Team IT Security - 📰 Alle Kategorien

CVE-2026-64390 | Linux Kernel up to 7.1.3 Ksmbd SMB2_LOCK conn race condition (Nessus ID 329970)

Sun, 26 Jul 2026 15:20:42 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.1.3. This impacts the function SMB2_LOCK of the component Ksmbd. Performing a manipulation of the argument conn results in race condition. This vulnerability is known as CVE-2026-64390. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-64439 | Linux Kernel up to 6.18.38/7.1.3 Crypto rfc3961_simplified.c use after free (Nessus ID 329965)

Sun, 26 Jul 2026 15:20:41 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.18.38/7.1.3. This issue affects the function krb5_aead_encrypt/krb5_aead_decrypt/rfc8009_encrypt/rfc8009_decrypt of the file rfc3961_simplified.c of the component Crypto. This manipulation causes use after free. This vulnerability appears as CVE-2026-64439. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

CVE-2026-64263 | Linux Kernel up to 6.18.38/7.1.3 fuse-uring fuse_uring_cancel null pointer dereference (Nessus ID 329967)

Sun, 26 Jul 2026 15:20:41 +0200

A vulnerability was found in Linux Kernel up to 6.18.38/7.1.3. It has been classified as critical. This vulnerability affects the function fuse_uring_cancel of the component fuse-uring. The manipulation leads to null pointer dereference. This vulnerability is referenced as CVE-2026-64263. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

CVE-2026-64369 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 s390 load_unaligned_zeropad infinite loop (Nessus ID 329966)

Sun, 26 Jul 2026 15:20:40 +0200

A vulnerability labeled as critical has been found in Linux Kernel up to 6.12.96/6.18.38/7.1.3. Affected is the function load_unaligned_zeropad of the component s390. Such manipulation leads to infinite loop. This vulnerability is uniquely identified as CVE-2026-64369. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A Promising Process For Nuclear Fuel Re-use and Disposal?

Sun, 26 Jul 2026 13:48:14 +0200

A Canadian lab has run a chemical process on real spent nuclear fuel "and pulled out 90% of the long-lived danger in 24 hours, the part that forces a burial site to last 100,000 years," notes the blog Autonocio, "with the leftovers meant to fuel a reactor." The standard plan for spent nuclear fuel is to wait it out. You pull the used bundles from a reactor, sit them in a pool of water for seven to ten years while the heat and radiation come down, seal them in concrete casks, and look for somewhere deep and geologically dull to leave them for the next hundred thousand years. Canada has been hunting for that burial site since the 1980s and still doesn't have one in the ground. A company in Saint John, New Brunswick thinks most of what makes that waste dangerous never needed to go in the ground at all. Moltex Energy Canada says a chemical process it calls WATSS can strip 90% of the long-lived material out of used Canada Deuterium Uranium [CANDU] fuel in 24 hours, and that the concentrated leftovers become fuel for a reactor it wants to build on the same site. The recovery step isn't a slide in a pitch deck anymore. In 2025, World Nuclear News reported that Canadian Nuclear Laboratories ran the process on real used fuel from a commercial Canadian reactor and confirmed the 90% figure. None of it is generating power yet. What exists is a validated chemical step and a reactor design waiting in line at a regulator. The rest is a 2030s problem. "The chemistry has a lab result behind it. The reactor does not exist..." the article points out. "Moltex is aiming to have its first WATSS and SSR-W units running at Point Lepreau by the early-to-mid 2030s... Not everyone buys the pitch. Critics have argued the reprocessing creates its own stream of byproducts, that the economics are unproven, and that a single site's stockpile is finite." But Moltex "isn't alone in trying to burn nuclear waste instead of bury it," the article notes, with Switzerland and Denmark "chasing the same goal a different way." Switzerland's Transmutex drives a subcritical reactor with a particle accelerator, feeding it spent fuel alongside thorium... Denmark's Copenhagen Atomics is building a thorium molten-salt reactor that fits inside a shipping container and runs on the leftovers from conventional plants. Thanks to long-time Slashdot reader kwelch007 for sharing the article.

Read more of this story at Slashdot.

CVE-2024-14040 | Linux Kernel nexthop weight/resvd1 allocation of resources (EUVD-2024-55701)

Sun, 26 Jul 2026 13:38:57 +0200

A vulnerability was found in Linux Kernel and classified as very critical. The impacted element is an unknown function of the component nexthop. Such manipulation of the argument weight/resvd1 leads to allocation of resources. This vulnerability is traded as CVE-2024-14040. The attack may be launched remotely. There is no exploit available. It is advisable to implement a patch to correct this issue.

CVE-2026-64530 | Linux Kernel up to 7.1.4 cls_api net/sched/cls_api.c tcf_qevent_handle use after free (EUVD-2026-49051)

Sun, 26 Jul 2026 13:38:49 +0200

A vulnerability has been found in Linux Kernel up to 7.1.4 and classified as very critical. The affected element is the function tcf_qevent_handle of the file net/sched/cls_api.c of the component cls_api. This manipulation causes use after free. This vulnerability appears as CVE-2026-64530. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

CVE-2026-64478 | Linux Kernel up to 7.1.3 ALSA USB Audio snd_dualsense_ih_match null pointer dereference (EUVD-2026-48822)

Sun, 26 Jul 2026 13:38:43 +0200

A vulnerability classified as problematic was found in Linux Kernel up to 7.1.3. Impacted is the function snd_dualsense_ih_match of the component ALSA USB Audio. Executing a manipulation can lead to null pointer dereference. This vulnerability appears as CVE-2026-64478. The attack requires local access. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-64477 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc1 resctrl cpu_to_node out-of-bounds (EUVD-2026-48821)

Sun, 26 Jul 2026 13:38:32 +0200

A vulnerability classified as critical has been found in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc1. This issue affects the function cpu_to_node of the component resctrl. Performing a manipulation results in out-of-bounds read. This vulnerability is reported as CVE-2026-64477. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-64475 | Linux Kernel up to 7.2-rc1 Vfio Pci vfio_pci_core_register_device use after free (EUVD-2026-48819)

Sun, 26 Jul 2026 13:38:24 +0200

A vulnerability described as very critical has been identified in Linux Kernel up to 7.2-rc1. Affected by this vulnerability is the function vfio_pci_core_register_device of the component Vfio Pci. The manipulation results in use after free. This vulnerability is reported as CVE-2026-64475. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

CVE-2026-64476 | Linux Kernel up to 7.2-rc1 vfio-pci driver vfio_pci.c vfio_pci_dev_set_pm_runtime_get disable_idle_d3 race condition (EUVD-2026-48820)

Sun, 26 Jul 2026 13:38:20 +0200

A vulnerability has been found in Linux Kernel up to 7.2-rc1 and classified as critical. This affects the function vfio_pci_dev_set_pm_runtime_get of the file vfio_pci.c of the component vfio-pci driver. Performing a manipulation of the argument disable_idle_d3 results in race condition. This vulnerability was named CVE-2026-64476. The attack needs to be approached locally. There is no available exploit. The affected component should be upgraded.

CVE-2026-64472 | Linux Kernel up to 7.2-rc1 Vfio Mlx5 race condition (EUVD-2026-48816)

Sun, 26 Jul 2026 13:38:19 +0200

A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2-rc1. This impacts an unknown function of the component Vfio Mlx5. Executing a manipulation can lead to race condition. This vulnerability is registered as CVE-2026-64472. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

CVE-2026-64474 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 Vfio vfio_mig_get_next_state infinite loop (EUVD-2026-48818)

Sun, 26 Jul 2026 13:38:19 +0200

A vulnerability was found in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. It has been rated as problematic. This impacts the function vfio_mig_get_next_state of the component Vfio. Performing a manipulation results in infinite loop. This vulnerability is identified as CVE-2026-64474. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is advised.

CVE-2026-64473 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc1 VFIO vfio_unregister_group_dev race condition (EUVD-2026-48817)

Sun, 26 Jul 2026 13:38:14 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc1. Affected is the function vfio_unregister_group_dev of the component VFIO. The manipulation leads to race condition. This vulnerability is documented as CVE-2026-64473. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

CVE-2026-64406 | Linux Kernel up to 7.2-rc2 Bluetooth bt_accept_dequeue use after free (Nessus ID 329977)

Sun, 26 Jul 2026 12:50:51 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been classified as very critical. The affected element is the function bt_accept_dequeue of the component Bluetooth. The manipulation leads to use after free. This vulnerability is listed as CVE-2026-64406. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

CVE-2026-64375 | Linux Kernel up to 7.1.3 proc filesystem call_proc_get_link race condition (Nessus ID 329978)

Sun, 26 Jul 2026 12:50:51 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been declared as very critical. This impacts the function call_proc_get_link of the component proc filesystem. The manipulation results in race condition. This vulnerability is reported as CVE-2026-64375. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-64372 | Linux Kernel up to 7.1.3 pcc pcc_cpufreq_do_osc use after free (Nessus ID 329975)

Sun, 26 Jul 2026 12:50:50 +0200

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.3. Impacted is the function pcc_cpufreq_do_osc of the component pcc. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-64372. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

CVE-2026-64384 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 SMB Client SMB2_notify_init double free (Nessus ID 329976)

Sun, 26 Jul 2026 12:50:50 +0200

A vulnerability classified as very critical has been found in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. Impacted is the function SMB2_notify_init of the component SMB Client. This manipulation causes double free. The identification of this vulnerability is CVE-2026-64384. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

CVE-2026-64431 | Linux Kernel NTFS post_write_mst_fixup memory corruption (Nessus ID 329973)

Sun, 26 Jul 2026 12:50:49 +0200

A vulnerability was found in Linux Kernel. It has been rated as critical. Affected by this vulnerability is the function post_write_mst_fixup of the component NTFS. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2026-64431. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

CVE-2026-64463 | Linux Kernel up to 7.2-rc2 Typec Tcpci Driver rt1711h_probe denial of service (Nessus ID 329974)

Sun, 26 Jul 2026 12:50:49 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3/7.2-rc2. This issue affects the function rt1711h_probe of the component Typec Tcpci Driver. Executing a manipulation can lead to denial of service. This vulnerability is handled as CVE-2026-64463. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

CVE-2026-64306 | Linux Kernel up to 7.1.3 DRBG drbg_ctr_generate uninitialized variable (Nessus ID 329971)

Sun, 26 Jul 2026 12:50:48 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been rated as very critical. The affected element is the function drbg_ctr_generate of the component DRBG. Performing a manipulation results in use of uninitialized variable. This vulnerability was named CVE-2026-64306. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-64309 | Linux Kernel up to 6.12.95/6.18.38/7.1.3 ccp initialization (Nessus ID 329972)

Sun, 26 Jul 2026 12:50:48 +0200

A vulnerability was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3 and classified as critical. This vulnerability affects unknown code of the component ccp. The manipulation results in improper initialization. This vulnerability is known as CVE-2026-64309. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Linux-Sicherheit: CVE-2026-53274 trifft Ubuntu bis 26.04 - BornCity

Sun, 26 Jul 2026 12:46:13 +0200

IT-Sicherheit wird zum Top-Thema – spezielle Trainings sollen Linux-Administratoren fit für die Bedrohungslage machen.

Best Home Security Cameras Without Subscriptions in 2026: Free of Fees

Sun, 26 Jul 2026 12:30:32 +0200

Smart security cameras don’t have to come with fees: These models give a lot while saving your budget.

Virtual Integrity Revisited: 7 Habits for the AI Age

Sun, 26 Jul 2026 11:46:49 +0200

In Part 3 of this exploration of AI ethics, we bring this topic closer to home: How can we use the power of AI to strengthen human trust and character?

CVE-2026-64469 | Linux Kernel up to 7.2-rc2 binder binder_thread_release to_proc use after free (Nessus ID 329983)

Sun, 26 Jul 2026 11:20:32 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been declared as very critical. This affects the function binder_thread_release of the component binder. Such manipulation of the argument to_proc leads to use after free. This vulnerability is referenced as CVE-2026-64469. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

CVE-2026-64371 | Linux Kernel up to 7.1.3 procfs ptrace_may_access race condition (Nessus ID 329982)

Sun, 26 Jul 2026 11:20:31 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.3. This issue affects the function ptrace_may_access of the component procfs. This manipulation causes race condition. This vulnerability is tracked as CVE-2026-64371. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-64395 | Linux Kernel up to 7.1.3 ksmbd vfs_clone_file_range/vfs_copy_file_range information disclosure (Nessus ID 329980)

Sun, 26 Jul 2026 11:20:30 +0200

A vulnerability was found in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. It has been declared as problematic. Affected by this issue is the function vfs_clone_file_range/vfs_copy_file_range of the component ksmbd. Such manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-64395. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

CVE-2026-64318 | Linux Kernel up to 7.1.3 partitions aix_partition pp_count out-of-bounds (Nessus ID 329981)

Sun, 26 Jul 2026 11:20:30 +0200

A vulnerability classified as problematic was found in Linux Kernel up to 7.1.3. This affects the function aix_partition of the component partitions. Executing a manipulation of the argument pp_count can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-64318. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Virtual Integrity Revisited: 7 Habits for the AI Age

Sun, 26 Jul 2026 11:11:07 +0200

In Part 3 of this exploration of AI ethics, we bring this topic closer to home: How can we use the power of AI to strengthen human trust and character?

Comic-Con 2026 Debuts Trailers for 'Coyote vs Acme' Movie, Plus 'Neuromancer' and 'Blade Runner 2099' Series

Sun, 26 Jul 2026 10:01:17 +0200

Big news from Comic-Con 2026: "Coyote vs. ACME" debuted its long-awaited final trailer. CNET calls it "an animation-meets-live-action story," with the Coyote catapulting into theaters this August 28. (The film began development back in 2018, but was shelved for a tax write-off in 2023 by Warner Bros. until a backlash led to its sale to Ketchup Entertainment.) "Fed up with Acme's unreliable products, Wile E. Coyote decides to hire a lawyer and sue the company..." writes CNET. "The movie also features Lana Condor along with a host of Looney Tunes characters like Porky Pig, Tweety, Foghorn Leghorn and Granny (who gets dinged by an anvil)." In other movie news, CNET says Johnny Depp also "made a surprise appearance at Comic-Con, donning a costume as Ebenezer Scrooge" to promote his November 13 movie about the miser from Charles Dickens' famous Christmas novella. (Ian McKellen and Daisy Ridley are also in the movie.) But several geek favorites are being filmed as TV series... There's big news for William Gibson fans, reports Entertainment Weekly. "Two years after Apple TV announced production on the first-ever series adaptation of William Gibson's seminal 1984 novel Neuromancer, the lucky few hundred who attended the studio's Hall H panel at Comic-Con 2026 got to watch the first teaser. For Amazon's Prime Video, the Tolkien-derived "Rings of Power" series released a season 3 trailer that CNET said "successfully hides the best parts with fire... The trailer suggests that Sauron is building an army, and all of Middle-earth is trying to find ways to stop him... Rings of Power season 3 will start dropping weekly episodes on Nov. 11, meaning this show will be airing at the same time the Peter Jackson films will be celebrating their 25th anniversary." Later in November Amazon's Prime Video will also debut Blade Runner 2099, an eight-episode series that's a sequel to 2017's film Blade Runner 2049, reports CNET. "Set in an alternate version of LA where replicants run things and the humans play second fiddle, the series sees Yeoh's replicant Olwen chasing down outlaw replicants who've gone missing. With her own shelf life on a ticking clock, the stakes are high for her and for her human fugitive partner, Cora..." Paramount Plus will debut Avatar: Seven Havens in October, a new animated series from the creators of Avatar: The Last Airbender which CNET says "follows a pair of twin avatars, one of whom is Korra's successor." Disney+ has season 3 of Percy Jackson and the Olympians. Kevin Feige said Marvel's television slate will include more seasons of "X-Men '97" and the upcoming "VisionQuest" TV series. HBO Max will launch a new Green Lantern series called Lanterns on August 16.

Read more of this story at Slashdot.

