vulnerability Archives

Winsage

October 16, 2026

Faster protection, fewer interruptions: How Microsoft Edge is rethinking updates

Microsoft Edge is developing a seamless-updates prototype that allows security updates to be applied without interrupting users' work. Currently, the browser has a Restart to update on idle feature that applies updates when devices are not in use. The goal is to eliminate the need for users to click an update button, enabling background updates that do not disrupt ongoing tasks. Microsoft Edge can also issue patches independently of the Chromium release schedule for urgent security needs. Additionally, Security Update Alerts help organizations manage updates by notifying administrators about critical updates and vulnerabilities. These alerts are available for managed Windows devices through the Edge management service without additional licensing.

AppWizard

October 16, 2026

Malware Found Pre-Installed In Thousands Of Budget Android Phones – Here’s What We Know

A report from Bitdefender reveals a malware campaign named "Midnight Mimosa" affecting budget and midrange Android smartphones, particularly those using low-energy MediaTek chipsets. This malware, embedded in devices marketed under various labels like Cubot and Doogee, operates through an application called "System" (package name com.android.system.lite) that displays hidden ads and can allow hackers to control the devices. Thousands of devices have been tracked with this malware, with 13% of affected devices located in Mexico, 8% in the United States, and less than 3% in Canada. The malware's source traces back to Android ODM Shenzhen Zediel. Additionally, Bitdefender identified 13 other ad fraud-related apps signed by the same entity that were previously available on the Google Play Store. Major manufacturers like Google, Motorola, and Samsung have security protocols to protect their firmware, unlike the affected budget brands.

Winsage

October 15, 2026

Windows update patches a whopping 1,400 security bugs – including 2 zero days

Microsoft released the October Windows update, addressing over 1,400 vulnerabilities, including 80 critical vulnerabilities and two zero-day exploits. This update is the final supported update for Windows 11 24H2 Home and Pro editions and the first for Windows 11 26H2. Notable enhancements include improvements to File Explorer and refined Bluetooth connectivity. One zero-day vulnerability, CVE-2026-96951, has been exploited in the wild, allowing remote attackers to bypass security protections. The second zero-day, CVE-2026-108398, could enable attackers to circumvent security measures in Microsoft’s .NET Framework. Windows 11 users can install the update via Settings and Windows Update, while Windows 10 users can follow a similar process. Each annual version, such as 24H2, will lose support after 24 months, necessitating an upgrade to Windows 11, version 26H2, for continued security updates. The update also introduces a feature to remap the Copilot key for enhanced user flexibility.

Winsage

October 15, 2026

Microsoft breaks record, fixing 1,416 security flaws. Update Windows now

Microsoft has identified 1,416 vulnerabilities in its systems, with 85 classified as “critical.” Among these, 67 are categorized as remote code execution (RCE) vulnerabilities. One vulnerability is actively exploited, and two have been publicly disclosed. The upcoming Patch Tuesday is on November 10th, 2026, and users are advised to upgrade to Windows 11 25H2 or 26H2. A specific vulnerability, CVE-2026-96951, allows attackers to bypass system defenses by masking the origin of executable files. Microsoft has flagged 42 critical vulnerabilities, including 30 RCE vulnerabilities, which can allow attackers to execute malicious code remotely.

Winsage

October 14, 2026

Microsoft breaks record, fixing 1,416 security flaws. Update Windows now

Microsoft has identified 1,416 vulnerabilities within its systems, with 85 classified as "critical." Among these, 67 are remote code execution (RCE) vulnerabilities. One vulnerability is actively exploited, and two others were disclosed prior to the assessment. The next opportunity for users to address these vulnerabilities will be on November 10th, 2026, during Patch Tuesday. Users are encouraged to upgrade to Windows 11 versions 25H2 or 26H2. A specific vulnerability, CVE-2026-96951, allows attackers to bypass system defenses by masking executable file origins. Of the critical vulnerabilities, 30 are RCE vulnerabilities that enable remote execution of malicious code without authentication or user interaction.

