Attackers Exploit Windows Driver to Gain SYSTEM Privileges
Microsoft's August updates fix an AFD.sys race used in attacks; defenders must verify fixed builds and investigate pre-patch privilege escalation.
Read article →endpoint
Endpoint security, malware, device controls, and host visibility.
Microsoft Fixes LegacyHive Flaw That Gives Local Attackers Admin Rights
August Windows updates fix a public registry-hive privilege escalation; defenders can hunt its staging files, virtual paths, and unusual DLL loads.
Read article →
Public Open vSwitch Exploit Gives Local Linux Users Root Access
OVSwrap exploits a 16-bit nested-action limit in the Linux kernel, leaving defenders to verify both the running fix and the earlier exposure window.
Read article →
Microsoft Defender Isolated a QNET Workstation in 128 Seconds
A Microsoft case study traces mshta execution to one isolated QNET host and shows which workstations qualify for the preview action.
Read article →
SCTPhantom Exposes Linux SCTP to Remote Attack and Local Root
A remote SCTP peer can trigger the kernel flaw, while Tencent separately demonstrated local privilege escalation and container escape. Defenders need both reachability and running-kernel checks.
Read article →
Cisco Fixes Seven IOS XE Flaws With No Workarounds
Cisco's August IOS XE hardening release fixes seven vulnerability classes across five reviewed trains; affected devices need an upgrade.
Read article →
Flooding Dropper Used 846 npm Components as Cross-Platform Loaders
An automated npm campaign uses hundreds of disposable packages to launch detached native malware, with DNS TXT records as a fallback delivery channel.
Read article →
Remus Malware Stores Command Server Addresses in Ethereum Contracts
Remus uses an Ethereum smart contract to resolve changing command infrastructure before stealing browser sessions, credentials, and wallet data.
Read article →
Windows Hello Keys Let Signed-In Code Create Persistent Entra Access
Code in a signed-in Windows session can invoke a TPM-backed Windows Hello for Business key, authenticate without a device identity claim, and create a path to durable Entra access.
Read article →
BINDCLOAK Duplicates Windows Tokens to Run Modules as Another User
BINDCLOAK collects Windows user and process tokens, duplicates them, and starts modular malware components inside more privileged security contexts.
Read article →
Researchers Forge WSUS Updates Through Standalone Microsoft SQL Server
SpecterOps shows how relayed WSUS machine-account access can forge targeted updates and bypass payload signature checks when SUSDB runs on a separate SQL Server.
Read article →
CISA Sets August 7 Deadline for Three Exploited Enterprise Flaws
Langflow, N-central, and Tomcat flaws entered CISA's exploited catalog. One gives unauthenticated callers Python execution by default.
Read article →
18 npm Packages Hid a RAT Across a Benign-Looking Dependency Chain
A targeted npm cluster split its downloader across ordinary-looking modules, then escaped Node.js vm isolation to install a cross-platform RAT on developer systems using Alibaba tools.
Read article →Showing 53–65 of 77