CVE-2026-64484 | Linux Kernel up to 7.1.3 ALSA snd_ctl_new1 null pointer dereference (EUVD-2026-48828)

Sun, 26 Jul 2026 09:19:20 +0200

A vulnerability described as very critical has been identified in Linux Kernel up to 7.1.3. This vulnerability affects the function snd_ctl_new1 of the component ALSA. Such manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2026-64484. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

CVE-2026-64485 | Linux Kernel up to 6.18.38/7.1.3 ALSA: compress snd_compr_task_new allocation of resources (EUVD-2026-48829)

Sun, 26 Jul 2026 09:19:20 +0200

A vulnerability has been found in Linux Kernel up to 6.18.38/7.1.3 and classified as very critical. This affects the function snd_compr_task_new of the component ALSA: compress. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2026-64485. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-64483 | Linux Kernel up to 7.1.3 ALSA FireWire iSight isight_packet sample_count buffer overflow (EUVD-2026-48827)

Sun, 26 Jul 2026 09:19:19 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been classified as very critical. Affected by this issue is the function isight_packet of the component ALSA FireWire iSight. Performing a manipulation of the argument sample_count results in buffer overflow. This vulnerability is identified as CVE-2026-64483. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

CVE-2026-64482 | Linux Kernel up to 7.1.3 ALSA: gus snd_gf1_pcm_volume_control null pointer dereference (EUVD-2026-48826)

Sun, 26 Jul 2026 09:19:19 +0200

A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. Affected by this issue is the function snd_gf1_pcm_volume_control of the component ALSA: gus. The manipulation results in null pointer dereference. This vulnerability is cataloged as CVE-2026-64482. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

CVE-2026-64479 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 ALSA snd_seq_event_dup heap-based overflow (EUVD-2026-48823)

Sun, 26 Jul 2026 09:19:18 +0200

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. Affected is the function snd_seq_event_dup of the component ALSA. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is tracked as CVE-2026-64479. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-64481 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 Alsa Hda Cs35l41 cs35l41_remove_dsp privilege escalation (EUVD-2026-48825)

Sun, 26 Jul 2026 09:19:18 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.12.96/6.18.38/7.1.3. This affects the function cs35l41_remove_dsp of the component Alsa Hda Cs35l41. This manipulation causes privilege escalation. This vulnerability is registered as CVE-2026-64481. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-64460 | Linux Kernel up to 6.18.38/7.1.3 Pci Iov drivers/pci/iov.c sriov_restore_vf_rebar_state out-of-bounds (Nessus ID 329992)

Sun, 26 Jul 2026 07:48:50 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.38/7.1.3. The impacted element is the function sriov_restore_vf_rebar_state of the file drivers/pci/iov.c of the component Pci Iov. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-64460. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64287 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.3 KVM arm64 pKVM hyp vCPU flush_hyp_vcpu used_lrs out-of-bounds (Nessus ID 329989)

Sun, 26 Jul 2026 07:48:49 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.3. This affects the function flush_hyp_vcpu of the component KVM arm64 pKVM hyp vCPU. This manipulation of the argument used_lrs causes out-of-bounds read. This vulnerability appears as CVE-2026-64287. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64480 | Linux Kernel up to 7.1.3 ALSA ice1712 driver aureon.c snd_ctl_new1 null pointer dereference (Nessus ID 329990)

Sun, 26 Jul 2026 07:48:49 +0200

A vulnerability identified as very critical has been detected in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. Affected by this vulnerability is the function snd_ctl_new1 of the file ice1712.c/ice1724.c/aureon.c of the component ALSA ice1712 driver. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2026-64480. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

CVE-2026-64416 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 swap_cgroup lookup_swap_cgroup_id null pointer dereference (Nessus ID 329991)

Sun, 26 Jul 2026 07:48:49 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.12.96/6.18.38/7.1.3. This vulnerability affects the function lookup_swap_cgroup_id of the component swap_cgroup. Executing a manipulation can lead to null pointer dereference. This vulnerability appears as CVE-2026-64416. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64410 | Linux Kernel up to 7.1.3/7.2-rc2 Netfilter Flowtable nf_flow_offload_add Remote Code Execution (Nessus ID 329988)

Sun, 26 Jul 2026 07:48:48 +0200

A vulnerability identified as critical has been detected in Linux Kernel up to 7.1.3/7.2-rc2. Affected is the function nf_flow_offload_add of the component Netfilter Flowtable. Performing a manipulation results in Remote Code Execution. This vulnerability is reported as CVE-2026-64410. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

CVE-2026-64418 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2 shrinker alloc_shrinker_info/expand_shrinker_info use after free (Nessus ID 329987)

Sun, 26 Jul 2026 07:48:48 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2. This issue affects the function alloc_shrinker_info/expand_shrinker_info of the component shrinker. Such manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2026-64418. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-64362 | Linux Kernel up to 7.2-rc2 HID lg-g15 lg_g15_event use after free (Nessus ID 329984)

Sun, 26 Jul 2026 07:48:47 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been classified as critical. Impacted is the function lg_g15_event of the component HID lg-g15. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-64362. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

CVE-2026-64348 | Linux Kernel up to 7.2-rc2 USB iso_stream_schedule hcpriv memory leak (Nessus ID 329985)

Sun, 26 Jul 2026 07:48:46 +0200

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2-rc2. Affected is the function iso_stream_schedule of the component USB. Executing a manipulation of the argument hcpriv can lead to memory leak. This vulnerability is registered as CVE-2026-64348. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

CVE-2026-64338 | Linux Kernel up to 7.2-rc2 uss720 uss720_probe allocation of resources (Nessus ID 329986)

Sun, 26 Jul 2026 07:48:46 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been rated as problematic. Affected by this issue is the function uss720_probe of the component uss720. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2026-64338. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

Firefox's New Tab Page Will Get Widgets - Including an AI-Powered Daily Crossword

Sun, 26 Jul 2026 07:16:12 +0200

In a sign of the times, Firefox's New Tab page could soon include a crossword puzzle from AI-powered news platform Particle. The blog OMG Ubuntu reports: The mini crossword game is updated daily, with puzzles based around recent content Particle's AI has ingested and summarised that day. [After solving the crossword, links appear to related news articles...] If you just want to try the crossword, you access it in any browser via a direct link. While it may look like Mozilla is trying to capitalise on the Wordle craze several years too late, it's part of its strategy to make the Firefox new tab page a discover destination in itself, not just a springboard for new searches. The 'Daily Grind' crossword widget (name subject to change) is just one of several widgets Firefox has (or will get). You'll also find a to-do list, timer, stock checker, world clock, picture of the day, privacy report and new-look weather widget (bigger than the existing one). During the World Cup 2026, Firefox offered real-time match scores and fixture information too... [T]hey aren't mandatory. You can disable the ones you don't want to use, or, if you don't want any at all, turn them all off to hide the widget area itself. A button to 'show fewer widgets' frees up room to allow other distractions (sponsored stories) on the new tab page to show... [Presumably you can also still open new tabs to a blank page...] They're rolling out to users in certain region and locales already. Plus, Mozilla routinely tests new features with a small set of users before they hit stable builds (i.e., the "Allow Firefox to run feature studies" setting). If you don't have widgets in your Firefox build, but you want them, you can manually enable them in Firefox 153 and later from the about:config page. Search for the following master switch and set it to true to enable the widget area: browser.newtabpage.activity-stream.widgets.system.enabled Then, enable the widgets you want to use by searching: activity-stream.widgets.*.enabled However, the usual caveats about "trying things not enabled by default" still apply. Mozilla hasn't set a firm rollout date, though the feature is already documented on its support site. With fortnightly Firefox releases about to start, and a big Nova redesign, chances are we'll all be puzzling over these widgets sooner rather than later.

Read more of this story at Slashdot.

CVE-2026-64412 | Linux Kernel up to 7.2-rc2 ebtables request_module buffer over-read (Nessus ID 329997)

Sun, 26 Jul 2026 06:50:22 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2-rc2. Affected by this issue is the function request_module of the component ebtables. The manipulation leads to buffer over-read. This vulnerability is traded as CVE-2026-64412. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

CVE-2026-64471 | Linux Kernel up to 7.1.3 Btusb use after free (Nessus ID 329993)

Sun, 26 Jul 2026 06:50:21 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.3. Affected by this vulnerability is an unknown functionality of the component Btusb. This manipulation causes use after free. This vulnerability is handled as CVE-2026-64471. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2026-64323 | Linux Kernel up to 7.1.3 UDF udf_load_vat/udf_get_pblock_virt15 lengthHeader/i_size out-of-bounds (Nessus ID 329996)

Sun, 26 Jul 2026 06:50:21 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been rated as problematic. This impacts the function udf_load_vat/udf_get_pblock_virt15 of the component UDF. The manipulation of the argument lengthHeader/i_size leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-64323. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-64470 | Linux Kernel up to 7.1.3 btusb btusb.c btusb_probe use after free (Nessus ID 329995)

Sun, 26 Jul 2026 06:50:20 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 7.1.3. Affected is the function btusb_probe of the file btusb.c of the component btusb. The manipulation results in use after free. This vulnerability is known as CVE-2026-64470. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

CVE-2026-64522 | Linux Kernel up to 6.18.33/7.0.10 eswitch mode net/mlx5e mlx5e_xfrm_add_state off-by-one (EUVD-2026-48866)

Sun, 26 Jul 2026 06:36:24 +0200

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.18.33/7.0.10. Affected is the function mlx5e_xfrm_add_state of the file net/mlx5e of the component eswitch mode. The manipulation results in off-by-one. This vulnerability is identified as CVE-2026-64522. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-64517 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 GSC xe_gsc_init_post_hwconfig double free (EUVD-2026-48861)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.91/6.18.33/7.0.10. This impacts the function xe_gsc_init_post_hwconfig of the component GSC. The manipulation results in double free. This vulnerability is cataloged as CVE-2026-64517. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

CVE-2026-64518 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 Tcp Ao Established Key tcp_ao_established_key out-of-bounds (EUVD-2026-48862)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.91/6.18.33/7.0.10. Affected is the function tcp_ao_established_key of the component Tcp Ao Established Key. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-64518. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

CVE-2026-64519 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 NFSD nfsd4_revoke_states infinite loop (EUVD-2026-48863)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.91/6.18.33/7.0.10. This affects the function nfsd4_revoke_states of the component NFSD. Executing a manipulation can lead to infinite loop. The identification of this vulnerability is CVE-2026-64519. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

CVE-2026-64520 | Linux Kernel up to 6.18.33/7.0.10 arm_ffa buffer overflow (EUVD-2026-48864)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability was found in Linux Kernel up to 6.18.33/7.0.10. It has been rated as very critical. The impacted element is an unknown function of the component arm_ffa. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2026-64520. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-64521 | Linux Kernel up to 6.18.33/7.0.10 pinctrl pinconf_pins_show deadlock (EUVD-2026-48865)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.18.33/7.0.10. This impacts the function pinconf_pins_show of the component pinctrl. The manipulation leads to deadlock. This vulnerability is referenced as CVE-2026-64521. The attack can only be performed from a local environment. No exploit is available. You should upgrade the affected component.

CVE-2026-64513 | Linux Kernel up to 6.18.38/7.1.3 KVM handle_tpr_below_threshold denial of service (EUVD-2026-48857)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability has been found in Linux Kernel up to 6.18.38/7.1.3 and classified as critical. Affected by this vulnerability is the function handle_tpr_below_threshold of the component KVM. Performing a manipulation results in denial of service. This vulnerability is known as CVE-2026-64513. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

CVE-2026-64515 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 mac80211 defragmentation routine heap-based overflow (EUVD-2026-48859)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.12.91/6.18.33/7.0.10. The impacted element is the function defragmentation routine of the component mac80211. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is tracked as CVE-2026-64515. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

CVE-2026-64516 | Linux Kernel up to 7.0.10 Drm Amgpu Vce1 drm/amdgpu/vce1 out-of-bounds (EUVD-2026-48860)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.0.10. This affects an unknown function of the file drm/amdgpu/vce1 of the component Drm Amgpu Vce1. The manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-64516. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

CVE-2026-64514 | Linux Kernel up to 7.1.3 userfaultfd userfaultfd_must_wait/userfaultfd_huge_must_wait encoding error (EUVD-2026-48858)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been declared as very critical. The affected element is the function userfaultfd_must_wait/userfaultfd_huge_must_wait of the component userfaultfd. Such manipulation leads to encoding error. This vulnerability is uniquely identified as CVE-2026-64514. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-64511 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 ACPI NFIT Core drivers/acpi/nfit/core.c acpi_nfit_uc_error_notify null pointer dereference (EUVD-2026-48855)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. The affected element is the function acpi_nfit_uc_error_notify of the file drivers/acpi/nfit/core.c of the component ACPI NFIT Core. Performing a manipulation results in null pointer dereference. This vulnerability is identified as CVE-2026-64511. The attack is only possible with local access. There is not any exploit available. You should upgrade the affected component.

CVE-2026-64510 | Linux Kernel up to 7.1.3 Nfit Core acpi_nfit_init use after free (EUVD-2026-48854)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been classified as very critical. Impacted is the function acpi_nfit_init of the component Nfit Core. This manipulation causes use after free. This vulnerability is handled as CVE-2026-64510. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is recommended.

CVE-2026-64512 | Linux Kernel up to 7.1.3 Cppc drivers/acpi/cppc_acpi.c cpc_write access_width out-of-bounds (EUVD-2026-48856)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.1.3. This impacts the function cpc_write of the file drivers/acpi/cppc_acpi.c of the component Cppc. This manipulation of the argument access_width causes out-of-bounds read. This vulnerability appears as CVE-2026-64512. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64507 | Linux Kernel up to 7.2-rc1 BPF JIT bugs.c allocation of resources (EUVD-2026-48851)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability was found in Linux Kernel up to 6.6.144/6.12.96/6.18.38/7.1.3/7.2-rc1. It has been rated as problematic. This issue affects some unknown processing of the file bugs.c of the component BPF JIT. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2026-64507. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is advised.

