'BlueHammer' vulnerability now exploited as part of malware campaigns — CISA issues warning despite patch release on April 14
Winsage
June 30, 2026

Windows Defender ‘BlueHammer’ vulnerability now exploited as part of malware campaigns — CISA issues warning despite patch release on April 14

A race condition vulnerability in Windows Defender, known as BlueHammer, has been exploited by the hacker Nightmare Eclipse, allowing attackers to gain SYSTEM user access. Microsoft released a patch for this vulnerability on April 14, but the Cybersecurity and Infrastructure Security Agency (CISA) has flagged it as actively exploited in ransomware campaigns. The average time to apply critical OS patches across Windows 10 and 11 is now 127 days, with enterprise environments averaging 76 days. Estimates suggest that 15% to 26% of Windows 10 machines remain unpatched, with a conservative estimate of 20% translating to one in five machines being vulnerable. Microsoft has extended security updates for Windows 10 until October 14, 2027, but public awareness of the updates remains low.
Microsoft keeps Windows Server 2022 hotpatching alive into 2027
Winsage
June 29, 2026

Microsoft keeps Windows Server 2022 hotpatching alive into 2027

Microsoft has extended the availability of Windows Server 2022 hotpatching until 2027, specifically for the Windows Server 2022 Datacenter: Azure Edition. Mainstream support for Windows Server 2022 will end on October 13, 2026, while extended support will last until October 14, 2031. Hotpatching allows administrators to apply security updates without server downtime, although quarterly cumulative updates requiring a reboot will still occur. This feature is exclusive to Azure Edition users, with no similar support for on-premises users of Windows Server 2022. Additionally, hotpatch updates are being introduced for Windows 11 24H2 Enterprise clients and are now the default for Windows Autopatch.
Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service
Tech Optimizer
June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.
How Cybersecurity Services Have Evolved Beyond Antivirus and Firewalls
Tech Optimizer
June 19, 2026

How Cybersecurity Services Have Evolved Beyond Antivirus and Firewalls

Businesses traditionally relied on antivirus software and firewalls for cybersecurity, which were effective when threats were simpler and data was mostly stored on-site. However, the cybersecurity landscape has evolved, with cybercriminals employing advanced tactics that traditional methods cannot adequately address. Antivirus software is limited to detecting known threats, while modern malware can evade detection by altering its code or executing in memory. Firewalls also struggle when authorized users' credentials are compromised, allowing threats to infiltrate networks. Contemporary security strategies advocate for a multi-layered approach, incorporating tools like Endpoint Detection and Response (EDR), Multi-Factor Authentication (MFA), Zero Trust Architecture, Dark Web Monitoring, and Security Awareness Training. Compliance with regulatory standards is increasingly important, and cyber insurance providers now require businesses to demonstrate comprehensive security measures. Managed security providers are becoming essential for small and mid-sized businesses, offering expertise and resources to manage complex security tools and processes effectively. Organizations should assess their current security status and adopt a layered approach to address vulnerabilities, recognizing that traditional solutions alone are insufficient in today's threat landscape.
The White House's dodgy app is being pushed to even more official government devices
AppWizard
June 18, 2026

The White House’s dodgy app is being pushed to even more official government devices

The Department of Homeland Security (DHS) has announced that The White House app will be automatically installed on all official government devices. The app, which serves as a wrapper for the official White House website, provides access to official communications but has raised security and privacy concerns due to its use of code from Elfsight, a Russian company. Elfsight previously exposed personal information of some White House staffers, and the app has been flagged for sharing sensitive user data with third-party services. Additionally, the Federal Aviation Administration (FAA) has begun automatically installing the app on all FAA-issued iPhones and iPads.
Search