Winsage

October 14, 2026

GLM’s 23 Windows Bug Finds Are Z.ai Building a Security Research Resume

Z.ai's GLM model identified 23 vulnerabilities in the Windows operating system, confirmed by Microsoft's Security Response Center (MSRC). This marks a significant advancement in commercial software security, demonstrating the model's autonomous capability in independent vulnerability discovery. Since the release of GLM-5.2, Z.ai has uncovered over 4,200 vulnerabilities across about 390 open-source projects, with over a thousand categorized as critical to high severity. Z.ai has established a public Security Disclosure Ledger to track its findings through a coordinated disclosure process. The confirmation of vulnerabilities by MSRC is notable due to the rigorous nature of their vulnerability triage operations. Z.ai's GLM-5.3 achieved a score of 84.5% on CyberGym, outperforming competitors like Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol. Reports indicate that NIST's AI safety division has flagged GLM-5.3 due to concerns about its cyber capabilities, particularly regarding the potential for modified versions to reduce safety features. Z.ai plans to continue targeting commercial software in its efforts.

Winsage

October 14, 2026

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Microsoft's October 2026 Patch Tuesday updates addressed 1,413 vulnerabilities, including 1,102 in Windows, 134 in Office applications, 61 in developer tools, and 36 related to SharePoint Server. This total surpasses the vulnerabilities fixed by Microsoft in all of 2025, with over 4,000 vulnerabilities resolved in 2026. A critical zero-day vulnerability, CVE-2026-96951, with a CVSS score of 8.8, was also patched; it allows attackers to bypass Windows shell security features. The Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerabilities catalog. Additionally, two publicly disclosed vulnerabilities were patched, and Microsoft introduced 'risk cohorts' to help manage security updates.

Winsage

October 14, 2026

Windows 11 October updates fix zero-day, VPN failures, and black screens

Microsoft released its October 2026 Patch Tuesday updates for Windows 11, addressing 1,413 vulnerabilities, including a critical fix for an exploited Windows Shell vulnerability (CVE-2026-96951) that bypasses Mark of the Web defenses. This update is the last monthly security update for Windows 11 24H2 Home and Pro users, who must upgrade to a supported version for future security fixes. The update packages KB5127648 and KB5127646 cover versions 24H2, 25H2, and 26H2, and also include fixes for reliability issues such as Explorer.exe startup failures, VPN connection problems, and gaming mouse stuttering. Additionally, the update resolves issues with AC-3 playback, printing failures, and fingerprint sign-in failures after a cold boot. Users are advised to install the updates promptly and restart their systems to complete the process.

Winsage

October 14, 2026

Microsoft’s Record October Patch Tuesday Fixes 1,400+ Flaws As Windows Zero-Day Comes Under Attack

Microsoft's October 2026 security updates address 1,411 vulnerabilities, marking the largest Patch Tuesday release to date. The update includes 70 vulnerabilities classified as Critical, with 57 related to remote code execution, 11 to elevation of privilege, and two to spoofing. Key vulnerabilities include CVE-2026-96951, a Windows Shell security bypass being actively exploited, CVE-2026-108398, which affects .NET Framework and allows bypassing Windows Defender Application Control, and CVE-2026-92707, a denial-of-service vulnerability in MessagePack-CSharp. The release coincides with critical Windows support deadlines, with the final regular update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 occurring on October 13. Organizations are advised to prioritize the exploited vulnerabilities, ensure relevant updates are applied, and validate application-control behavior.

Winsage

October 12, 2026

Windows 11 24H2 hits end of updates Oct. 13: What you should do now

Windows 11 version 24H2 for Home and Pro systems will stop receiving security updates on October 13, 2026. After this date, these editions will not receive any updates or technical support, although they will still boot. Windows 11 Enterprise, Education, IoT Enterprise, and Enterprise multi-session editions will continue to receive support until October 12, 2027. Organizations are advised to verify their systems' versions and editions, especially for those without endpoint management systems. Windows 11 25H2 and 26H2 are available as upgrade options, with 25H2 supported until October 12, 2027, and 26H2 supported until October 10, 2028, for Home and Pro editions. The rollout of 26H2 will be phased, and safeguard holds may be implemented if compatibility issues are detected. Unmanaged Home and Pro devices on 24H2 will automatically receive 25H2, while managed devices may require IT intervention. Regular monitoring and proactive management of Windows versions are necessary to ensure compliance and avoid future deadlines.