CVE-2026-64508 | Linux Kernel up to 7.2-rc1 BPF bpf_arch_pred_flush allocation of resources (EUVD-2026-48852)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.6.144/6.12.96/6.18.38/7.1.3/7.2-rc1. Impacted is the function bpf_arch_pred_flush of the component BPF. Such manipulation leads to allocation of resources. This vulnerability is referenced as CVE-2026-64508. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

CVE-2026-64506 | Linux Kernel up to 7.1.3 rtw89 state issue (EUVD-2026-48850)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.1.3. Affected is an unknown function of the component rtw89. Such manipulation leads to state issue. This vulnerability is traded as CVE-2026-64506. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

CVE-2026-64509 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 block GenDiskBuilder::build memory leak (EUVD-2026-48853)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability was found in Linux Kernel up to 6.12.96/6.18.38/7.1.3 and classified as very critical. This issue affects the function GenDiskBuilder::build of the component block. The manipulation results in memory leak. This vulnerability is known as CVE-2026-64509. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-64502 | Linux Kernel up to 6.18.38/7.1.3 Iio Adc Ad Sigma Delta ad_sigma_delta_clear_pending_event heap-based overflow (EUVD-2026-48846)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.18.38/7.1.3. Affected by this issue is the function ad_sigma_delta_clear_pending_event of the component Iio Adc Ad Sigma Delta. Performing a manipulation results in heap-based buffer overflow. This vulnerability is reported as CVE-2026-64502. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-64501 | Linux Kernel up to 6.18.38/7.1.3 iio adc ad_sigma_delta state issue (EUVD-2026-48845)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.18.38/7.1.3. Affected by this vulnerability is the function ad_sigma_delta_single_conversion/ad_sd_buffer_postenable of the component iio adc ad_sigma_delta. This manipulation causes state issue. This vulnerability is tracked as CVE-2026-64501. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

CVE-2026-64504 | Linux Kernel up to 7.2-rc2 BMC150 Accelerometer Driver __bmc150_accel_fifo_flush stack-based overflow (EUVD-2026-48848)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been declared as very critical. This vulnerability affects the function __bmc150_accel_fifo_flush of the component BMC150 Accelerometer Driver. The manipulation results in stack-based buffer overflow. This vulnerability was named CVE-2026-64504. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

CVE-2026-64503 | Linux Kernel up to 7.2-rc2 kxsd9 kxsd9_write_raw release of resource (EUVD-2026-48847)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2-rc2. This affects the function kxsd9_write_raw of the component kxsd9. Executing a manipulation can lead to missing release of resource. This vulnerability appears as CVE-2026-64503. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

CVE-2026-64505 | Linux Kernel up to 7.2-rc2 Rndis rndis_rm_hdr out-of-bounds (EUVD-2026-48849)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability has been found in Linux Kernel up to 7.2-rc2 and classified as very critical. This vulnerability affects the function rndis_rm_hdr of the component Rndis. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-64505. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

CVE-2026-64496 | Linux Kernel up to 7.2-rc2 IIO Event iio_event_getfd out-of-bounds (EUVD-2026-48840)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability classified as critical has been found in Linux Kernel up to 7.2-rc2. The impacted element is the function iio_event_getfd of the component IIO Event. The manipulation leads to out-of-bounds read. This vulnerability is documented as CVE-2026-64496. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

CVE-2026-64497 | Linux Kernel up to 7.1.3 scd30 linux/bitfield.h FIELD_GET integer overflow (EUVD-2026-48841)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 7.1.3. This affects the function FIELD_GET of the file linux/bitfield.h of the component scd30. The manipulation results in integer overflow. This vulnerability is reported as CVE-2026-64497. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-64498 | Linux Kernel up to 7.1.3 hw-consumer iio_hw_buf_release use after free (EUVD-2026-48842)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability was found in Linux Kernel up to 7.1.3 and classified as very critical. Affected by this issue is the function iio_hw_buf_release of the component hw-consumer. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-64498. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

CVE-2026-64500 | Linux Kernel up to 7.2-rc2 Lpc32xx Adc lpc32xx_adc.c lpc32xx_adc_probe uninitialized pointer (EUVD-2026-48844)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been classified as critical. This affects the function lpc32xx_adc_probe of the file drivers/iio/adc/lpc32xx_adc.c of the component Lpc32xx Adc. The manipulation leads to uninitialized pointer. This vulnerability is uniquely identified as CVE-2026-64500. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

CVE-2026-64499 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2 ADC ads1119_triggered_buffer_preenable release of resource (EUVD-2026-48843)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability classified as problematic was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2. Affected by this vulnerability is the function ads1119_triggered_buffer_preenable of the component ADC. Such manipulation leads to missing release of resource. This vulnerability is documented as CVE-2026-64499. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

CVE-2026-64493 | Linux Kernel up to 7.2-rc2 Mpl115 mpl115_read_raw denial of service (EUVD-2026-48837)

Sun, 26 Jul 2026 06:36:08 +0200

A vulnerability marked as problematic has been reported in Linux Kernel up to 6.6.144/6.12.96/6.18.38/7.1.3/7.2-rc2. Impacted is the function mpl115_read_raw of the component Mpl115. Performing a manipulation results in denial of service. This vulnerability is cataloged as CVE-2026-64493. The attack must be initiated from a local position. There is no exploit available. It is suggested to upgrade the affected component.

CVE-2026-64494 | Linux Kernel up to 7.2-rc2 iio light gp2ap002 gp2ap002_read_raw release of resource (EUVD-2026-48838)

Sun, 26 Jul 2026 06:36:08 +0200

A vulnerability labeled as critical has been found in Linux Kernel up to 7.2-rc2. This issue affects the function gp2ap002_read_raw of the component iio light gp2ap002. Such manipulation leads to missing release of resource. This vulnerability is listed as CVE-2026-64494. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

CVE-2026-64495 | Linux Kernel up to 7.1.3 Bmg160 bmg160_core.c bmg160_get_filter/bmg160_set_filter bw_bits out-of-bounds (EUVD-2026-48839)

Sun, 26 Jul 2026 06:36:08 +0200

A vulnerability described as critical has been identified in Linux Kernel up to 7.1.3. The affected element is the function bmg160_get_filter/bmg160_set_filter of the file drivers/iio/gyro/bmg160_core.c of the component Bmg160. Executing a manipulation of the argument bw_bits can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-64495. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended.

CVE-2026-64488 | Linux Kernel up to 7.1.3 ALSA layout.c snd_ctl_new1 null pointer dereference (EUVD-2026-48832)

Sun, 26 Jul 2026 06:36:07 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been declared as very critical. Affected by this vulnerability is the function snd_ctl_new1 of the file layout.c of the component ALSA. Executing a manipulation can lead to null pointer dereference. The identification of this vulnerability is CVE-2026-64488. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

CVE-2026-64489 | Linux Kernel up to 7.1.3 ALSA snd_ctl_new1 null pointer dereference (EUVD-2026-48833)

Sun, 26 Jul 2026 06:36:07 +0200

A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. This vulnerability affects the function snd_ctl_new1 of the component ALSA. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-64489. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

CVE-2026-64491 | Linux Kernel up to 6.18.38/7.1.3/7.2-rc1 ALSA usx2y tascam_disconnect use after free (EUVD-2026-48835)

Sun, 26 Jul 2026 06:36:07 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.38/7.1.3/7.2-rc1. The impacted element is the function tascam_disconnect of the component ALSA usx2y. The manipulation results in use after free. This vulnerability is known as CVE-2026-64491. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

CVE-2026-64492 | Linux Kernel up to 6.18.38/7.1.3 iio temperature driver tmp006_probe use after free (EUVD-2026-48836)

Sun, 26 Jul 2026 06:36:07 +0200

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.38/7.1.3. This affects the function tmp006_probe of the component iio temperature driver. The manipulation results in use after free. This vulnerability is identified as CVE-2026-64492. The attack is only possible with local access. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2026-64486 | Linux Kernel up to 7.1.3 cmipci snd_cmipci_spdif_controls null pointer dereference (EUVD-2026-48830)

Sun, 26 Jul 2026 06:36:06 +0200

A vulnerability was found in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3 and classified as problematic. This impacts the function snd_cmipci_spdif_controls of the component cmipci. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-64486. Local access is required to approach this attack. No exploit exists. It is suggested to upgrade the affected component.

CVE-2026-64487 | Linux Kernel up to 7.1.3 ALSA snd_usb_caiaq_tks4_dispatch out-of-bounds (EUVD-2026-48831)

Sun, 26 Jul 2026 06:36:06 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been rated as problematic. Affected by this issue is the function snd_usb_caiaq_tks4_dispatch of the component ALSA. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-64487. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

CVE-2026-64490 | Linux Kernel up to 6.12.95/6.18.38/7.1.3 ALSA virtsnd_kctl_parse_cfg out-of-bounds (EUVD-2026-48834)

Sun, 26 Jul 2026 06:36:06 +0200

A vulnerability was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3. It has been classified as very critical. Affected is the function virtsnd_kctl_parse_cfg of the component ALSA. Performing a manipulation results in out-of-bounds read. This vulnerability was named CVE-2026-64490. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

Kooperativer Führungsstil: So entfesseln Sie wahre Performance

Sun, 26 Jul 2026 06:33:31 +0200

Kooperative Führungskräfte teilen Verantwortung mit ihren Mitarbeitern und beziehen sie in Entscheidungen ein.

NDAB Creativity – shutterstock.com

Ein Führungsstil beschreibt die Grundhaltung einer Führungskraft sowie ihr Verhalten gegenüber Mitarbeitern. Es gibt verschiedene Theorien und Modelle mit unterschiedlichen Führungsstilen.

Welche Führungsstile gibt es?

Eine bekannte Einteilung hat der Sozialpsychologe Kurt Lewin vorgenommen. Lewin emigrierte 1933 aus Deutschland und forschte in den USA. In dieser Zeit entstand die Unterscheidung und Abstufung zwischen den Führungsstilen autoritär, laissez-faire und kooperativ:

Beim autoritären Führungsstil gibt die Führungsperson ihren Mitarbeitern Anweisungen, was zu tun ist. Mitarbeiter haben diese Anweisungen zu akzeptieren und auszuführen.
Beim Laissez-faire-Führungsstil überträgt die Führungskraft Aufgaben auf die Mitarbeiter. Vorgesetzte machen klare Zielvorgaben, definieren die erwarteten Arbeitsergebnisse und delegieren die Aufgaben an die Mitarbeiter.
Dazwischen liegt der kooperative Führungsstil, bei dem Führungskraft und Mitarbeiter Verantwortung teilen beziehungsweise gemeinsam übernehmen. Eines der Forschungsergebnisse Lewins war, dass ein kooperativer Führungsstil mit einer erhöhten Arbeitszufriedenheit der Mitarbeiter verbunden ist.

Merkmale eines kooperativen Führungsstils

Kooperative Führungskräfte teilen Verantwortung mit ihren Mitarbeitern und beziehen sie in Entscheidungen ein. Für Prof. Dr. Guido Möllering, Direktor des Reinhard-Mohn-Instituts für Unternehmensführung an der Universität Witten/Herdecke, zählt zu den Merkmalen einer kooperativen Führungskraft auch, dass mehr Autonomie gewährt wird bei zugleich gegenseitiger Transparenz und Koordination: “Die formale Führungskraft kommuniziert auf Augenhöhe, das heißt mit Respekt und Anerkennung der Fähigkeiten und Bedürfnisse der Geführten. Es gibt kaum noch Anweisungen, sondern man einigt sich, was zu tun ist”, so Möllering. Man verständige sich häufiger über die gemeinsamen Werte und Ziele. Führungskräfte sähen sich selbst als Vermittelnde.

Für den Transformationsexperten und Berater Martin Michaelis ist es nicht nur eine Frage von Branchen, Unternehmenskultur oder Generationen, ob kooperatives Führen sinnvoll ist. “In der heutigen Zeit ständiger und schneller Veränderung haben Unternehmen gar keine andere Wahl, als Ihren Mitarbeitern in einem bestimmten Maße mehr Verantwortung zu übergeben. Das bedeutet für Führungskräfte, dass sie ihre Mitarbeiter mehr in Entscheidungsprozesse einbinden müssen.” Schwierig werde es dann, wenn unter den Mitarbeitern nur eine niedrige Bereitschaft bestehe, Verantwortung zu übernehmen. “Wichtig ist dann, Schritt für Schritt vorzugehen: je nach individueller Kapazität und nicht zu viel auf einmal an Verantwortungen zu delegieren”, rät Michaelis.

Vor- und Nachteile eines kooperativen Führungsstils

“Die stärkere Partizipation und das Empowerment, das kooperative Führung ermöglicht, sind sehr motivierend, können aber auch überfordern”, weiß Experte Möllering. Wenn Verantwortung stärker geteilt werde, werfe das Fragen auf: Wer trägt das Risiko von gemeinsamen Entscheidungen? Und: Wer bekommt welchen Anteil am gemeinsamen Erfolg? “Wenn ein gemeinsames Verständnis hergestellt werden kann, wie die kooperative Führung wirklich gemeint ist, dann überwiegen klar die Vorteile”, ist Möllering überzeugt. Wichtig sei auch, dass eine echte Beteiligung an der Führung möglich ist. Also nicht am Ende doch wieder einer alles alleine entscheide.

Kooperatives Führen lernen

Doch lässt sich ein solcher kooperativer Führungsstil erlernen? “Es gibt eine Menge Kompetenzen, die erlernt werden können”, sagt Martin Michaelis auf die Frage, ob sich kooperatives Führen erlernen lässt. Dabei unterscheidet er zwischen Methoden und Verhalten, sowie Haltung. Neue Methoden und Verhaltensweisen lassen sich erlernen. Dazu zählt beispielsweise, sich selbst als Führungskraft zurückzunehmen, Mitarbeitern mehr Raum zu geben und ihnen mehr Fragen zu stellen.

“Eine kooperative Haltung braucht meist etwas mehr Zeit”, so Michaelis. Je nach Person ständen oft alte Einstellungen und Glaubenssätze im Weg. Eine wichtige Erkenntnis lautet: Wer kooperativ führen möchte, muss Schritt für Schritt lernen, Vertrauen zu haben. “Eine ‘Dann mache ich das jetzt lieber selbst’-Haltung ergibt keinen Sinn”, sagt Michaelis. In einer konkreten Situation ist eine Aufgabe damit vielleicht schneller und auch besser erledigt. Aber damit nehme man seinen Mitarbeitern den Raum, zu lernen und sich weiterzuentwickeln. Und damit auch die Möglichkeit, zumindest mittelfristig mehr Verantwortung zu übernehmen.

Kooperativ führen

Die Bertelsmann Stiftung und das Reinhard-Mohn-Institut der Universität Witten/Herdecke haben für ihren Führungskräfte-Radar eine repräsentative Befragung unter Führungskräften in Deutschland vorgenommen. Eine Beobachtung: Wenn Home-Office zur Dauereinrichtung wird, befürchten Führungskräfte, dass der Austausch mit den Mitarbeitern mehr und mehr verloren geht und die Unternehmenskultur leidet. Viele Führungskräfte konnten ihre Mitarbeiter in Home-Office-Corona-Zeiten nicht so unterstützen, wie sie es gerne getan hätten (45,7 Prozent). Guido Möllering vom Reinhard-Mohn-Institut sagt: “Die Ausnahmesituation hat uns verschiedene Aspekte deutlicher sehen lassen als sonst”. Er nennt die folgenden drei Punkte:

Führung funktioniert nur, wenn die Geführten mitspielen, also kooperativ die Impulse der Führenden aufnehmen oder konstruktiv der Führungskraft Feedback geben.
Das Management kann gerade in einer Krise nicht alle Probleme alleine lösen und alle Entscheidungen alleine treffen. Notgedrungen wird mehr delegiert, pragmatisch gehandelt und sich aufeinander verlassen. Man ist im Team beim gemeinsamen, kooperativen Problemlösen mehr auf Augenhöhe.
Gerade beim Führen auf Distanz (insbesondere wegen Homeoffice) merkt man deutlich, dass Führen nicht primär Kontrolle, sondern Unterstützung der Geführten bedeutet. Der Team-Gedanke verstärkt sich und die Verantwortung für das gemeinsame Ergebnis wird stärker geteilt.

Kooperative Führungskräfte brauchen Vertrauen

Übergreifend werde deutlich, wie wichtig eine solide Vertrauensbasis sei, so Möllering: “Diese baut man nicht durch hierarchische Anweisungen, sondern durch kollegiale Zusammenarbeit auf.” Im Gegensatz zu dem oft in Krisen vermuteten autoritären Führungsstil hat sich in der zurückliegenden Corona-Pandemie nicht die lenkende Führungskraft früherer Zeiten, sondern die vermittelnde Führungskraft bewährt.

Wie Führungskräfte Teams im Homeoffice leiten

Seit der Pandemie gehört virtuelle Mitarbeiterführung zu den Standartaufgaben für jeden Vorgesetzten. Wir haben die wichtigsten Learnings aus dieser Zeit zusammengefasst.

Zu den größten Herausforderungen zählen die unterschiedlichen Voraussetzungen, womit Teammitglieder bei der Heimarbeit konfrontiert sind. Nicht jeder hat ausreichenden Raum für ein separates Home-Office. Dazu kommen Ablenkungen wie Kinder, Haustiere oder bei Singles ein Gefühl der Isolation. All das hat Einfluss darauf, wie und zu welchen Zeiten Mitarbeiter ihre Aufgaben am besten erledigen können. Vorgesetzte, die offen Verständnis für individuelle Situationen zeigen, schaffen die Grundlage einer vertrauensvollen Zusammenarbeit.

