grep -rl "microsoft" ./articles
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
Attackers hid characters from Unicode's Tags block inside words like funding and credit, splitting them so keyword matching could not see them, and pushed up to 2.37 million messages a day. Microsoft says over 99% were caught anyway — by sender reputation, IP and domain signals. The technique defeated exactly one layer.
Microsoft documented a campaign of counterfeit vendor sites whose installers disable four Windows Update services, rename the update DLLs, set Defender exclusions and then lock the ACLs against standard users. The payload hash changes on every download, so there is no hash to block.
TerminalFix is ClickFix with one substitution. A fake Cloudflare CAPTCHA asks you to paste a command, and instead of the Run dialog it sends you to Windows Terminal or PowerShell — where long multi-line scripts actually work. The end of the chain is a Python reverse tunnel that lets the operator reach anything your machine can see.
Two DMCA subpoenas filed in New York on 20 August demand that Microsoft and Discord hand over device identifiers, IP addresses, phone numbers, linked accounts and OneDrive contents — for every account that spoke in three named servers since 1 June. One of those servers belongs to a streamer who says he knows nothing about it. The deadline is 4 September.
KB5121003 broke several games with access violation errors and restarts. Microsoft traced it to drivers with filenames like inpoutx64, installed by peripherals and internal components with RGB lighting. The workaround being shared is to delete a service and remove the file from the Windows drivers folder.
Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.
WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.
CVE-2026-69836 is a real maximum-severity flaw in Entra ID, and Microsoft fixed it cloud-side with nothing for customers to do. For most of 21 August its own bulletin marked it exploited in the wild. Microsoft corrected that field to No after a reporter asked. The correction has not travelled the way the original did.
Microsoft's Orkney experiment is real and the 1/8th failure rate is Microsoft's own figure. But the cause it gave was a sealed dry-nitrogen atmosphere with nobody walking around inside, which you can build on land. China's $226 million Shanghai project is also real, is running, and raises a question the viral version says nobody has studied. People have studied it.
Huntress reports password spraying up 155x in the first half of 2026, driven by a campaign against Azure CLI that abuses ROPC, a deprecated OAuth grant which posts your username and password straight to the token endpoint with no interactive MFA prompt. In two weeks it made 81 million login attempts.
CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.
Varonis found three linked flaws in consumer Copilot, tracked as CVE-2026-24301. An undocumented autorun parameter made a crafted link execute an attacker's prompt inside the victim's session with no further clicks, and a separate path wrote attacker instructions into Copilot's memory — where they survive a password change.
CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.
CVE-2026-45659 was patched in May, flagged as exploited on 1 July with a three-day federal deadline, and marked as used in ransomware on 11 August. Of 8,500 SharePoint servers exposed online, 200-plus remain vulnerable.
Microsoft's analysis describes two Polygon wallet addresses holding proxy URLs and leak-blog posts, with negotiation over Session. There is no hosting provider to serve, because there is no hosting.
Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.
Microsoft attributes StormEncryptor, a new C++ locker, to the China-linked group. Initial access was likely CVE-2026-18577 in N-able N-central, which is itself a bypass of the earlier fix. CISA has both flagged as exploited.
Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.