Researchers at Kaspersky have identified a new vulnerability in the Remote Procedure Call (RPC) architecture of Windows. This flaw allows an attacker to set up a counterfeit RPC server, which they can then use to gain elevated privileges on a target system. The implications of this vulnerability are significant, as it could enable attackers to execute malicious actions with higher access rights, potentially compromising sensitive data and system integrity. Organizations using affected systems should be vigilant and consider implementing security measures to defend against this exploitation. The discovery emphasizes the need for regular updates and security practices to mitigate such risks.
Articles tagged "Microsoft"
Found 196 articles
Critical
Actively exploited SharePoint spoofing bug continues to threaten over 1,300 instancesSCM feed for Latest
Actively Exploited
A critical vulnerability in Microsoft SharePoint, identified as CVE-2026-32201, is currently being exploited by attackers. Over 1,300 SharePoint servers exposed to the internet remain at risk, with fewer than 200 instances patched since the last Patch Tuesday. This zero-day spoofing flaw allows unauthorized access, which could lead to significant data breaches or further intrusions. Organizations using SharePoint should prioritize applying available updates to mitigate the risk and secure their systems against ongoing attacks. The situation underscores the urgency for users to remain vigilant and proactive in patch management.
Actively Exploited
A newly discovered vulnerability in Microsoft Defender has been exploited as a zero-day, allowing attackers to access the Security Account Manager (SAM) database. This flaw enables them to extract NTLM hashes, potentially granting them system-level privileges. This is particularly concerning as it affects a widely used security solution, which could put numerous systems at risk. Organizations using Microsoft Defender should be vigilant, as this exploitation may lead to unauthorized access to sensitive data and systems. The urgency of addressing this vulnerability cannot be overstated, given its potential impact on user security.
Microsoft has issued emergency updates to address issues that arose after the installation of the April 2026 security updates on Windows Server systems. These out-of-band updates were necessary due to problems that could disrupt server functionality for users. Affected systems include various versions of Windows Server, particularly those that had recently applied the April updates. Organizations relying on these servers need to apply the updates promptly to avoid potential disruptions. By addressing these issues quickly, Microsoft aims to minimize any impact on businesses and maintain system stability.
A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) exploit for a zero-day vulnerability in Microsoft Defender, identified as 'RedSun'. This follows the earlier disclosure of an exploit for another flaw in Defender, tracked as CVE-2026-33825, known as the BlueHammer flaw. The implications of these exploits are significant, as they expose users of Microsoft Defender to potential attacks that could compromise system security. Organizations using this antivirus solution should be particularly vigilant, as the release of these exploits could lead to increased attempts at exploitation by malicious actors. It's crucial for users to stay informed about updates from Microsoft regarding these vulnerabilities.
Critical
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More StoriesThe Hacker News
Actively Exploited
This week saw several notable cybersecurity incidents, including a zero-day vulnerability affecting Microsoft Defender. Attackers are exploiting this flaw to bypass security measures, putting users at risk. Additionally, SonicWall reported a brute-force attack targeting their products, which could compromise user accounts. In another concerning development, a 17-year-old remote code execution (RCE) vulnerability in Microsoft Excel remains a threat, proving that outdated software can still be a significant risk. These incidents emphasize the need for organizations to stay vigilant and ensure their systems are updated and secure.
Critical
Ransomware-Linked ViperTunnel Malware Hits UK and US BusinessesHackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
ViperTunnel is a new backdoor malware linked to the DragonForce ransomware, specifically targeting businesses that operate on Windows servers in the US and the UK. This Python-based malware allows attackers to gain unauthorized access to systems, which can lead to data theft or further exploitation. Companies utilizing Windows server environments should be particularly vigilant, as the malware poses a significant risk to their operations and data security. The emergence of ViperTunnel highlights the ongoing challenges businesses face in protecting their networks from evolving ransomware threats. Organizations are urged to implement strong security measures and regularly update their systems to fend off such attacks.