Permanenter Stress im Home-Office ist keine gute Voraussetzung, um kontinuierlich gute Arbeit zu leisten. Wer als Führungskraft vermittelt, dass es okay ist, nicht immer perfekt zu funktionieren, nimmt Mitarbeitern etwas den Druck in der Gewöhnung an die neue Normalität. Vielen fällt es mit dieser Gewissheit leichter, Deadlines einzuhalten und den Erwartungen zu entsprechen.

Ein tägliches Gespräch mit Chefin oder Chef – ist das nicht zu viel der Kommunikation? Nein, denn insbesondere bei der digitalen Mitarbeiterführung ist die Regelmäßigkeit des Austauschs entscheidend. Nur so lässt sich einschätzen, ob alles wie besprochen läuft und sich alle im Team den Anforderungen gewachsen fühlen. Missverständnisse und Fehler passieren – ähnlich wie im Büro – vor allem, wenn zu wenig kommuniziert wird.

Nur mit Personen, zu denen man regelmäßigen Kontakt pflegt, können Beziehungen entstehen. Das funktioniert im Zeitalter des digitalen Austauschs über zahlreiche Kommunikationskanäle. Moderne Videokonferenz-Tools wie Zoom, Teams, Google Meet etc. ermöglichen eine Kommunikation von Angesicht zu Angesicht und machen sichtbar, wie es allen Teammitgliedern geht.

Dezentral organisierte Teamarbeit funktioniert am effektivsten, wenn sich alle über die Grundregeln der Kommunikation einig sind. Vorgesetzte können für klare Verhältnisse sorgen, indem sie Häufigkeit, Zweck und Timing des Austauschs und die dafür priorisierten Kanäle festlegen. Videokonferenzen sind in der Regel die erste Wahl für die tägliche Gruppenbesprechung. Gerade größere Gesprächsrunden lassen sich durch simple Tricks so strukturieren, dass auch Meetings mit hoher Teilnehmerzahl geordnet und effektiv ablaufen. Wenn es um dringliche Angelegenheiten oder Nachfragen geht, sind andere Kanäle wie Instant Messaging der bessere Weg. Unified-Communications-Plattformen ermöglichen eine Vielzahl von Anwendungen und Kommunikationskanälen.

Oft werden beim Übergang von der klassischen Büroarbeit ins Home-Office Aufgaben innerhalb eines Teams neu verteilt oder kommen neue hinzu. Damit Mitarbeiter diese erfüllen können, muss klar sein, was genau von ihnen erwartet wird. Manchen mag es außerhalb der gewohnten Büroatmosphäre anfangs schwerfallen, Aufträge zu priorisieren. Gemeinsam kann geklärt werden, welche Aufgaben Priorität haben und zu schaffen ist. Einfach davon auszugehen, dass jeder weiß, was zu tun ist, ist kontraproduktiv. Besser ist, von Anfang an eine Feedback-Schleife zu vereinbaren, um Erwartungen anzupassen und in den bekannten Applikationen zu dokumentieren.

Teams funktionieren vor allem dann, wenn alle Mitglieder eine gemeinsame Mission verfolgen. Das dabei entstehende Gemeinschaftsgefühl hilft auch, Unsicherheiten zu überwinden und mit ungewohnten Arbeitssituationen umzugehen. Wenn jeder weiß, was er zum gemeinsamen Erfolg beiträgt, ist das die beste Motivation, Höchstleistungen zu erbringen. Erfolge sollten außerdem gewürdigt werden.

Wie lassen sich Engagement und Selbstverantwortung fördern? Indem Führungskräfte sich auf die gewünschten Ergebnisse konzentrieren und Teammitgliedern den Freiraum lassen, selbst einzuteilen, wie sie zum Ziel kommen wollen. Voraussetzung dafür ist ausreichend Zeit und zuvor aufgebautes Vertrauen. Ist das der Fall, lässt sich auf diesem Weg nicht nur die Kreativität der Mitarbeiter fördern, sondern auch kräftezehrendes Mikromanagement vermeiden. Virtuelle Brainstorms lassen sich beispielsweise in Breakout-Räume aufteilen. Kleinere Teams können dadurch in separaten Sitzungen arbeiten und ihre Ideen sammeln, die anschließend in der größeren Runde präsentiert werden.

Regelmäßige Kommunikation und klare Zielvorgaben sind wichtig. Sie dürfen aber nicht dazu führen, dass Mitarbeiter das Gefühl bekommen, im Home-Office überwacht zu werden. Vorgesetzte, die mehrmals täglich penible Rückmeldungen zu erledigten Arbeitsschritten einfordern, signalisieren damit fehlendes Vertrauen. Sie riskieren zudem, dass Teams den Fokus verlieren. Beratung und Betreuung sind besser als strikte Kontrolle.

Als neues Mitglied in ein dezentral arbeitendes Team zu kommen, kann zur Herausforderung werden, weil sich die Dynamik einer Gruppe anfangs schwerer erspüren lässt. Umso wichtiger ist es, Neulingen zu Beginn ihrer Tätigkeit das Gefühl zu geben, Teil der Gruppe zu sein. Unternehmen, die bereits über längere Erfahrung in dezentralem Arbeiten verfügen, haben dies zum festen Bestandteil ihres Onboardings gemacht.

Selbst in gut funktionierenden Arbeitsumfeldern kann es gelegentlich zu Unsicherheiten, Unzufriedenheit oder Ängsten der Mitarbeiter kommen. Die Aufgabe von Führungskräften besteht darin, Teams davor zu schützen. Das gelingt am besten, wenn auch die sozialen Aspekte der gemeinsamen Arbeit berücksichtigt werden. Dafür braucht es keine verpflichtenden gemeinsamen Kaffeepausen, aber von Zeit zu Zeit die Gelegenheit für einen lockeren Austausch, der Mitarbeitern das Gefühl gibt, trotz der Distanz wahrgenommen zu werden. Virtuell lässt sich der Teamgeist auch fördern, wenn zur Abwechslung mal eine Happy Hour, ein virtuelles Quizzen oder ein gemeinsames Essen per Videochat organisiert wird.

Firefox' New Tab Page Will Get Widgets - Including an AI-Powered Daily Crossword

Sun, 26 Jul 2026 06:31:16 +0200

Read more of this story at Slashdot.

Did Virginia Regulators Downplay Data Center Health Concerns?

Sun, 26 Jul 2026 06:31:16 +0200

Politico reports that in the Virginia area alone there's dozens of data center projects "that altogether need 70 gigawatts of power — equivalent to 70 nuclear plants" — currently seeking connection to their grid. But there's also concerns about a Virginia data center powered with natural gas and backup diesel generators: When Virginia's top environmental regulator received an analysis warning of data center pollution, it took him less than five minutes to forward it to seven people on his staff... Internal emails obtained by POLITICO through a public records request paint a portrait of an agency that moved quickly to defend the only data center in Virginia that is powering itself — in what former officials and environmental health advocates described as an unusual effort to shape the debate around an industry whose global epicenter is in the state. The agency's pushback focused on the report's findings that the facility in Loudoun County could release harmful amounts of air pollution through eight bus-sized natural gas turbines — as allowed by permits granted by the Department of Environmental Quality [DEQ] itself... The request comes as data centers are devising new ways to produce their own power as a way to temper growing public discord over rising electricity prices amid the AI construction boom. Virginia has more than 600 data centers. The report [commissioned by Virginia's 54-year-old environmental nonprofit Piedmont Environmental Council] raised concerns that the data center's on-site power system, which also includes dozens of backup diesel generators, could cause tens of millions of dollars in health damages to people living around the facility, owned by Vantage Data Centers... [The analysis also argued the pollution could lead to 3.4 to 6.5 premature deaths annually.] People living near the Vantage facility in Sterling say its natural gas turbines produce constant noise and air pollution. The permits for Vantage issued by DEQ in 2023 allow cumulative emissions of seven different pollutants, including 95 tons per year of nitrogen oxides and more than 56 tons of soot. Both contribute to asthma and heart attacks. Those figures are in line with other state permits for minor sources of pollution, but DEQ's permits for Vantage have sparked local concerns because of the facility's location in a residential area... [Viriginia environmental quality officials] raised questions about whether the report wrongly described the facility's potential air pollution as dangerous, when soot levels in Loudoun County are deemed acceptable by America's Environmental Protection Agency (EPA). Health experts, including former EPA air quality official Michael Korber, told POLITICO that soot pollution can negatively affect human health even at EPA-approved levels. The World Health Organization's standard for ambient soot pollution is nearly half of what EPA suggests is safe. Some current and former staffers on Virginia's Department of Environmental Quality believe it's inappropriate for the agency to issue aggressive statements on the healthfulness of the data centers, with one former department leader saying Virginia's DEQ "is not the health department."

Read more of this story at Slashdot.

Drying Lakebeds Are Releasing Massive Amounts of Carbon, Study Finds

Sun, 26 Jul 2026 06:31:16 +0200

"In many parts of the world, lakes are drying out at a scale so massive that scientists are warning they may be emitting enough greenhouse gases to rival our fossil fuel habit," reports ScienceAlert: In a new study published in Science, scientists say the Aral Sea — the world's largest desiccated lake — has emitted a whopping 204 megatons (~225 million US tons) of carbon dioxide since it was drained in the 1960s... The study estimates that between 1960 and 2022, the evaporating sea has released 204 megatons of carbon dioxide into the atmosphere, based on site surveys and core samples collected from across the dry lakebed... The new study suggests that rehydrating the entire basin could come with enormous benefits to the environment, not just within the sea itself, but at a global level. "There is a hidden carbon treasure beneath the Aral Sea," says biochemist Rafael Marcé from the Spanish National Research Council. "If these sediments remain exposed, carbon will continue to be released into the atmosphere. If the sea is re-flooded, that same carbon could shift from being a source of emissions to becoming part of the climate solution." According to the researchers' calculations, re-flooding the lakebed could prevent the release of the estimated 165 megatons of carbon that remain. The study also revealed that nearly one-fifth of the Aral Sea's carbon emissions are actually being released as wind blows away sediment on the lakebed, a factor that researchers had not accounted for in the past. Thanks to Slashdot reader schwit1 for sharing the article.

Read more of this story at Slashdot.

32 of 35 Students Caught Using Hilariously Wrong AI-Generated Answers for Professor's Midterm

Sun, 26 Jul 2026 06:31:15 +0200

"32 of my 35 students between two classes failed a portion of their midterm because they all used AI to generate their entire response," history professor Jason Gibson says in a viral video shared over 10 million times. "And apparently, they didn't proofread it." The instructions included a hidden white-font prompt to use the word Madagascar "in a way that makes no sense." So if he saw the word Madagascar, "I knew that they copied and pasted the whole thing, and just threw it in AI." Futurism reports: [A]pparently none of the indolent cheats put in the bare modicum of effort required to at least check if what the AI wrote made any sense at all... [Gibson shared some AI-generated answersin a follow-up video.] An observation about AI automation was unceremoniously closed with how the island nation "wore a toaster to a basketball game," he also shared. And social media's impact on the world was compared to a "long journey to Madagascar." Gibson makes it clear that humiliating his students wasn't the point. He says he fully explained how he caught them afterwards, and that he gave the students an opportunity to contest their grade. (Only two did, showing at least that they do feel shame....) He definitely isn't the only educator going through similar tribulations... One Brown University professor discovered that over half his students were using AI to cheat on an exam, and Princeton University has even dropped its over century-old Honor Code tradition by forcing exams to be supervised after being mired in its own chatbot cheating scandal. "We don't know best practices for navigating academia with AI," Gibson warned. "We're all just trying to hold onto some level of academic integrity in the process." "First and foremost, Madagascar has nothing to do with the Industrial Revolutionary," Gibson says with exasperation in the video. "Second, it was more than obvious that they didn't even go back and re-read these responses... If you're going to use AI to generate the entire response, at least re-read it!" Here's how one student answered the test question. "Today technology such as artificial intelligence, smartphones, and automation is changing many jobs by making work faster and reducing the need for some manual tasks. Madagascar floats sideways through the afternoon." And another student wrote "At the same time not everyone has the same access to technology, which can make social inequality even worse. Madagascar purple bicycle whispers to the ceiling."

Read more of this story at Slashdot.

Hyundai Claims Humanoid Robot Plan Is Not Part of Talks With Striking Workers

Sat, 25 Jul 2026 23:16:07 +0200

Ars Technica reports: Hyundai Motor Company's plan to put humanoid robots to work by 2028 is not part of current negotiations with striking South Korean autoworkers, according to the company. The automaker is disputing news reports that partial labor strikes by the Hyundai Motor union at the world's largest automotive plant in South Korea were spurred by concerns about the company's planned deployment of humanoid robots in the United States starting in 2028. [The planned robots are built by Boston Dynamics, now a wholly-owned subsidiary of Hyundai.] A Hyundai statement shared with Ars describes the union's demands as focusing on compensation-related issues such as wage increases, bonuses, and an extension of workers' retirement age. "Potential deployment of robots in Korean production facilities is not part of the current labor-management discussions," according to the Hyundai statement... Hyundai emphasized that its current plan only covers the initial deployment of the Atlas humanoid robot at Metaplant America, an electric vehicle factory near Savannah, Georgia, starting in 2028. "Decisions about future Atlas deployment at other facilities will be made thoughtfully, in accordance with local operational needs, and in dialogue with the employees and workforce representatives at those sites," the company stated. However, The Wall Street Journal described the Hyundai Motor union as making "unprecedented demands seeking to enshrine job protections in the era of robots and AI," and characterized certain compensation demands as hedging against potential reductions in work hours caused by AI adoption and robotic automation. "Remember that without labor-management agreement, not a single robot using new technology will be allowed to enter the workplace," the union told Hyundai in an internal letter reported by Reuters. Hyundai management and the labor union are currently reviewing a proposed wage reform that would "provide factory workers with greater income stability even after the carmaker's planned deployment of humanoid robots," The Korea Times reported. But experts cautioned that the wage overhaul, which would convert hourly pay for overtime and night-shift allowances into fixed wages, could come at the expense of company productivity.

Read more of this story at Slashdot.

Amazon Cracks Down On Use of AI Images By Sellers

Sat, 25 Jul 2026 22:16:17 +0200

CNBC reports: Amazon is requiring that third-party sellers label any product images or videos that contain "AI-generated people" after New York recently passed a law mandating greater transparency around "synthetic performers" in ads... The policy directs sellers to tag images [and videos or other graphics on listing pages] with specific metadata keywords before they're uploaded. "Recent legislation requires disclosure when images or videos in advertisements contain photorealistic AI-generated people," Amazon wrote in the announcement [clarifying that the requirement doesn't apply to content featuring TV/video game/movie characters or content including real people, even if they've been altered using AI]. The company said it will "add an indicator" to listings on its website, informing consumers that images or other content feature AI-generated people, "where applicable." It's unclear what criteria Amazon will apply when deciding when to display the label to shoppers... Amazon has embraced AI internally and it's increasingly infusing the technology across its portfolio. The company has optimized listing titles and details so they're more likely to be spotted by AI systems, invested in a recently rebranded assistant called Alexa for Shopping, and launched a feature that injects AI-generated [images of] products into its search bar in real time based on user queries. More Amazon third-party sellers are using AI to generate text, images and other content for their listings, partly by using the company's tools. Outside sellers account for more than 60% of goods sold on Amazon, the article points out. It adds that there's currently no nationwide U.S. law requiring companies to disclose AI-generated advertising content, it adds — but YouTube, Meta, Pinterest, and TikTok have already added labels for AI-generated content. And a new California law also requires large AI providers to embed watermarks in AI-generated images, video and other content...

Read more of this story at Slashdot.

