Windows Security News

Security news specific to Microsoft Windows: vulnerabilities, exploitation and patches affecting Windows systems.

Windows is the most widely deployed desktop and enterprise operating system, and a constant target for both criminal and state-linked attackers. Windows-specific CVEs, in-the-wild exploitation, and Microsoft's Patch Tuesday and out-of-band fixes show up here. Expect heavy overlap with the ransomware and exploit feeds: Windows endpoints remain the most common initial-access target.

Recent Windows items

Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers https://ift.tt/GZKYE9S
@ctinow · Nov 13, 2026
CVE-2026-123806 python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, whic...
@cveNotify · Nov 13, 2026
Microsoft confirms Windows activation failures after November updates Microsoft has confirmed that this month's Patch Tuesday security updates are causing Windows activation and licensing failures wit...
@bleepingcomputer · Nov 13, 2026
New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections https://securityaffairs.com/202968/hacking/new-signdrop-exploit-can-abuse-windows-defender-to-bypass-security-protections...
@PentestingNews · Nov 13, 2026
StingyBasilisk APT Uses Windows Named Pipes to Control Malware and Evade Security Detection https://gbhackers.com/stingybasilisk-apt-attack/
@PentestingNews · Nov 13, 2026
Microsoft confirms Windows activation failures after November updates https://ift.tt/WsHKJf2
@ctinow · Nov 13, 2026
New SignDrop Exploit Can Abuse Windows Defender to Bypass Security Protections https://ift.tt/Y4Vo8qN
@ctinow · Nov 13, 2026
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’ https://ift.tt/QqaGIbT
@ctinow · Nov 13, 2026
New SignDrop Exploit Claims SYSTEM Access on Windows Through CLFS https://thecyberexpress.com/signdrop-zero-day-exploit-clfs-authentication/
@PentestingNews · Nov 13, 2026
CVE-2026-126883 Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sa...
@cveNotify · Nov 13, 2026
CVE-2026-127277 A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Per...
@cveNotify · Nov 13, 2026
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access 🖋️ Nable on Thursday said it's investigating a new public disclosure containing claims of additional vuln...
@cibsecurity · Nov 13, 2026
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry 🖋️ A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and...
@cibsecurity · Nov 13, 2026
CVE-2026-123806 python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, whic...
@cveNotify · Nov 12, 2026
CVE-2026-114032 The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially...
@cveNotify · Nov 12, 2026
CVE-2026-114031 Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Win...
@cveNotify · Nov 12, 2026
CVE-2026-68548 Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case...
@cveNotify · Nov 12, 2026
CVE-2026-40427 Use after free for some Intel(R) QuickAssist Technology Driver for Windows within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authen...
@cveNotify · Nov 12, 2026
klist.exe Revisited: Internals and Further Use Cases – Jake Otte A follow-up on klist.exe: extracting non-zeroed TGT session keys without SeTcbPrivilege, abusing WinRM for in-memory remote dumping, an...
@malwr · Nov 12, 2026
CVE-2026-126883 Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sa...
@cveNotify · Nov 12, 2026
CVE-2026-100307 Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator s...
@cveNotify · Nov 12, 2026
CVE-2026-112174 Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users w...
@cveNotify · Nov 12, 2026
CVE-2026-126625 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product...
@cveNotify · Nov 12, 2026
CVE-2026-126624 Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an adminis...
@cveNotify · Nov 12, 2026
CVE-2026-126623 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST A...
@cveNotify · Nov 12, 2026
CVE-2026-126622 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the...
@cveNotify · Nov 12, 2026
CVE-2026-119040 The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who alread...
@cveNotify · Nov 12, 2026
CVE-2026-119039 The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted sour...
@cveNotify · Nov 12, 2026
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access https://ift.tt/4vHuqE6
@ctinow · Nov 12, 2026
Microsoft uncovers 59 Linux kernel bugs, including 8 with working root exploits. Also in this week's #ThreatsDay : • Falcon browser spyware • GSocket backdoor surge • Europol server takedown • $6.43B...
@thehackernews · Nov 12, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.