vulnerability Archives

Tech Optimizer

July 11, 2026

Microsoft closes RoguePlanet vulnerability in Defender: SYSTEM privileges via the antivirus engine

A vulnerability known as RoguePlanet was identified in Microsoft Defender, tracked as CVE-2026-50656. This flaw allows local privilege escalation to the NT AUTHORITYSYSTEM account, requiring an attacker to have local code execution capabilities. It can be exploited through methods such as opening malicious email attachments. The vulnerability is categorized under CWE-59: “Improper Link Resolution Before File Access” and involves a race condition that affects the Defender engine's operations. RoguePlanet was disclosed by security researcher Nightmare-Eclipse on June 10, 2026, and confirmed by various security firms. Microsoft released a fix in version 1.1.26060.3008 of the Microsoft Malware Protection Engine, which should be installed automatically in standard Windows configurations. Users can verify their engine version using PowerShell. The vulnerability affects both Windows 10 and Windows 11 systems with the June 2026 security updates, and disabling real-time protection does not reliably mitigate it.

TrendTechie

July 11, 2026

Assassin’s Creed Black Flag Resynced залили на торренты до официального релиза

Assassin’s Creed Black Flag Resynced was leaked hours after the PC pre-load opened, with a pirated version appearing on torrent sites. The leak originated from an unencrypted build uploaded during the pre-load phase. Pirates bypassed security measures using a hypervisor, requiring the disabling of several Windows security features. The official launch for PC is scheduled for July 9, with console players also gaining access at midnight on that date in their respective time zones.

AppWizard

July 10, 2026

Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

Researchers analyzed 281 popular free VPN applications on the Google Play Store and found significant privacy and security shortcomings. The study, conducted by teams from the University of Michigan, the University of New Mexico, and IIT Delhi using a framework called MVPNalyzer, revealed that flagged apps had over 2.4 billion downloads. Key findings included: - Five apps transmitted configuration files unencrypted, allowing attackers to intercept and modify them. - 29 apps allowed user traffic to leak outside the encrypted tunnel, with 24 leaking DNS traffic and six leaking full browsing traffic. - 169 apps made no effort to disguise their traffic, making it identifiable to network operators or government censors. - 76 apps transmitted the device's Advertising ID to advertisers, and over 80% contacted known advertising and tracking servers. - Only one of 108 OpenVPN configurations adhered to recommended security practices; 89% used a single authentication method, and nearly 20% employed outdated encryption techniques. - Many apps passed through Play Store checks without adequate scrutiny, with safety labels often serving as marketing tools rather than security indicators. These findings align with previous research highlighting similar issues in popular Android VPN apps. Users are advised to be cautious when selecting VPNs, prioritizing those with recent independent security audits.

Winsage

July 10, 2026

Microsoft goes all in on new AI-powered Windows security strategy – what it means for you

Microsoft is integrating artificial intelligence into its vulnerability management processes to enhance cybersecurity, particularly for its Windows operating system used by over 1.5 billion devices. The company is implementing an automated, AI-driven approach to identify vulnerabilities earlier in the development cycle, allowing for quicker fixes. Microsoft has developed a cloud-based scanning system called MDASH, which has identified 16 vulnerabilities since its introduction, four of which were critical and promptly patched. AI tools are being embedded earlier in the software development lifecycle, and Microsoft is updating its Secure Development Lifecycle best practices to address potential AI-enabled attack techniques. The shift towards an AI-enhanced system will lead to an increase in the volume of security updates, requiring enterprise administrators to adopt more agile approaches to testing and deploying updates. Microsoft has introduced a feature called Known Issue Rollback (KIR) to help admins revert problematic changes. The company emphasizes the importance of human oversight in evaluating AI findings and making informed decisions.

Winsage

July 10, 2026

Patch for Windows Defender 0-day could allow attackers to fill hard disk

A recent Microsoft patch addressing the RoguePlanet vulnerability (CVE-2026-50656) in its Defender security engine has raised concerns about disk space issues for Windows users. The vulnerability allows remote attackers to gain administrative control over Windows 10 and 11 systems. The patch, which updates the Microsoft Malware Protection Engine, is automatically installed without user action. However, it may enable attackers to fill a hard drive by writing excessive data due to changes in the mpengine.dll driver. These changes can cause a data leak of 8 bytes when opening a file and involve new functionalities in SpyNet, which could lead to mass file-writing behavior. Typically, Defender limits file sizes during scanning, but the spynet functions may maintain a local copy of the Zone.Identifier Alternate Data Stream file, potentially exhausting disk space.