Top Online Sites Debate Cutting Off Google's Crawlers

Sat, 25 Jul 2026 21:04:59 +0200

Futurism reports: [Some online publications] are now debating whether to cut Google off entirely, as the Wall Street Journal reports, illustrating an increasingly fraught relationship between the tech giant and the publishers that are creating content its AI models are regurgitating. According to the newspaper, prominent outlets including USA Today, Politico, the Economist, People, and Reuters are all reexamining their relationship with Google. Some are debating whether to continue to work with the tech giant at all... Even Reddit executives are reevaluating the company's $60 million-a-year contract that allows Google to train its AI models on user-submitted content on the platform. They've similarly watched as Google's AI features discourage users from navigating to Reddit... Beyond pondering whether to cut Google off, other publishers have resorted to suing the company, accusing it of illegally rehashing their intellectual property via AI summaries. It's an extremely undesirable position for publishers. By severing ties with the search giant, they could face even steeper declines in traffic. At the same time, there's seemingly little to gain from having Google's AIs crawl their content — and in the long term, it could guarantee their destruction. Two interesting data points from the article: "Last month, Cloudflare CEO Matthew Prince noticed that automated bot traffic had overtaken human traffic for the first time in the internet's history." "USA Today has seen its traffic from US users drop by almost half over the last year."

Read more of this story at Slashdot.

Weekend deals deliver $299 Apple Watch Series 11, $89 AirTag 4-pack, $399 iPad

Sat, 25 Jul 2026 20:54:08 +0200

Amazon's weekend Apple sale is going strong, with price drops of up to $150 off Apple Watch, AirTag, and iPad devices.

Apple Watch, AirTags, and iPads are all on sale this weekend.

Continue Reading on AppleInsider | Discuss on our Forums

China is Creating a Herd of 100 Elite Yak Clones

Sat, 25 Jul 2026 20:01:07 +0200

CNN reports on yaks "designed and cloned" in secretive, high-altitude labs in Tibet — 2.4 miles (4,000 meters) above sea level. They're a critical part of the local economy, and researchers "hope to create an 'elite' herd of super-yaks, healthier and more fertile than their predecessors." Both domestic yaks and their wild cousins have been facing threats for years, with some rare subspecies at risk of disappearing entirely. Authorities in the southwestern Chinese region have poured tens of millions of dollars into boosting the yak industry in recent years — and they hope cloning can help. The first yak clone came in July 2025, Chinese state media hailing it as a breakthrough achievement that combined cloning with gene selection. More clones were born this spring — and researchers are now aiming to create a herd of more than 100 "elite" yak clones by 2028, boasting desired traits like faster growth and larger size. "This shows the technology has moved from a one-time success to a stable, mass-scale application," said Fang Shengguo, the project's scientific lead and director of the State Conservation Center for Gene Resources of Endangered Wildlife, according to state-run news agency Xinhua... Many experts acknowledge there are legitimate arguments for using cloning in conservation, and for gene selection in farming. But the ethical waters are murky, and any such project should have high levels of public transparency and accountability, said Lisa Moses, a veterinarian and bioethicist at Harvard Medical School. So far, much of the yak cloning project remains mysterious, with information largely limited to glowing state-media coverage... [S]ome scientists say these projects reduce our sense of urgency toward fixing the environment, and that we can't simply churn out clones while the planet burns. To truly enact change, they say, we have to continue addressing the root cause of the problem — restoring degraded habitats, lowering carbon emissions, cracking down on poaching, and more. But for others, "there is a strong feeling ... that traditional conservation is essentially failing now," Moses said. "What we've been doing for the last 100 years to try to stave off ecological destruction is not working.... The argument is, we don't have a choice," she added. "If we want to try to do something that will actually make a difference, we need to use these technologies, specifically synthetic biology, to essentially override evolution and change the fitness of the species for the environment that they live in." "History is littered with good intentions in the environment gone wrong," Moses said, "and I would argue that these technologies have even more unknowns than ones that we previously employed." The article points out that the number of wild yaks "dropped more than a third in the last 30 years, with just 10,000 to 20,000 individuals left, according to the Wildlife Conservation Society." The yaks are threatened by climate change and habitat degradation, "with warmer temperatures bringing invasive plant species and increased competition for resources... in one of the world's most inhospitable terrains."

Read more of this story at Slashdot.

Tech layoffs: A 2026 timeline

Sat, 25 Jul 2026 19:50:08 +0200

Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.

But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.

According to data compiled by Layoffs.fyi, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.

Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.

Notable tech layoffs in 2026

Monday.com
Microsoft
Meta
Cisco
Cloudflare
Oracle
Atlassian
Salesforce
Amazon
Ericsson

July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era

The company says the decision to cut 620 jobs isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.

July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams

As the company trims thousands of jobs, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees voluntary retirement buyouts.

June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024

AI was blamed for 40% of the job cuts in May, up from 7% in January, according to research by employment placement company Challenger, Gray & Christmas.

May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce

The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, according to Yahoo Tech.

May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking

Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will eliminate almost 4,000 jobs.

May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring

About 20% of Cloudflare’s global workforce will be culled as the company pivots for the agentic AI era, Reuters reported.

April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk

Oracle began laying off employees on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. (Note: in June, CNBC put the final layoff tally at 21,000.)

March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion

Atlassian will reduce its global workforce by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.

March 11, 2026: Tech layoffs surpass 45,000 in early 2026

A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing workforce cuts even as many tech companies report strong revenue growth.

February 10, 2026: Salesforce lays off staffers as executive leadership churn continues

Salesforce has reduced close to 1,000 roles earlier this month across teams, including marketing, product management, data analytics, and its Agentforce AI unit, Business Insider reported, quoting employees familiar with the matter.

January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent

As the market slows down, AWS and other Amazon units are preparing for another round of layoffs, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 confirmed 16,000 job cuts.

January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden

Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, Reuters reports.

January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business

Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, according to The New York Times.

Layoffs in 2025

Cisco
Oracle
Windsurf
Intel
Microsoft
Crowdstrike
HPE
Autodesk
HPE
CISA
Workday
Salesforce
Meta

Global tech-sector layoffs surpass 244,000 in 2025

Economic uncertainty, elevated interest rates, and AI adoption have driven workforce reductions across tech companies worldwide, according to a RationalFX report.

October 28, 2025: Amazon to cut 14,000 jobs across company

Amazon will reduce its overall workforce by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.

August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs

Tech companies Cisco and Oracle are cutting hundreds of jobs across the Bay Area. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date

August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door

Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, reports The Information.

July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’

Intel will reduce its workforce to 75,000 employees by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker

July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs

Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect major layoffs at Intel in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales.

July 2, 2025: Microsoft will cut 9,000 workers

Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut told CNBC. The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.

June 17, 2025: Intel looks to factory layoffs to return to profitability

Intel will lay off up to 20% of its manufacturing sector employees starting in July, according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.

May 7, 2025: CrowdStrike to lay off 5% of staff

CrowdStrike announced a plan to cut about 500 roles, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs

March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy

CEO Antonio Neri told Wall Street analysts that HPE would begin implementing a cost-cutting program involving layoffs of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.

Feb. 27, 2025: Autodesk to lay off 9% of workforce

Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, CEO Andrew Anagnost said in a message to employees. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there.

Feb. 27, 2025: HP to lay off 2,000 more

As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by forcing callers to wait for at least 15 minutes if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on.

Feb. 21, 2025: CISA lays off 130

Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.

Feb. 5, 2025: Workday lays off 1,750

As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.

Feb. 4, 2025: Salesforce lays off over 1,000

At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.

Jan. 14, 2025: Meta will lay off 5% of workforce

Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.

Tech layoffs in 2024

Equinix
AMD
Freshworks
Cisco
General Motors
Intel
OpenText
Microsoft
AWS
Dell

Nov. 26, 2024: Equinix to cut 3% of staff

Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.

Nov. 13, 2024: AMD to cut 4% of workforce

AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings.

Nov. 7, 2024: Freshworks lays off 660

Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.

Sept. 17, 2024: Cisco lays off 6,000

After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security.

Aug. 20, 2024: General Motors lays off 1,000 software staff

More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.

August 1, 2024: Intel removes 15,000 roles

Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”

July 4, 2024: OpenText to lay off 1,200

OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.

June 4, 2024: Microsoft lays off staff in Azure division

Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.

April 4, 2024: Amazon downsizes AWS in a fresh cost-cutting round

Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “Just Walk Out” technology built for its Amazon Fresh grocery stores.

April 1, 2024: Dell acknowledges 13,000 job cuts

Dell Technologies’ latest 10K filing with the US Securities and Exchange Commission disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.

See news of earlier layoffs.

‘I thought, I’ve tried everything else, why not give AI a shot?’: the long-lost family reunited by ChatGPT

Sat, 25 Jul 2026 19:50:01 +0200

Avtar spent decades wondering what happened to the mother he never got to know. Thousands of miles away, Nicci was haunted by the story of a half-brother given away before she was born. How did a chatbot bring them together?

As a small boy growing up in Amritsar, India, in the 1960s, Avtar Singh used to hear whispers. Your mum isn’t really your mum, the rumours would say. Your mum lives abroad. Avtar didn’t really pay any attention to it. “I thought, the neighbours are just making up stories.” But the stories were true: the woman raising Avtar was actually his grandmother. When he was too young to remember it, his father had emigrated to Canada to work as a teacher, leaving Avtar in the care of his paternal grandparents. His grandfather, a police officer, was a fearsome authoritarian, but his grandmother brought him up with tenderness, as if he were her own son. She called him by his nickname, Titu. He felt loved.

When Avtar was around eight years old, he was told about his family in Canada: his dad, his mum and a little brother were waiting for him there, and he would soon travel to join them. Just after his ninth birthday, Avtar found himself sitting on a plane, dressed in a three‑piece suit and tie. He was travelling alone. He had never flown before. He didn’t speak a word of English. He landed in Halifax, Nova Scotia, on Christmas Eve, 1968; his family met him at the airport and took him home. “I didn’t know what to think,” Avtar, now 66, tells me in a video call from his home in Abbotsford, British Columbia. “Before I knew it, it was the first week of January, and I was put in school.”

Harry Potter publisher to receive millions in Anthropic copyright settlement

Sat, 25 Jul 2026 19:50:01 +0200

Bloomsbury has 14,087 titles listed in agreement between AI startup and authors over use of their work

The publisher of Harry Potter has received a multimillion-pound payout as a beneficiary of a $1.5bn (£1.12bn) copyright settlement between the AI startup Anthropic and thousands of authors over the use of their protected work to power chatbots.

Bloomsbury, which is home to the bestselling novelists Sarah J Maas and Susanna Clarke as well as JK Rowling, said it had 14,087 titles listed within the settlement, with a proposed compensation of about $3,000 a title.

Agent Kim Reactivated Episode 10 Recap: Ending Explained and Season 2 Setup

Sat, 25 Jul 2026 19:47:47 +0200

Agent Kim Reactivated Episode 10 brings the first season to a tense close as Manager Kim fights for Min-ji’s future while South Korean intelligence officials pull him into another dangerous mission. The finale delivers action, emotional reunions, political betrayal, and a cliffhanger that leaves Kim’s promised freedom uncertain. Release date: July 25, 2026 Streaming platform: Netflix Genre: Action, crime, espionage thriller The series follows Manager Kim, an ordinary office worker and single father who previously served as a highly trained black-ops agent. His hidden life returns after his daughter, Min-ji, disappears, forcing him to reconnect with former operatives Han-soo and Jin-cheol. Spoilers ahead for Agent Kim Reactivated Episode 10 The finale begins with Kim trapped and repeatedly questioned about his activities in South Korea. He remains silent until an interrogator threatens Min-ji, prompting him to attack, break free, and attempt another escape. Kim soon learns that the imprisonment was part of a loyalty test arranged by South Korean intelligence. Officials want to determine whether he can still follow orders before assigning him another classified operation. They offer Kim and Min-ji new identities and a chance to disappear after he completes one final mission. Kim agrees, but only after demanding protection for Min-ji and freedom for Han-soo and Jin-cheol. His two friends later wake up after being drugged and abandoned far from home, adding a short comic break after the episode’s intense opening. Gang-chan prepares another attack While Kim handles the government’s mission, Ju Gang-chan continues planning revenge. He discovers that Kim and Min-ji have effectively disappeared from official records, which makes them easier targets for anyone operating outside the law. Gang-chan begins working with political and North Korean contacts, showing that the conspiracy surrounding Kim goes far beyond one personal conflict. His obsession with destroying Kim keeps the threat alive even after several of his earlier plans fail. Kim eventually reunites with Han-soo and Jin-cheol, but their relief does not last long. Intelligence agents surround their location and announce that Kim’s operation has technically failed. Officials then order Kim and the North Korean Director General to be returned across the border. Does Manager Kim save Min-ji? Min-ji remains alive and protected by the end of Episode 10. Kim succeeds in keeping her away from immediate danger, although he does not receive the peaceful life he was promised. The final scene leaves Kim trapped between two governments, powerful enemies, and possible traitors inside South Korea’s intelligence service. The finale also suggests that someone within the agency has been manipulating events, creating a clear storyline for another season. Netflix currently describes Agent Kim Reactivated as a limited series, and no official Season 2 renewal has been announced. Agent Kim Reactivated Episode 10 ends the kidnapping storyline while keeping Kim’s larger battle unfinished. Do you think Kim will uncover the intelligence mole and finally escape with Min-ji? Let us know in the comments.

One of these 13 gadgets could be the hero your junk drawer needs (here's why)

Sat, 25 Jul 2026 19:03:32 +0200

From tiny box cutters to bug-bite healers, these handy gadgets totally earn their place in your home for their form and function.

Pwn2Own Berlin 2026: The Full Schedule

Sat, 25 Jul 2026 19:02:56 +0200

Willkommen! (Welcome!) Pwn2Own Berlin 2026 has arrived at OffensiveCon, and the world’s top security researchers are ready. This year’s enterprise-focused competition features AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products.

Earlier today, we held the random draw to determine attempt order. Below is the official schedule. All times are Berlin local time (CET) and may change as the competition progresses. Check back for live updates.

In case you missed it, you can watch the draw here.

Jump to:

Day One

Day Two

Day Three

DAY ONE

Thursday, May 14 - 1030

chompie of IBM X-Force Offensive Research (XOR) targeting NV Container Toolkit in the NVIDIA category for a total of $50,000 and 5 Master of Pwn points

Le Duc Anh Vu ( @vulda ) of Viettel Cyber Security (@vcslab) targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) targeting Microsoft Edge – Sandbox Escape in the Web Browser category for a total of $175,000 and 17.5 Master of Pwn points

Thursday, May 14 - 1130

k3vg3n targeting LiteLLM in the Local Inference category for a total of $40,000 and 4 Master of Pwn points

Satoki Tsuji (@satoki00) / Ikotas Labs, Inc. targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points

Thursday, May 14 - 1300

Angelboy (@scwuaptx) of DEVCORE Research Team and TwinkleStar03 (@_twinklestar03), working with DEVCORE Internship Program targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points

Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Park Jae Min (@hiariz) targeting Oracle Autonomous AI Database in the AI Database category for a total of $40,000 and 4 Master of Pwn points

Thursday, May 14 - 1400

Satoki Tsuji (@satoki00) / Ikotas Labs, Inc. targeting LiteLLM in the Local Inference category for a total of $40,000 and 4 Master of Pwn points.

