grep -rl "windows" ./articles
ShieldBreak was CVE-2026-69414 in Defender's Malware Protection Engine, patched in engine 1.1.26080.3. Chaotic Eclipse has released ShieldCrash, a proof of concept that reaches the same bug through a path the fix did not close, giving arbitrary file read as SYSTEM on every supported Windows desktop.
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
Sleepwalker is a Windows backdoor with a 23-instruction custom bytecode language, AES-256-CCM, and no outbound connections at all. It sits dormant until a specially crafted packet arrives. It loads by side-loading through a security vendor's own management agent while pretending to be Microsoft's dpapi.dll — and the researcher who found it says plainly that he cannot name a single victim.
KB5121003 broke several games with access violation errors and restarts. Microsoft traced it to drivers with filenames like inpoutx64, installed by peripherals and internal components with RGB lighting. The workaround being shared is to delete a service and remove the file from the Windows drivers folder.
Marcus Hutchins at Expel picked apart SynkLoader, pushed through Microsoft Teams by attackers posing as the IT help desk and hosted on Azure so the download looks legitimate. Its PhishLocker module paints a convincing Windows 11 lock screen to harvest the password. It is a borderless full-screen app, and Alt+Tab exposes it.
MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.
Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.
WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.
CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.
CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.
AmnesiaStealer clones a Mac user's Chromium profile and streams the session back at 3fps. SpecterOps' Windows technique switches on Chrome's debugging protocol inside the running process. Neither needs your credentials, and neither is stopped by MFA.
Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.
Presented at DEF CON 34, 'Plug And Pwn' chains Windows' own driver auto-install against itself — emulate a Sierra Wireless modem, then a Sony FeliCa reader, and a DLL lands in System32. There is a Remote Desktop variant too.
Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.