Yesterday, Microsoft released its traditional October security update, addressing 172 vulnerabilities across its products. The patch includes six dangerous zero-day flaws and eight critical vulnerabilities — five enabling remote code execution, and three allowing...
A privilege escalation vulnerability in Microsoft Windows systems is once again being actively exploited, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned, adding the flaw to its official catalog of known exploited...
A developer operating under the handle 0xr0BIT has released a new Windows security-audit tool called TaskHound. It is designed to discover scheduled tasks that run with elevated privileges or that rely on stored credentials—assets...
Broadcom has patched a critical privilege escalation vulnerability in VMware Aria Operations and VMware Tools, which had been actively exploited as a zero-day since October 2024. The flaw, tracked as CVE-2025-41244, was not initially...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in the widely used Sudo utility—employed across Linux and Unix-like systems—to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-32463 and...
Researcher Nicholas Zubriski of Trend Research has disclosed a critical flaw in the ksmbd component of the Linux kernel, enabling attackers to remotely execute arbitrary code with the highest system privileges. The vulnerability, tracked...
Microsoft has issued a warning about two flaws in Windows BitLocker that could allow a local attacker—or malware already running on a machine—to escalate privileges and seize control of the system. Both defects are...
An independent researcher named Alexander Popov has unveiled a novel exploitation technique for a critical Linux kernel vulnerability, identified as CVE-2024-50264. This use-after-free flaw in the AF_VSOCK subsystem has existed since kernel version 4.8...
At DEF CON 2025, researchers from Akamai unveiled a study on a critical vulnerability in Windows Server 2025 known as BadSuccessor (CVE-2025-53779), which allows low-privileged users to instantly escalate their access to Domain Admin....
Researchers at Resecurity have drawn attention to an exceptionally dangerous attack that enables adversaries to seize full control over an organization’s Active Directory domain infrastructure—all while exploiting default Windows configurations. The technique combines MITM6,...
Researchers at Cymulate Research Labs have disclosed a new vulnerability in Windows that allows attackers to bypass Microsoft’s recent patch and once again exfiltrate NTLM hashes without any user interaction. The flaw, tracked as...
Microsoft has introduced a new mechanism known as Nested App Authentication (NAA), which is steadily becoming a key component of the company’s cloud ecosystem. The concept is straightforward: if a user has already signed...