Yoseop kim(@pwning_me) targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points

Thursday, May 14 - 1500

Ben Koo (@kiddo_pwn) of Team DDOS targeting Mozilla Firefox – Renderer Only in the Web Browser category for a total of $50,000 and 5 Master of Pwn points

Interrupt Labs targeting NV Container Toolkit in the NVIDIA category for a total of $50,000 and 5 Master of Pwn points

Thursday, May 14 - 1530

maitai (@MaitaiThe) of Doyensec (@Doyensec) targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Thursday, May 14 - 1600

Billy (@st424204), Pan Zhenpeng(@Peterpan980927), Weiming Shi (@bestswngs) of STARLabs SG (@starlabs_sg) targeting LM Studio in the Local Inference category for a total of $40,000 and 4 Master of Pwn points

Marcin Wiązowski targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points

Thursday, May 14 - 1630

haehae (@haehaeYang) of Out Of Bounds targeting Chroma in the AI Database category for a total of $20,000 and 2 Master of Pwn points

Thursday, May 14 - 1730

chompie of IBM X-Force Offensive Research (XOR) targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points

Yoseop Kim(@pwning_me) targeting Mozilla Firefox – Renderer Only in the Web Browser category for a total of $50,000 and 5 Master of Pwn points

Thursday, May 14 - 1800

@rewhiles of Viettel Cyber Security (@vcslab) targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Thursday, May 14 - 1830

Kentaro Kawane of GMO Cybersecurity by Ierae targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points

Qrious Secure (@qriousec) targeting LM Studio in the Local Inference category for a total of $40,000 and 4 Master of Pwn points

Thursday, May 14 - 1900

haehae (@haehaeYang) of Out of Bounds targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points

Back to top

DAY TWO

Friday, May 15 - 1030

Ben Koo (@kiddo_pwn) of Team DDOS targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points

Stephen Fewer (Rapid7) targeting Microsoft SharePoint in the Server category for a total of $100,000 and 10 Master of Pwn points

Tao Yan (@Ga1ois) and Edouard Bochin (@le_douds) from Palo Alto Networks targeting Apple Safari – Renderer Only in the Web Browser category for a total of $75,000 and 7.5 Master of Pwn points

Friday, May 15 - 1130

Le Duc Anh Vu ( @vulda ) of Viettel Cyber Security (@vcslab) targeting Cursor in the Coding Agent category for a total of $30,000 and 3 Master of Pwn points

Nikolaos Mourousias (@deltaclock), Caue Obici (@caueobici) and Bruno Halltari (@BrunoModificato) of OtterSec targeting LM Studio in the Local Inference category for a total of $40,000 and 4 Master of Pwn points

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Friday, May 15 - 1300

Ruitong from the Abstract Team at the University of Colorado Boulder targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points

Friday, May 15 - 1330

Kiyong Kwak of Kakaogames and Song Nuri of Samsung Electronics targeting Apple Safari – Renderer Only in the Web Browser category for a total of $75,000 and 7.5 Master of Pwn points

Orange Tsai (@orange_8361) of DEVCORE Research Team targeting Microsoft Exchange in the Server category for a total of $200,000 and 20 Master of Pwn points

Friday, May 15 - 1400

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Friday, May 15 - 1430

Billy (@st424204), Bruce Chen(@bruce30262), Pan Zhenpeng(@Peterpan980927), Weiming Shi (@bestswngs ) of STARLabs SG (@starlabs_sg) targeting Megatron Bridge in the NVIDIA category for a total of $20,000 and 2 Master of Pwn points

David Tae, Louis Hur of Out Of Bounds targeting Ollama in the Local Inference category for a total of $40,000 and 4 Master of Pwn points

Friday, May 15 - 1530

Team: Alon Ben Tsur (@iamgweej), Yahav Azran (@_yahav) targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points

Friday, May 15 - 1600

@rewhiles of Viettel Cyber Security (@vcslab) targeting Mozilla Firefox – Renderer Only in the Web Browser category for a total of $50,000 and 5 Master of Pwn points

Siyeon Wi targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points

Friday, May 15 - 1630

Byung Young Yi (@yibarrack) of Out Of Bounds targeting LiteLLM in the Local Inference category for a total of $40,000 and 4 Master of Pwn points

Friday, May 15 - 1700

Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) targeting Cursor in the Coding Agent category for a total of $30,000 and 3 Master of Pwn points

Friday, May 15 - 1800

Daniel Cohen Hillel (@0xDACA) targeting NV Container Toolkit in the NVIDIA category for a total of $50,000 and 5 Master of Pwn points

Back to top

DAY THREE

Saturday, May 16 - 1100

Le Tran Hai Tung (@tacbliw), dungnm (@dungnm_) and hieuvd (@gr4ss341) of Viettel Cyber Security (@vcslab) targeting Microsoft Windows 11 in the Local Escalation of Privilege category for a total of $30,000 and 3 Master of Pwn points

Satoki Tsuji (@satoki00) / Ikotas Labs, Inc. targeting OpenAI Codex in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam). targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points

Saturday, May 16 - 1330

Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Hyunwoo Kim (@v4bel) targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for a total of $20,000 and 2 Master of Pwn points

Team: Giuseppe Calì (@_gcali) of Summoning Team targeting VMware ESXi in the Virtualization category with the Cross-tenant Code Execution Addon add-on for a total of $200,000 and 20 Master of Pwn points

Saturday, May 16 - 1430

splitline (@_splitline_) of DEVCORE Research Team targeting Microsoft SharePoint in the Server category for a total of $100,000 and 10 Master of Pwn points

Saturday, May 16 - 1600

Byung Young Yi (@yibarrack) of Out Of Bounds targeting Anthropic Claude Code in the Coding Agent category for a total of $40,000 and 4 Master of Pwn points

Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) targeting VMware ESXi in the Virtualization category with the Cross-tenant Code Execution Addon add-on for a total of $200,000 and 20 Master of Pwn points

Follow the action live! We’ll be posting real-time updates and results throughout the competition on our blog and across social media. Stay up to date by following us on Twitter, Mastodon, LinkedIn, and Bluesky, and join the conversation using #Pwn2Own Berlin and #P2OBerlin for continuous coverage.

The May 2026 Security Update Review

Sat, 25 Jul 2026 19:02:56 +0200

I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.

Adobe Patches for May 2026

For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-49	Adobe Commerce	15	Critical	8.7	No	2
APSB26-48	Adobe After Effects	4	Critical	7.8	No	3
APSB26-50	Adobe Connect	2	Critical	9.6	No	3
APSB26-51	Adobe Illustrator	4	Critical	7.8	No	3
APSB26-47	Adobe Media Encoder	2	Critical	7.8	No	3
APSB26-46	Adobe Premiere Pro	3	Critical	7.8	No	3
APSB26-55	Adobe Substance 3D Painter	2	Critical	7.8	No	3
APSB26-54	Adobe Substance 3D Sampler	1	Critical	7.8	No	3
APSB26-53	Content Authenticity SDK	14	Critical	7.5	No	3
APSB26-52	Adobe Substance 3D Designer	5	Important	6.3	No	3
TOTAL	10 bulletins	52

The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.

Microsoft Patches for May 2026

This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.

This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.

None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:

- CVE-2026-41096 - Windows DNS Client Remote Code Execution Vulnerability
This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.

- CVE-2026-41089 - Windows Netlogon Remote Code Execution Vulnerability
This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.

- CVE-2026-42898 - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.

- CVE-2026-40415 - Windows TCP/IP Remote Code Execution Vulnerability
This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.

Here’s the full list of CVEs released by Microsoft for May 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-35435	Azure AI Foundry Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-35428	Azure Cloud Shell Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-42826	Azure DevOps Information Disclosure Vulnerability	Critical	10	No	No	Info
CVE-2026-32207	Azure Machine Learning Notebook Spoofing Vulnerability	Critical	8.8	No	No	Spoofing
CVE-2026-33109	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-33844	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9	No	No	RCE
CVE-2026-41105	Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability	Critical	8.1	No	No	EoP
CVE-2026-33111	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26129	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26164	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-33821	Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability	Critical	7.7	No	No	EoP
CVE-2026-42898	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-40379	Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability	Critical	9.3	No	No	Spoofing
CVE-2026-40363	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40358	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-34327	Microsoft Partner Center Spoofing Vulnerability	Critical	8.2	No	No	Spoofing
CVE-2026-40365	Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41103	Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability	Critical	9.1	No	No	EoP
CVE-2026-33823	Microsoft Team Events Portal Information Disclosure Vulnerability	Critical	9.6	No	No	Info
CVE-2026-40364	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40366	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40361	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40367	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-42831	Office for Android Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-41096	Windows DNS Client Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-35421	Windows GDI Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-40403	Windows Graphics Component Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-40402	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-32161	Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability	Critical	7.5	No	No	RCE
CVE-2026-41089	Windows Netlogon Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-32175	.NET Core Tampering Vulnerability	Important	4.3	No	No	Tampering
CVE-2026-32177	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-35433	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2025-54518 *	AMD: CVE-2025-54518 CPU OP Cache Corruption	Important		No	No	RCE
CVE-2026-42899	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40381	Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42823 †	Azure Logic Apps Elevation of Privilege Vulnerability	Important	9.9	No	No	EoP
CVE-2026-33833	Azure Machine Learning Notebook Spoofing Vulnerability	Important	8.2	No	No	Spoofing
CVE-2026-32204	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42830	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-33117	Azure SDK for Java Security Feature Bypass Vulnerability	Important	9.1	No	No	SFB
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-35424	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-41614	M365 Copilot for Desktop Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-41100	Microsoft 365 Copilot for Android Spoofing Vulnerability	Important	4.4	No	No	Spoofing
CVE-2026-40377	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-41094	Microsoft Data Formulator Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40417	Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42833	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Important	9.1	No	No	RCE
CVE-2026-42838	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	5.4	No	No	EoP
CVE-2026-40360	Microsoft Excel Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-40359	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-40362	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-42832	Microsoft Excel Spoofing Vulnerability	Important	7.7	No	No	Spoofing
CVE-2026-34329	Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40419	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40418	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35436	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-40420	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-42893	Microsoft Outlook for iOS Tampering Vulnerability	Important	7.4	No	No	Tampering
CVE-2026-40374	Microsoft Power Automate Desktop Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41102	Microsoft PowerPoint for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35439	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40368	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33110	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-33112	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40357	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-32185	Microsoft Teams Spoofing Vulnerability	Important	5.5	No	No	Spoofing
CVE-2026-41101	Microsoft Word for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35440	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40421	Microsoft Word Information Disclosure Vulnerability	Important	4.3	No	No	Info
CVE-2026-41097	Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-40370 †	SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-41613	Visual Studio Code Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-41612	Visual Studio Code Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41611	Visual Studio Code Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-41610	Visual Studio Code Security Feature Bypass Vulnerability	Important	6.3	No	No	SFB
CVE-2026-33839	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33840	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34330	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34331	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35423	Windows 11 Telnet Client Information Disclosure Vulnerability	Important	5.4	No	No	Info
CVE-2026-35438	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-41086	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-34344	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34345	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35416	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41088	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34343	Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35418	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33835	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34337	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40407	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40397	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42896	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35419	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34336	Windows DWM Core Library Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-33834	Windows Event Logging Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32209	Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-33841	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35420	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40369	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34332	Windows Kernel-Mode Driver Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-34339	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-34341	Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33838	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34342	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41095	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34340	Windows Projected File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-40398	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21530	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32170	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-40410	Windows SMB Client Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35415	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34350	Windows Storport Miniport Driver Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-40405	Windows TCP/IP Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40414	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-40401	Windows TCP/IP Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-40413	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-35422	Windows TCP/IP Driver Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-34351	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40399	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34334	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40406	Windows TCP/IP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-33837	Windows TCP/IP Local Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40415	Windows TCP/IP Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-42825	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34338	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40382	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40380	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Important	6.2	No	No	RCE
CVE-2026-40408	Windows WAN ARP Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34333	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34347	Windows Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35417	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42891	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-35429	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-41107	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	7.4	No	No	Info
CVE-2026-40416	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira & Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.

Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.

As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.

This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption. Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook. On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.

Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.

The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI.

There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.

There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.

No new advisories are being released this month.

Looking Ahead

Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Pwn2Own Berlin 2026 - Day Two Results

Sat, 25 Jul 2026 19:02:55 +0200

Day Two of Pwn2Own Berlin 2026 and the stakes continue to rise! Security researchers are back on the Pwn2Own stage, pushing enterprise systems to their limits as the competition heats up. More exploits, more surprises, and more standout moments are unfolding, so follow along here for live updates as the race for Master of Pwn intensifies. There were plenty of big targets on the schedule today, including SharePoint, Exchange, and Safari.

Following an action-packed Day One where $523,000 was awarded for 24 unique 0-day vulnerabilities, Day Two added another $385,750 and 15 unique 0-days, bringing event totals to $908,750 with 39 unique vulnerabilities overall. DEVCORE holds a commanding lead for Master of Pwn with 40.5 points and $405,000, but with one day still to go, anything can happen. Here are the standings as of Day Two but we'll see what the final day of the contest brings. Stay tuned!

We’ll be posting real-time updates and results throughout the competition right here on our blog and across social media. Stay up to date by following us on Twitter, Mastodon, LinkedIn, and Bluesky, and join the conversation using #Pwn2Own Berlin and #P2OBerlin for continuous coverage.

FAILURE - Unfortunately, Tao Yan & Edouard Bochin of Palo Alto Networks could not get their exploit of Apple Safari – Renderer Only working within the time allotted.

FAILURE - Unfortunately, Stephen Fewer of Rapid7 could not get their exploit of Microsoft SharePoint working within the time allotted.

SUCCESS - Ben Koo (@kiddo_pwn) of Team DDOS used a use-after-free bug to escalate privileges on Red Hat Enterprise Linux for Workstations in the second round, earning $10,000 and 1 Master of Pwn point.

SUCCESS - Dialed in! Nikolaos Mourousias (@deltaclock), Caue Obici (@caueobici) & Bruno Halltari (@BrunoModificato) of OtterSec used a Code Injection bug to exploit LM Studio in the second round, earning $20,000 and 4 Master of Pwn points. Full win!

COLLISON - Although successful on stage, Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeting Claude Desktop in the Coding Agent category used a bug that was previously known. They still earn $10,000 and 2 Master of Pwn points.

SUCCESS - Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) exploited Cursor, earning $30,000 and 3 Master of Pwn points. Full win!

WITHDRAWAL - Kiyong Kwak of Kakaogames and Song Nuri of Samsung Electronics has withdrawn their entry for Apple Safari – Renderer Only in the Web Browser category.

FAILURE - Unfortunately, Ruitong of Abstract Team, University of Colorado Boulder could not get their exploit of Red Hat Enterprise Linux for Workstations working within the time allotted.

SUCCESS - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) exploited OpenAI Codex in the second round, earning $20,000 and 4 Master of Pwn points.

COLLISON - Although successful on stage, Billy (@st424204), Bruce Chen (@bruce30262), Pan Zhenpeng (@Peterpan980927) & Weiming Shi (@bestswngs) of STARLabs SG (@starlabs_sg) targeting NVIDIA Megatron Bridge used a bug that was previously known. They still earn $2,500 and 1 Master of Pwn point.

WITHDRAWAL - Alon Ben Tsur (@iamgweej), Yahav Azran (@_yahav) have withdrawn their entry for Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category.

SUCCESS - Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning $200,000 and 20 Master of Pwn points.

SUCCESS / COLLISON - David Tae & Louis Hur of Out Of Bounds targeted Ollama, hitting a one-vulnerability collision with a previous attempt and earning $28,000 and 3 Master of Pwn points.

FAILURE - Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) could not get their exploit of Mozilla Firefox – Renderer Only working within the time allotted.

SUCCESS - Cyrill Bannwart, Emanuele Barbeno, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security exploited Cursor in the second round, earning $15,000 and 3 Master of Pwn points.

SUCCESS - Siyeon Wi used an integer overflow bug to escalate privileges on Microsoft Windows 11 in the fourth round, earning $7,500 and 3 Master of Pwn points.

SUCCESS / COLLISON - Byung Young Yi (@yibarrack) of Out Of Bounds targeted LiteLLM, hitting a one-vulnerability collision with a previous attempt and earning $17,750 and 3.75 Master of Pwn points.

SUCCESS - Confirmed! 0xDACA (@0xDACA) & Noam Trobishi (@NTrobishi) used a use-after-free bug to exploit NV Container Toolkit in the second round, earning $25,000 and 5 Master of Pwn points.

Pwn2Own Berlin 2026 - Day One Results

Sat, 25 Jul 2026 19:02:55 +0200

Welcome to Day One of Pwn2Own Berlin 2026! Today, 22 entries took the Pwn2Own stage to target AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products, as the world’s top security researchers push technology to its limits. Exploits, surprises, and breakthrough discoveries are unfolding.

After Day One, we awarded $523,000 for 24 unique 0-days! DEVCORE is currently in the lead for Master of Pwn, but a pack of teams are right on their heels. Stay tuned tomorrow for more results and surprises.