Recent allegations suggest that Microsoft is engaging in corporate espionage through its LinkedIn browser extension, raising concerns about user privacy. However, security researchers are analyzing these claims and have found mixed results regarding the extent of data collection by the extension. While some users are worried about their information being tracked or misused, the research indicates that the data collection practices may not be as invasive as initially claimed. This debate over LinkedIn's data handling practices is crucial as it could impact user trust and privacy standards across similar platforms. Understanding the reality behind these accusations is important for users who rely on LinkedIn for networking and job opportunities.
A recently patched vulnerability in the EngageLab SDK, a third-party software development kit used in many Android applications, has potentially exposed the private data of around 50 million users, including 30 million cryptocurrency wallet holders. The flaw allowed apps on the same device to bypass Android's security measures, enabling unauthorized access to sensitive information. This incident raises significant concerns about the security of users' cryptocurrency assets, as the compromised data could have led to theft or fraud. Developers using the EngageLab SDK are urged to update their applications to protect users from potential attacks. The vulnerability was identified and addressed, but users should remain vigilant about app permissions and security practices.
Actively Exploited
A new privilege escalation vulnerability, dubbed 'BlueHammer', has been identified in Windows operating systems. This flaw, which merges a time-of-check to time-of-use (TOCTOU) vulnerability with path confusion, allows attackers to gain higher-level access to systems. Users of affected Windows versions are particularly at risk, as this could enable unauthorized actions that compromise system security. The release of exploit code for BlueHammer raises concerns about its potential use in cyberattacks, making it crucial for organizations to address this vulnerability promptly. Keeping systems updated and applying any available patches will be essential to mitigate the risks associated with this flaw.
Critical
Missile Alert Phishing Exploits Iran-US-Israel Conflict for Microsoft LoginsHackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
A new phishing scam is exploiting the ongoing conflict between Iran, the US, and Israel by sending out fake missile alerts to trick users into revealing their Microsoft login credentials. Attackers are using QR codes and counterfeit government emails to lure victims. This tactic is particularly concerning as it preys on the heightened anxiety surrounding geopolitical tensions, making users more susceptible to clicking on malicious links. The scam underscores the importance of vigilance regarding unsolicited communications, especially during times of crisis. Users are advised to verify the authenticity of any alerts before taking action, particularly those requesting sensitive information.
Windows 11 users who attempted to install a problematic preview update released in March are encouraged to download a new out-of-band update that fixes installation errors. This recent update addresses issues that may have prevented users from successfully applying the earlier version. Affected users should check for the latest updates in their system settings to ensure they have the fix installed. This situation is important because installation errors can disrupt users' workflows and impact system stability. Keeping software up to date is crucial for security and performance.
Microsoft links Classic Outlook issue to email delivery problems
BleepingComputer
Microsoft is currently addressing an issue that affects some users of Classic Outlook trying to send emails through Outlook.com. The problem has been acknowledged as part of ongoing investigations into email delivery failures. While the company has not specified the exact number of users impacted, it is clear that those relying on Classic Outlook for their email communications are experiencing significant disruptions. This situation is important because it highlights the challenges users may face with legacy software in modern environments, potentially affecting business communications and personal messaging. Microsoft is working on a solution, but users should be aware of potential delays in their email delivery until the issue is resolved.
Microsoft pulls KB5079391 Windows update over install issues
BleepingComputer
Microsoft has withdrawn the KB5079391 update for Windows 11 after users reported installation issues resulting in error code 0x80073712. This non-security preview update was intended to enhance the operating system but instead caused problems for those attempting to install it. The company is now investigating the source of the error, which is affecting users who downloaded this particular update. For many, this means they may have to wait longer for fixes or improvements that were supposed to come with the update. It's a reminder of the potential complications that can arise from software updates and the importance of monitoring system changes closely.
Actively Exploited
A pro-Ukrainian hacking group known as Bearlyfy has carried out over 70 cyber attacks against Russian companies since January 2025. Their recent campaigns have utilized a custom ransomware known as GenieLocker, which targets Windows systems. This group aims to disrupt operations in Russian businesses, indicating a strategic move in the ongoing conflict between Ukraine and Russia. The use of ransomware adds a financial pressure point, potentially crippling affected organizations. As these attacks continue, it raises concerns about the security of critical infrastructure and business operations in the region.