Winsage

July 9, 2026

Evolving Windows vulnerability management to meet the speed of AI-powered discovery

Microsoft is enhancing its security measures for Windows by integrating artificial intelligence (AI) to improve the discovery and analysis of vulnerabilities across its codebase. This includes the use of a multi-model agentic scanning harness (MDASH) that employs various AI models to identify and validate potential vulnerabilities efficiently. A dedicated cloud infrastructure supports this scanning process, which aims to minimize false positives and reduce the time from discovery to customer protection. The company collaborates across divisions to promote AI-powered tools and practices, refining its internal systems to integrate vulnerability discovery into development processes. This includes updating Secure Development Lifecycle (SDL) practices to address AI-enabled attack techniques. Customers can expect an increase in security updates as AI enhances vulnerability discovery capabilities. Windows updates undergo rigorous validation through programs like the Security Update Validation Program (SUVP) to ensure quality and compatibility. Microsoft also offers tools like Known Issue Rollback (KIR) for quick reversion of changes if issues arise during updates. Customers are encouraged to stay current with security updates and utilize resources like the Security Update Guide for prioritizing protections. To facilitate smoother update processes, Microsoft provides optional non-security preview releases for compatibility testing and employs modern management capabilities like Windows Autopatch to automate security updates. Azure Arc enables rebootless updates for Windows Servers, while Microsoft Defender and Intune help manage vulnerabilities and compliance across endpoints. Overall, Microsoft is committed to continuous improvement in its security practices to adapt to the evolving threat landscape and ensure customer protection through timely updates.

Winsage

July 9, 2026

Microsoft Details How It’s Using AI to Improve Windows Security

Microsoft has reaffirmed its commitment to security, focusing on enhancing protection for Windows users. The company is utilizing a multi-model agentic scanning harness (MDASH) that incorporates various AI models to identify Windows vulnerabilities earlier in the development process. This proactive approach allows security experts to detect potential issues before public releases. Microsoft is also investing in technologies that use AI to streamline the development of fixes while maintaining human oversight during code reviews. The company acknowledges the dual nature of AI in security, as it accelerates both the identification of vulnerabilities and the potential for exploitation. Microsoft aims to strengthen its systems to find vulnerabilities earlier and deliver timely security patches to customers.

Tech Optimizer

July 8, 2026

Critical PHP PDO Driver Bugs Expose Firebird SQL Injection and PostgreSQL DoS Risks

A recent examination of PHP's database driver layer revealed two significant vulnerabilities in PHP Data Objects (PDO) affecting the pdo_firebird and pdo_pgsql drivers. The first vulnerability, CVE-2026-25289, allows SQL injection attacks through NUL byte manipulation in quoted strings, compromising the safety of SQL statements. The second vulnerability, CVE-2026-25290, can cause application crashes due to null pointer dereferencing when invalid multibyte character sequences are processed. Both vulnerabilities stem from assumptions about C string handling and have been addressed in a security release. Researchers recommend treating binary input as untrustworthy and encapsulating financial workflows within atomic transactions.

Tech Optimizer

July 7, 2026

PDO PostgreSQL Bug Triggers NULL Pointer Dereference and Crashes PHP Worker Processes

Researchers at Positive Technologies have identified two significant vulnerabilities in the PHP Data Objects (PDO) extension layer, both posing high severity risks. The first vulnerability (CVE-2025-14180) leads to a NULL pointer dereference, causing PHP worker processes to crash. It affects PHP versions 8.1.x prior to 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1. This issue occurs when the pdo_pgsql driver operates with PDO::ATTR_EMULATE_PREPARES enabled, allowing a remote attacker to exploit it without authentication by submitting malformed character sequences. The second vulnerability (CVE-2025-14179) allows for SQL injection and affects PHP versions 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6. It arises from a mishandling of NUL bytes in the Firebird driver during the PDO::prepare() process, despite the quoting routine functioning correctly. Additionally, the audit revealed an integer overflow in PostgreSQL’s libpq client library and an information disclosure flaw in Firebird 3’s fbclient.

Winsage

July 6, 2026

Microsoft just broke custom folder icons in Windows, and the reason is a bug from 2003

Microsoft has updated Windows to stop trusting untrusted desktop.ini files, a change aimed at addressing a long-standing security vulnerability that has existed since 2003. This decision affects the display of custom folder icons, as Windows will now ignore customization metadata from potentially unsafe sources. Users can still use custom folder icons if the desktop.ini file and icon resources come from trusted locations. A workaround allows users to manually create a desktop.ini file with the desired icon while following new security protocols.