“Windows”

Microsoft released a broad May 2026 Patch Tuesday covering 120 vulnerabilities across Windows, Azure, and Office, including 29 critical RCE flaws. Patch management is essential to reduce exposure.

PoC demonstrates SYSTEM-level privilege escalation on patched Windows; rapid patching recommended.

Mass patch Tuesday covering DNS, Netlogon, and privilege-escalation flaws; prioritize critical patches in risk mitigations.

Chrome 148 closes 127 vulnerabilities, including critical overflow and use-after-free flaws. Update immediately to reduce exploitation risk.

ScarCruft trojanized a gaming platform to deploy backdoors on Windows and Android. Review supply chain and application trust.

Critical unauthenticated RCE in Weaver E-cology is being actively abused in the wild. Organizations should patch affected builds and monitor for payloads.

April 2026 Windows 11 update breaks third-party backup software; assess vendor patches and rollback options to avoid data loss.

VECT 2.0 acts more as a data wiper due to encryption nonce flaws; recovery unlikely even for attackers.

New Windows RPC flaw PhantomRPC enables LPE with multiple exploitation paths; disclosed at Black Hat Asia 2026.

New destructive wiper targeting energy utilities; review backups and incident response playbooks.

Zero-Day in Microsoft Defender exploited to access SAM and NTLM hashes; patch available. Review Windows security posture and apply the patch promptly.

Edge update breaks right-click paste in Teams; workaround and patch ETA provided by vendor.

Microsoft released patches for SharePoint and 168 additional flaws, with one actively exploited in the wild; prioritize patch deployment and verification.

Microsoft released a massive April 2026 Patch Tuesday with 168 fixes, including an actively exploited SharePoint zero-day. Remediation prioritizes active exploits and affected services.

Microsoft released a massive April 2026 Patch Tuesday with 168 fixes, including an actively exploited SharePoint zero-day. Remediation prioritizes active exploits and affected services.

Device-Bound Session Credentials (DBSC) became generally available for Chrome on Windows to prevent session hijacking. Update Chrome.

Adobe patched a Reader zero-day (CV E-2026-34621) after it was exploited in the wild for months; keep systems updated.

Device-Bound Session Credentials (DBSC) became generally available for Chrome on Windows to prevent session hijacking. Update Chrome.

Adobe patched a Reader zero-day (CV E-2026-34621) after it was exploited in the wild for months; keep systems updated.