Three Active Directory Flaws Can Bypass Windows Security Controls
Microsoft has patched three remotely reachable Active Directory security-feature bypass vulnerabilities. Although no active exploitation has been reported, defenders should prioritize domain controllers because identity infrastructure sits at...
Microsoft Patches Windows Shell Zero-Day Used to Evade Download Warnings
Microsoft has fixed CVE-2026-96951, an actively exploited Windows Shell flaw that can bypass Mark of the Web protections. Organizations should prioritize the October 2026 update while reinforcing controls...
Microsoft’s October Patch Tuesday Fixes Over 1,100 Flaws and Debuts a New Way to Triage Them
Microsoft's October 2026 Patch Tuesday addressed 1,118 vulnerabilities, one of its largest releases yet, and introduced an experimental 'risk cohort' framework that groups flaws by the shared exposure...
Unsigned JWT Flaw Opened Microsoft Analytics Service to Administrator Access
A missing signature check in Microsoft’s internal Titan analytics service allowed a forged token to obtain administrator privileges and query connected databases. Microsoft closed the public endpoint after...
N0va Phishing Kit Hijacks Real Microsoft Logins to Steal Session Tokens
A new phishing kit called N0va abuses legitimate device-code authentication flows for Microsoft, Google, and other trusted services to steal access and refresh tokens rather than passwords. The...
Microsoft’s September Patch Wave Fixes 973 Flaws and Two Exploited Zero-Days
Microsoft’s September 2026 security release addresses 973 vulnerabilities across Windows, Office, SQL Server and other enterprise products. Two privilege-escalation zero-days are already being exploited, making rapid testing and...
Microsoft’s September Patch Tuesday Closes 973 Holes, Including Two Zero-Days Already Under Attack
Microsoft's September 2026 security update addresses 973 vulnerabilities — one of its largest releases on record — including two Windows elevation-of-privilege flaws that attackers are actively exploiting. Several...
Microsoft’s New Windows Tool Quietly Resets Chrome, Firefox, and Brave to Bing
A newly spotted Microsoft installer called MicrosoftSettings.exe pushes a browser extension that switches Chrome, Firefox, and Brave over to Bing search and the MSN homepage. Security researchers note...