NewApp Digest
search bot

vulnerable systems

silver Android smartphone
Winsage
December 15, 2025

Still running Windows 10? Here’s why that’s a bad idea

Hundreds of millions of computers are still using Windows 10, despite it reaching its end-of-support deadline. An Extended Security Updates (ESU) subscription is available for free until October 2026, providing updates to help protect against security threats. By early 2021, around 100 million PCs were still running Windows 7, which had ceased receiving updates in January 2020, making them vulnerable to cyberattacks from groups like Digital Shadows, LockBit, Conti, and Vice Society. Notable incidents include the PrintNightmare flaw in July 2021, which led Microsoft to issue a patch for Windows 7, and the WannaCry attack in 2017, which targeted Windows XP machines. Microsoft releases monthly security fixes, and vulnerabilities like CVE-2025-62215, identified in November 2025, have been categorized as "Exploitation Detected." While current vulnerabilities require local access, history suggests that remote attacks may soon occur, posing severe risks to unpatched systems.
Google probes exploitation of critical Windows service CVE
Winsage
October 28, 2025

Google probes exploitation of critical Windows service CVE

The Google Threat Intelligence Group (GTIG) is investigating cyberattacks linked to a hacker exploiting a vulnerability in the Windows Server Update Service (WSUS), specifically CVE-2025-59287. The threat actor, UNC6512, has targeted multiple organizations, gaining access to systems, conducting reconnaissance, and exfiltrating data. Despite a Microsoft patch released earlier, it has been ineffective. Researchers from HawkTrace and Eye Security have identified suspicious activities related to the vulnerability, with Eye Security noting at least two adversaries exploiting it. Palo Alto Networks Unit 42 confirmed the use of malicious PowerShell commands for exploitation. Shadowserver reported around 2,800 instances exposed to this flaw. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and is urging users to implement the patch. CISA has found no evidence of federal agency impacts but encourages reporting of suspicious activities.
CISA orders feds to patch actively exploited Windows Server WSUS flaw
Winsage
October 28, 2025

CISA orders feds to patch actively exploited Windows Server WSUS flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated U.S. government agencies to address a critical vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287, which allows for remote code execution (RCE) on affected servers. Microsoft has released out-of-band security updates for this vulnerability, and IT administrators are urged to implement these updates immediately. For those unable to do so, CISA recommends disabling the WSUS Server role on vulnerable systems. Active exploitation attempts targeting WSUS instances have been detected, and CISA has also added a second vulnerability affecting Adobe Commerce to its Known Exploited Vulnerabilities catalog. U.S. Federal Civilian Executive Branch agencies are required to patch their systems by November 14th, 2023, under the Binding Operational Directive 22-01. CISA emphasizes the need for organizations to address these vulnerabilities to mitigate risks of unauthorized remote code execution.
Windows Server emergency patches fix WSUS bug with PoC exploit
Winsage
October 24, 2025

Windows Server emergency patches fix WSUS bug with PoC exploit

Microsoft has released out-of-band security updates to address a critical-severity vulnerability in its Windows Server Update Service (WSUS), tracked as CVE-2025-59287. This remote code execution flaw affects Windows servers with the WSUS Server Role enabled, allowing low-complexity remote attacks without user interaction. If the WSUS server role is enabled and the fix is not installed, the server becomes vulnerable. Microsoft recommends that customers install the updates immediately and provided alternative measures, such as disabling the WSUS Server Role or blocking inbound traffic to Ports 8530 and 8531. The update is cumulative and supersedes all previous updates for affected versions. After installation, WSUS will no longer display synchronization error details as a temporary risk mitigation measure.
Why Windows 95 left HLT on the cutting-room floor
Winsage
September 10, 2025

Why Windows 95 left HLT on the cutting-room floor

Raymond Chen discussed the HLT instruction, which was designed to reduce power consumption by putting the CPU into a low-power state, particularly benefiting laptops. Although implemented in Windows 95, Microsoft removed it due to some devices becoming irretrievably locked when the instruction was executed. The company chose not to create exceptions for affected devices because of uncertainty regarding the number of vulnerable systems in circulation. By the time Windows 95 was ready for release, not all problematic systems had been identified, leading to the decision to exclude the HLT instruction to avoid widespread issues. This decision resulted in the emergence of a niche market for software that executed the HLT instruction, accompanied by criticism of Microsoft. Chen highlighted the risks of bricking laptops due to the instruction, noting that users faced difficulties uninstalling problematic programs if their systems froze.
Windows KDC Proxy RCE Vulnerability Let Attackers Control The Server Remotely
Winsage
March 5, 2025

Windows KDC Proxy RCE Vulnerability Let Attackers Control The Server Remotely

A critical remote code execution vulnerability, designated as CVE-2024-43639, has been identified in Microsoft’s Windows Key Distribution Center (KDC) Proxy. This flaw arises from an integer overflow due to a missing validation check for Kerberos response lengths, allowing unauthenticated remote attackers to execute arbitrary code with the privileges of the target service. The vulnerability specifically affects KDC Proxy servers and was addressed in a November 2024 security update by implementing necessary length validation checks. Organizations using remote authentication services reliant on the KDC Proxy, such as RDP Gateway or DirectAccess, are particularly at risk. Immediate patching is advised, and monitoring for potential exploitation attempts is recommended.
Windows 10 on the brink of extinction: This is how vulnerable you really are!
Winsage
February 5, 2025

Windows 10 on the brink of extinction: This is how vulnerable you really are!

Microsoft will cease support for Windows 10 in October 2025, meaning new security vulnerabilities will not be patched, increasing exposure to threats. Cybercriminals are expected to target Windows 10, which still has over 60% market share, making it an attractive target. ESET estimates that around 32 million PCs in Germany are still using Windows 10. Users can opt for the Extended Security Updates program for an additional cost, extending updates until October 2026, or use 0Patch for updates until 2030. Windows 10 IoT Enterprise LTSC 2021 will receive updates until 2032, but its use as an office PC is restricted. Users are encouraged to upgrade to Windows 11 where hardware compatibility exists for ongoing security updates and new features.
CISA warns of Windows flaw used in infostealer malware attacks
Winsage
September 18, 2024

CISA warns of Windows flaw used in infostealer malware attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has directed U.S. federal agencies to strengthen their systems against the Windows MSHTML spoofing zero-day vulnerability identified as CVE-2024-43461. This vulnerability was initially deemed non-exploited by Microsoft but was later confirmed to have been exploited before its patch. Attackers, including the Void Banshee hacking group, used this vulnerability to install information-stealing malware by deceiving users into opening malicious files disguised as harmless documents. CISA has included this vulnerability in its Known Exploited Vulnerabilities catalog and has mandated that federal agencies secure their systems within three weeks, with a deadline of October 7. Additionally, Microsoft has addressed three other actively exploited zero-days in its September 2024 Patch Tuesday updates.
PoCcode released for zero-click Windows critical vuln
Winsage
August 29, 2024

PoCcode released for zero-click Windows critical vuln

A critical vulnerability in Windows, designated CVE-2024-38063, has been identified with a CVSS score of 9.8, allowing unauthenticated attackers to execute code remotely on unpatched machines via specially crafted IPv6 packets. All versions of Windows 10, Windows 11, and Windows Server are affected. A temporary workaround is to disable IPv6 and revert to IPv4. Microsoft released a patch for this vulnerability on August 13, but system administrators often delay patch installations, leading to exploitation opportunities. A developer has released proof-of-concept code for the vulnerability. Marcus Hutchins noted the rapid identification of the flaw, which stemmed from a single change in the driver file. Users are urged to patch their systems promptly to mitigate risks.
Search