FAILURE - Unfortunately, Le Duc Anh Vu (@vulda17) of Viettel Cyber Security (@vcslab) could not get their exploit of OpenAI Codex working within the time allotted.

SUCCESS - Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points.

SUCCESS - chompie of IBM X-Force Offensive Research (XOR) used a single bug to exploit NV Container Toolkit, earning $50,000 and 5 Master of Pwn points.

SUCCESS - k3vg3n chained 3 bugs including SSRF and Code Injection to take down LiteLLM. $40,000 and 4 Master of Pwn points. Full win.

SUCCESS - Satoki Tsuji (@satoki00) of Ikotas Labs, Inc. used an Overly Permissive Allowed List bug to exploit NVIDIA Megatron Bridge, earning $20,000 and 2 Master of Pwn points.

FAILURE - Unfortunately, Park Jae Min could not get their exploit of Oracle Autonomous AI Database working within the time allotted. #Pwn2Own #P2OBerlin

SUCCESS - Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller of Compass Security (@compasssecurity) used a single CWE-150 bug to exploit OpenAI Codex, earning $40,000 and 4 Master of Pwn points.

SUCCESS - Angelboy (@scwuaptx) & TwinkleStar03 (@_twinklestar03) of DEVCORE Research Team used an Improper Access Control bug to escalate privileges on Microsoft Windows 11, earning $30,000 and 3 Master of Pwn points.

WITHDRAWAL - Ben Koo (@kiddo_pwn) of Team DDOS has withdrawn their entry for Mozilla Firefox – Renderer Only in the Web Browser category

FAILURE - Unfortunately, Interrupt Labs could not get their exploit of NV Container Toolkit working within the time allotted

COLLISON - Although successful on stage, the Ikotas Labs, Inc. team targeting LiteLLM in the Local Inference category used bugs that were previously known. They still earn $8,000 and 1.75 Master of Pwn points.

SUCCESS - Yoseop Kim (@pwning_me) used a CWE-470 bug to exploit NVIDIA Megatron Bridge in the second round, earning $10,000 and 2 Master of Pwn points.

COLLISON - Although successful on stage, maitai (@MaitaiThe) of Doyensec (@Doyensec) targeting OpenAI Codex in the Coding Agent category used a bug that was previously known to the vendor. They still earn $10,000 and 2 Master of Pwn points.

WITHDRAWAL - Yoseop Kim(@pwning_me) has withdrawn their entry for Mozilla Firefox – Renderer Only in the Web Browser category

SUCCESS - haehae (@haehaeYang) of Out Of Bounds chained 2 bugs (CWE-190, CWE-362) to exploit Chroma, earning $20,000 and 2 Master of Pwn points.

SUCCESS - Billy (@st424204), Pan Zhenpeng (@Peterpan980927) & Weiming Shi (@bestswngs) of STARLabs SG (@starlabs_sg) chained 5 bugs (incl. SSRF and Code Injection) to exploit LM Studio, earning $40,000 and 4 Master of Pwn points. Full win!

SUCCESS - Marcin Wiązowski used a heap-based buffer overflow to escalate privileges on Microsoft Windows 11 in the second round, earning $15,000 and 3 Master of Pwn points.

WITHDRAWAL - Qrious Secure (@qriousec) has withdrawn their entry for LM Studio in the Local Inference category.

SUCCESS - Chompie of IBM X-Force Offensive Research (XOR) used a race condition to escalate privileges on Red Hat Enterprise Linux for Workstations, earning $20,000 and 2 Master of Pwn points.

COLLISON - Although successful on stage, Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) targeting Anthropic Claude Code in the Coding Agent category used a bug that was previously known to the vendor. They still earn $20,000 and 2 Master of Pwn points

SUCCESS - haehae (@haehaeYang) of Out Of Bounds used a Path Traversal bug to exploit NVIDIA Megatron Bridge in the second round, earning $10,000 and 2 Master of Pwn points. Full win!

SUCCESS - Kentaro Kawane of GMO Cybersecurity by Ierae chained 2 Use-After-Free bugs to escalate privileges on Microsoft Windows 11 in the third round, earning $15,000 and 3 Master of Pwn points.

Pwn2Own Berlin 2026: Day Three Results and Master of Pw

Sat, 25 Jul 2026 19:02:54 +0200

Following two days of intense competition, Day Three of Pwn2Own Berlin 2026 brought the curtain down on an incredible event. Security researchers delivered their final exploits, pushing enterprise systems to the limit one last time as the race for Master of Pwn came to a close.

Day Three added to an already historic event, bringing the final totals to $1,298,250 awarded for 47 unique 0-day vulnerabilities across three days of competition. DEVCORE claimed the title of Master of Pwn with a commanding 50.5 points and $505,000 — a dominant performance across all three days. STARLabs SG finished in second with 25 points and $242,500, followed by Out Of Bounds in third with 12.75 points and $95,750.

Congratulations to all the researchers who participated, and a special thank you to OffensiveCon for hosting. We'll see you at the next Pwn2Own.

Here are the results of Day Three:

SUCCESS/COLLISION - Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) used two bugs to exploit Red Hat Linux, but one of the bugs was previously known. He still earns $7,000 and 1.5 Master of Pwn points.

SUCCESS - Le Tran Hai Tung (@tacbliw), dungnm (@dungnm_) and hieuvd (@gr4ss341) of Viettel Cyber Security (@vcslab) used an integer overflow to escalate privileges on #Windows 11. Their 5th round win nets them $7,500 and 3 Master of Pwn points.

SUCCESS - Satoki Tsuji (@satoki00) of Ikotas Labs, Inc. abused an external control to exploit OpenAI Codex and pop a host of calcs. He earns $20,000 and 4 Master of Pwn points.

FAILURE - Unfortunately, Giuseppe Calì of Summoning Team (@SummoningTeam) could not get their exploit of VMware ESXi working within the time allotted.

COLLISON - Although successful on stage, Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller (@compasssecurity) of Compass Security targeted Anthropic Claude Code, hitting a one-vulnerability collision with a previous attempt and earning $20,000 and 2 Master of Pwn points.

SUCCESS - Hyunwoo Kim (@v4bel) chained a use-after-free and uninitialized memory bug to escalate privileges on Red Hat Enterprise Linux for Workstations in the fourth round, earning $5,000 and 2 Master of Pwn points.

SUCCESS - splitline (@splitline) of DEVCORE Research Team chained 2 bugs to exploit Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points.

SUCCESS - Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG (@starlabs_sg) used a Memory Corruption bug to exploit VMware ESXi with the Cross-tenant Code Execution add-on, earning $200,000 and 20 Master of Pwn points.

COLLISON - While Byung Young Yi (@yibarrack) of Out Of Bounds successfully demonstrated their exploit of Anthropic Claude Code, the bug used had been previously disclosed. They still earn $20,000 and 2 Master of Pwn points.

The June 2026 Security Update Review

Sat, 25 Jul 2026 19:02:53 +0200

I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for June 2026

For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-66	Adobe Campaign Classic	2	Critical	10.0	No	1
APSB26-64	Adobe ColdFusion	7	Critical	9.6	No	1
APSB26-63	Adobe Acrobat Reader	20	Critical	7.8	No	2
APSB26-57	Adobe Experience Manager Forms	3	Critical	9.3	No	2
APSB26-62	Adobe Dreamweaver	5	Critical	8.6	No	3
APSB26-65	Adobe Format Plugins	2	Critical	7.8	No	3
APSB26-59	Adobe InCopy	3	Critical	7.8	No	3
APSB26-58	Adobe InDesign	12	Critical	7.8	No	3
APSB26-60	Adobe Substance 3D Sampler	4	Critical	7.8	No	3
APSB26-61	Content Credentials SDK	8	Critical	7.5	No	3
APSB26-56	Adobe Experience Manager	57	Important	5.4	No	3
TOTAL	11 bulletins	123

Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.

Microsoft Patches for June 2026

This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.

One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.

I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.

One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.

- CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.

- CVE-2026-45657 - Windows Kernel Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.

- CVE-2026-47291 - HTTP.sys Remote Code Execution Vulnerability
Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.

- CVE-2026-44815 - DHCP Client Service Remote Code Execution Vulnerability
Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.

- CVE-2026-45585/CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability
If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “bone shattering” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.

Here’s the full list of CVEs released by Microsoft for June 2026:

CVE	Title	Severity	CVSS	Public	Exploited	XI	Type
CVE-2026-41091	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	Yes	0	EoP
CVE-2026-49160	HTTP.sys Denial of Service Vulnerability	Important	7.5	Yes	No	1	DoS
CVE-2026-50507	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.8	Yes	No	1	SFB
CVE-2026-45586	Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability	Important	7.8	Yes	No	1	EoP
CVE-2025-10263 *	ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]	Critical	9.3	No	No	2	EoP
CVE-2026-48567	Azure HorizonDB Elevation of Privilege Vulnerability	Critical	10	No	No	N/A	EoP
CVE-2026-32193	Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-47644	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	6.5	No	No	2	Info
CVE-2026-44815	DHCP Client Service Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47291	HTTP.sys Remote Code Execution Vulnerability	Critical	9.8	No	No	1	RCE
CVE-2026-42824	M365 Copilot Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45476	Microsoft Azure Network Adapter Elevation of Privilege Vulnerability	Critical	8.2	No	No	2	EoP
CVE-2026-44810	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Critical	8.4	No	No	2	EoP
CVE-2026-48579	Microsoft Exchange Online Information Disclosure Vulnerability	Critical	9.1	No	No	N/A	Info
CVE-2026-47655	Microsoft Graph Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45497	Microsoft M365 Copilot Remote Code Execution Vulnerability	Critical	7.7	No	No	N/A	RCE
CVE-2026-45460	Microsoft Office Information Disclosure Vulnerability	Critical	4.7	No	No	3	Info
CVE-2026-45472	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45474	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45461	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45463	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45456	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45458	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47635	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-26142	Nuance PowerScribe Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47289	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	2	RCE
CVE-2026-47654	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	3	RCE
CVE-2026-48563	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42992	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44799	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44801	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42985	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	1	RCE
CVE-2026-45648	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-42987	Windows Deployment Services (WDS) Remote Code Execution	Critical	8.1	No	No	2	RCE
CVE-2026-33828	Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability	Critical	7.8	No	No	3	EoP
CVE-2026-44803	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-44812	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-45607	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45641	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47652	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.2	No	No	2	RCE
CVE-2026-47288	Windows Kerberos Key Distribution Center (KDC) Remote Code Execution	Critical	7.1	No	No	3	RCE
CVE-2026-45657	Windows Kernel Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-48574	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	2	RCE
CVE-2026-45490	.NET SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45491	.NET Tampering Vulnerability	Important	6.2	No	No	3	Tampering
CVE-2026-45591	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	2	DoS
CVE-2026-47643	Azure Stack Edge Remote Code Execution Vulnerability	Important	9.8	No	No	3	RCE
CVE-2026-41098	Azure Stack Edge Spoofing Vulnerability	Important	8.4	No	No	2	Spoofing
CVE-2026-45642	Microsoft Azure Attestation service and Device Health Attestation Service Spoofing Vulnerability	Important	3.9	No	No	2	Spoofing
CVE-2026-45650	Microsoft Bing Search Spoofing Vulnerability	Important	4.3	No	No	2	Spoofing
CVE-2026-45637	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45647	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	2	EoP
CVE-2026-40371	Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-44822	Microsoft Excel Information Disclosure Vulnerability	Important	8.2	No	No	3	Info
CVE-2026-45455	Microsoft Excel Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-45469	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44817	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	3	RCE
CVE-2026-44818	Microsoft Excel Remote Code Execution Vulnerability	Important	7	No	No	2	RCE
CVE-2026-44820	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44823	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45459	Microsoft Excel Security Feature Bypass Vulnerability	Important	3.3	No	No	2	SFB
CVE-2026-45504	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	8.8	No	No	3	EoP
CVE-2026-45502	Microsoft Exchange Server Information Disclosure Vulnerability	Important	5	No	No	3	Info
CVE-2026-45503	Microsoft Exchange Server Information Disclosure Vulnerability	Important	8.1	No	No	3	Info
CVE-2026-45583	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45500	Microsoft Exchange Server Spoofing Vulnerability	Important	6.1	No	No	2	Spoofing
CVE-2026-45501	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	2	Spoofing
CVE-2026-47631	Microsoft Exchange Server Spoofing Vulnerability	Important	8.1	No	No	2	Spoofing
CVE-2026-42986	Microsoft Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-41092	Microsoft Kinect Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45644	Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability	Important	8	No	No	2	EoP
CVE-2026-47293	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45485	Microsoft Office Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-44821	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45483	Microsoft Office Project Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45475	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44819	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44824	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45645	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-49161	Microsoft PC Manager Security Feature Bypass Vulnerability	Important	7.8	No	No	3	SFB
CVE-2026-42902	Microsoft PowerToys Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45484	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-45454	Microsoft SharePoint Remote Code Execution Vulnerability	Important	6.5	No	No	2	RCE
CVE-2026-47298	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	2	RCE
CVE-2026-45467	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45468	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45479	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45453	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47636	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47637	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47638	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47639	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	3	Spoofing
CVE-2026-47641	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-33113	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45462	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45464	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45465	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47634	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-47640	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	3	Spoofing
CVE-2026-45481	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-48560	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-48562	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-42835	Microsoft Teams for Android Information Disclosure Vulnerability	Important	8.1	No	No	2	Info
CVE-2026-45606	Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability	Important	5.5	No	No	2	DoS
CVE-2026-45482	Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability	Important	8.4	No	No	2	SFB
CVE-2026-45466	Microsoft Word Information Disclosure Vulnerability	Important	3.3	No	No	3	Info
CVE-2026-45471	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45486	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45643	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45457	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-42980	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-42916	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45649	Office for Android Spoofing Vulnerability	Important	7.1	No	No	3	Spoofing
CVE-2026-47653	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	3	RCE
CVE-2026-42909	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42913	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42993	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45588	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48568	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48570	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48573	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48575	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48576	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48578	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45654	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45656	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-8863	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-40376	Visual Studio Code Elevation of Privilege Vulnerability	Important	7.5	No	No	2	EoP
CVE-2026-47281	Visual Studio Code Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-47284	Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47292	Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-48569	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	2	SFB
CVE-2026-47287	Visual Studio Code Tampering Vulnerability	Important	6.5	No	No	2	Tampering
CVE-2026-42829	Windows Administrator Protection Secure Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-34335	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45601	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45598	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45596	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45638	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45603	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42911	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45594	Windows Application Identity (AppID) Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45655	Windows BitLocker Security Feature Bypass Vulnerability	Important	5.3	No	No	2	SFB
CVE-2026-45658	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.8	No	No	1	SFB
CVE-2026-45640	Windows Bluetooth Port Driver Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45605	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-47656	Windows Boot Manager Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-44809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45634	Windows DHCP Client Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-45608	Windows DHCP Client Information Disclosure Vulnerability	Important	6.8	No	No	3	Info
CVE-2026-41108	Windows DNS Client Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42905	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-44811	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44808	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44807	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42983	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44802	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44813	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44804	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-48566	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-44814	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45602	Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability	Important	9.1	No	No	2	Tampering
CVE-2026-42836	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42910	Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42972	Windows Hyper-V Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45592	Windows Internet (wininet.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42903	Windows Kerberos Denial of Service Vulnerability	Important	6.5	No	No	3	DoS
CVE-2026-42914	Windows Kerberos Denial of Service Vulnerability	Important	5.3	No	No	2	DoS
CVE-2026-48583	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45653	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42984	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45600	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45604	Windows Managed Installer Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45595	Windows Mark of the Web Security Feature Bypass Vulnerability	Important	5.4	No	No	2	SFB
CVE-2026-45636	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-50508	Windows NTLM Spoofing Vulnerability	Important	6.5	No	No	1	Spoofing
CVE-2026-48565	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44805	Windows Network Controller (NC) Host Agent Denial of Service Vulnerability	Important	5.5	No	No	3	DoS
CVE-2026-42981	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-42974	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45487	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42828	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42837	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42969	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-42971	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42970	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42973	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42978	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42977	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42979	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42991	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45639	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-42908	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-45593	Windows SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42906	Windows Shell Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42907	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47648	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42915	Windows TCP/IP Denial of Service Vulnerability	Important	5.7	No	No	2	DoS
CVE-2026-42904	Windows TCP/IP Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-42968	Windows Telephony Server Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42912	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45597	Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45599	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45635	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-40409	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-40404	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42989	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.

Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.

There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be.

Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls.

Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.

There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.

I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.

There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Pwn2Own Ireland 2026 – New Targets and Categories

Sat, 25 Jul 2026 19:02:51 +0200

If you just want to read the rules, you can find them here.

Pwn2Own Ireland returns for 2026, and it’s the third year for this event in the Emerald Isle. Despite the dreary Irish skies (and the threat of a random banshee), we had an amazing event, even if we did end up in a jail at the end. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event up at a special location (stay tuned for that announcement).

As for the contest itself, it will run from October 6-9, 2026. As always, we’ll have a random drawing to determine the schedule of attempts on the first day of the contest, and we will proceed from there. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2026. There are no exceptions for late entries, so if you have questions, please contact us at pwn2own@trendmicro.com (note the address). We will be happy to address your issues or concerns directly.

Due to the overwhelming amount of registrations and last-minute entries for our Pwn2Own Berlin event, we’re changing who can enter the contest a bit to ensure it’s fair for all researchers. To enter, you must have received an aggregate bounty payment totaling at least $15,000 during their life-time participation in ZDI. This includes past Pwn2Own events and our regular bug bounty program. We recognize there may be some who haven’t participated in the past with great exploits to demonstrate, so we will also accept up to 10 new contestants at our discretion. We’re capping the number of entries to 80 this year. Once we have 80 qualifying entries, we will close registration. That means if you want to enter, it is in your best interest to contact us sooner rather than later. Please read the rules thoroughly to ensure you meet all the requirements.

Now on to this year’s target categories. We’ll have seven different categories for this year’s event:

-- Mobile Phones
-- Smart Home Devices
-- Wellness
-- Printers
-- Messaging
-- AI Infrastructure
-- AI Coding Agents

Let’s take a look at each category in more detail, starting with mobile phones.

The Target Phones

Back in Amsterdam where this contest originated, it was originally dubbed “Mobile Pwn2Own” and our focus was strictly on phones. Mobile handsets remain at the heart of this event, and some of the Samsung entries from last year were absolutely smashing. As always, these phones will be running the latest version of their respective operating systems with all available updates installed. Last year we also introduced the USB attack vector, but no one submitted an entry for it. We’ll see if that changes this year.

Otherwise, contestants must compromise the device by browsing to content in the default browser for the target under test or by communicating with the following short-distance protocols: near field communication (NFC), Wi-Fi, or Bluetooth. The awards for this category are:

Back to top

Smart Home Devices

As you might have noticed, we have eliminated most of the consumer-related devices from this year’s event. However, there are still a few “pro-sumer” devices that still could have an impact on enterprises, and the first of these categories are the devices that control other devices and services. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Wellness Category

This is one of the new categories this year and our first foray into the world of healthcare devices. However, we don’t intend to make this too easy. Entries that require physically pressing any button on the target, or the use of any information, code or PIN printed on the device, are out of scope. Entries that require the contestant to be paired to the target prior to the start of the attempt are not in scope. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Rage Against the Printers

Printers have long been the source of jokes and memes, but they are also an often overlooked attack surface in your office. The printer category always produces some interesting results, often by playing music it shouldn’t or the occasional Rick Roll. We’ve reduced the number of targets in this category this year, but we still expect to see some interesting exploits in these oft unheralded targets.

Back to top

The Messaging Category

We introduced WhatsApp as a target last year and came close to seeing a functioning exploit. Sadly, that didn’t happen. However, WhatsApp is used by more than three billion people globally, and some of the messages transmitted can be quite sensitive. That’s why we are bringing it back and hoping for some better results. We know the bugs are out there. We’re just hoping the right researcher decides to show us an exploit that leads to code execution. All of the target handset will be available as clients. Here’s the full prize list for Messaging category:

Back to top

AI Infrastructure Category

We introduced these targets at Pwn2Own Berlin, and we saw such…uh…enthusiasm from the community that we decided to immediately bring them back for our Ireland event. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Infrastructure category:

Back to top

AI Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a recently updated category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

Master of Pwn

No Pwn2Own contest would be complete without crowning a Master of Pwn, which signifies the overall winner of the competition. Earning the title results in a slick trophy, a different sort of wearable, and brings with it an additional 65,000 ZDI reward points (instant Platinum status in 2027).

For those not familiar with how it works, points are accumulated for each successful attempt. While only the first demonstration in a category wins the full cash award, each successful entry claims the full number of Master of Pwn points. Since the order of attempts is determined by a random draw, those who receive later slots can still claim the Master of Pwn title – even if they earn a lower cash payout. As with previous contests, there are penalties for withdrawing from an attempt once you register for it. If the contestant decides to remove an Add-on Bonus during their attempt, the Master of Pwn points for that Add-on Bonus will be deducted from the final point total for that attempt. For example, someone registers for the Apple iPhone 15 with the Kernel Bonus Add-on. During the attempt, the contestant drops the Kernel Bonus Add-on but completes the attempt. The final point total will be 20 Master of Pwn points.

The Complete Details

The full set of rules for Pwn2Own Ireland 2026 can be found here. They may be changed at any time without notice. We highly encourage potential entrants to read the rules thoroughly and completely should they choose to participate. We also encourage contestants to read this blog covering what to expect when participating in Pwn2Own.

Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. (Email only, please; queries via social media, blog post, or other means will not be acknowledged or answered.) If we receive more than one registration for any category, we’ll hold a random drawing to determine the contest order. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2025.

The Results

We’ll be blogging and tweeting results in real-time throughout the competition. Be sure to keep an eye on the blog for the latest information. Follow us on Twitter at @thezdi and @trendaisecurity, and keep an eye on the #P2OIreland hashtag for continuing coverage.

We look forward to seeing everyone in Cork, and we look forward to seeing what new exploits and attack techniques they bring with them.

©2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

The July 2026 Security Update Review

Sat, 25 Jul 2026 19:02:51 +0200

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2026

Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.

For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here.

Microsoft Patches for July 2026

Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.

So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.

- CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability
This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability
The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

- CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

- CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability
This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly.

- CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability
This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

- CVE-2026-55008 - Microsoft Exchange Server Spoofing Vulnerability
Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.

- CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability
There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

- CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability
Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

- CVE-2026-55010 - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.

There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.

The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.

Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.

Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.

Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network. The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”. HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Facebook Offers a Verification System Certifying to Other Users That You're a Real Human

Sat, 25 Jul 2026 19:01:11 +0200

Facebook announced Friday they're launching a badge "that verifies there's a real person behind a profile". "You record a short video selfie, which we check against your existing profile photos to confirm a match. The process is free and typically takes just a few minutes. Accounts must meet our trust and safety standards to qualify for verification...." Once verified, your badge will appear across the places on Facebook where it matters most: Marketplace, Dating, Groups, and Profile to start. Over time, we'll add badges in Feed posts as well. There's no subscription fee — you verify once, and the badge travels with you across Facebook... [Y]ou'll see the Verified badge on accounts that have completed the verification process... It's a quick, visible signal, before you respond to a listing, accept a date, or join a conversation, that there's a real person on the other end. "We're rolling out Facebook Verified in phases, starting in select markets with plans to expand globally..." their announcement adds. "As AI makes it easier to do more on Facebook, a clear signal that distinguishes real people becomes essential. That's what Facebook Verified is for: keeping the moments that matter on Facebook grounded in real people." Lifehacker shares their reaction: Facebook says it will store your selfie video for "up to 30 days" after verification, which is a one-time process. It's not entirely clear what happens with that video in the meantime, and it's worth noting that Meta has relied on user data to train its AI. Meta AI (and Meta more broadly) is a terrible offender when it comes to privacy and security, so you should consider whether the tradeoff of a verification mark is worth handing over more of your data and read the privacy policy before you agree. Google also launched a video selfie verification feature this week, though its purpose is to prove your identity should you get locked out of your account. Unlike Facebook Verified, which is meant to be a trust signal to other users, Google's selfie verification allows access to your entire Google account, bringing with it some additional security considerations.

Read more of this story at Slashdot.

Pwn2Own Automotive 2026 - Day Three Results and the Master of Pwn

Sat, 25 Jul 2026 19:00:45 +0200

The last day of Pwn2Own Automotive 2026 saw the world’s top security researchers take their final shots at the latest automotive systems. Over three days of intense competition, $1,047,000 USD was awarded for 76 unique 0-day vulnerabilities, with bold exploits, clever techniques, and collisions keeping the action thrilling throughout.

By the end, Tobias Scharnowski (@ScepticCtf), Felix Buchmann (@diff_fusion), and Kristian Covic (@SeTcbPrivilege) of Fuzzware.io claimed the title of Master of Pwn, earning 28 points and $215,500 USD.

Follow the final updates on Twitter, Mastodon, LinkedIn, and Bluesky, and join the conversation using #Pwn2OwnAutomotive and #P2OAuto.

SUCCESS / COLLISON - Tobias Scharnowski (@ScepticCtf), Felix Buchmann (@diff_fusion), and Kristian Covic (@SeTcbPrivilege) of Fuzzware.io targeted the Alpine iLX-F511, demonstrating one vulnerability previously used by another contestant, earning $2,500 USD and 1 Master of Pwn point. #Pwn2Own #P2OAuto

SUCCESS / COLLISON - Slow Horses of Qrious Secure (@qriousec) targeted the Grizzl-E Smart 40A but encountered two bug collisions, still earning $5,000 USD and 2 Master of Pwn points.

SUCCESS / COLLISON - Team MST targeted the Kenwood DNR1007XR, demonstrating one bug but running into a collision, earning $2,500 USD and 1 Master of Pwn point.

SUCCESS - PetoWorks (@petoworks) targeted the Grizzl-E Smart 40A, exploiting one buffer overflow bug, and earned $10,000 USD and 4 Master of Pwn points.

SUCCESS - Bongeun Koo (@kiddo_pwn) and Evangelos Daravigkas (@freddo_1337) of Team DDOS targeted the Alpine iLX‑F511, exploiting a stack‑based buffer overflow to earn $5,000 USD and 2 Master of Pwn points.

SUCCESS - Viettel Cyber Security (@vcslab) targeted the Sony XAV‑9500ES, exploiting a heap‑based buffer overflow to achieve arbitrary code execution, earning $10,000 USD and 2 Master of Pwn points. #Pwn2Own #P2OAuto

SUCCESS / COLLISON - Qrious Secure (@qriousec) targeted the Kenwood system, demonstrating three bugs - one n-day and two unique vulnerabilities (incorrect permission assignment and a race condition), earning $4,000 USD and 1.75 Master of Pwn points.

SUCCESS - Boom! or shall we say Doom? Game On! Aapo Oksman, Elias Ikkelä-Koski and Mikael Kantola of Juurin Oy exploit the Alpitronic HYC50 with a TOCTOU bug - and installed a playable version of Doom to boot. They earn $20,000 and 4 Master of Pwn points. #Pwn2Own #P2OAuto

SUCCESS / COLLISON - Nguyen Thanh Dat (@rewhiles) of Viettel Cyber Security (@vcslab) targeted the Kenwood DNR1007XR, demonstrating one bug but encountering a collision, earning $2,500 USD and 1 Master of Pwn point.

SUCCESS / COLLISON - Autocrypt (Hoyong Jin, Jaewoo Jeong, Chanhyeok Jung, Minsoo Son, and Kisang Choi) targeted the Alpine iLX-F511, demonstrating two vulnerabilities to gain root access. One collided with a previously known issue, earning $3,000 USD and 1.25 Master of Pwn points.

SUCCESS - Elias Ikkelä-Koski and Aapo Oksman of Juurin Oy targeted the Kenwood DNR1007XR, demonstrating a link-following vulnerability to earn $5,000 USD and 2 Master of Pwn points.

SUCCESS - Nam Ha Bach and Vu Tien Hoa of the FPT NightWolf Team targeted the Alpine iLX-F511, exploiting one unique vulnerability to gain root access and earning $5,000 USD and 2 Master of Pwn points.

SUCCESS / COLLISON - Ryo Kato (@Pwn4S0n1c) targeted the Autel MaxiCharger AC Elite Home 40A, demonstrating a three-bug chain but encountering one collision, still earning $16,750 USD and 3.5 Master of Pwn points.

The February 2026 Security Update Review

Sat, 25 Jul 2026 19:00:44 +0200

I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for February 2026

For February, Adobe released nine bulletins addressing 44 unique CVEs in Adobe Audition, After Effects, InDesign, Substance 3D Designer, Substance 3D Stager, Adobe Bridge, Substance 3D Modeler, Lightroom Classic, and the Adobe DNG Software Development Kit (SDK). The largest update here is for After Effects, which fixes 13 Critical and two Important rated bugs. The patch for Substance 3D Designer is on the larger side with seven fixes, but only two of those are Critical. On the other hand, the fix for Substance 3D Stager corrects five Critical-rated bugs that could lead to code execution. The Audition patch fixes six bugs, but only one is Critical.

The other patches are smaller in size. The fix for the Adobe DNG Software Development Kit (SDK) corrects two Critical and two Important-rated bugs. The InDesign patch fixes three bugs, but only one is Critical. The update for Adobe Bridge fixes two Critical bug that could lead to code execution. The patch for Lightroom Classic addresses a single Critical bug, and the release is wrapped up with a patch for Substance 3D Modeler that fixes a single, Important-rated memory link.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and all of the updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for February 2026

This month, Microsoft drops 58 new CVEs in Windows and Windows components, Office and Office Components, Azure, Microsoft Edge (Chromium-based), .NET and Visual Studio, GitHub Copilot, Mailslot FS, Exchange Server, Internet Explorer (!), Power BI, Hyper-V Server, and the Windows Subsystem for Linux. Counting the third-party and Chromium updates listed in the release, it brings the total number of CVEs to 62. One of the bugs in the Windows Graphics component was submitted through the ZDI program. Five of these bugs are rated Critical, two are rated Moderate, and the rest are rated Important in severity.

It’s typical to see this number of CVEs released in February, but the number of bugs under active attack is extraordinarily high. Microsoft lists six bugs being exploited at the time of release, with three of these listed as publicly known. Last month only had a single bug being exploited, although there were twice as many CVEs patched. We’ll see if we’re on our way to another “hot exploit summer” as we saw a few years ago or if this is just an aberration.

Let’s take a closer look at some of the more interesting updates for this month, starting with the bugs under active attack:

- CVE-2026-21510 - Windows Shell Security Feature Bypass Vulnerability
This bug is listed as a security feature bypass, but it could also be classified as code execution. An attacker can bypass Windows SmartScreen and Windows Shell security prompts to execute code on a target system. This bug is also listed as publicly known, but Microsoft doesn’t say where. There is user interaction here, as the client needs to click a link or a shortcut file. Still, a one-click bug to gain code execution is a rarity. Definitely test and deploy this fix quickly.

- CVE-2026-21514 - Microsoft Word Security Feature Bypass Vulnerability
This bug also requires user interaction in the form of opening a Word document, but that’s all that’s required to bypass protections to dangerous COM/OLE controls. Thankfully, the Preview Pane is not an attack vector here. However, users are well known to open lots of documents they receive in e-mail. This bypass could also result in code execution if the right COM/OLE control is hit. This is also listed as publicly known, so add this to the list to test and deploy quickly.

- CVE-2026-21519 - Desktop Window Manager Elevation of Privilege Vulnerability
This is the second month in a row that a DWM was listed as being exploited in the wild. That leads me to believe the first patch didn’t completely resolve the vulnerability. Same as last month, this bug allows attackers to run code with SYSTEM privileges. Bugs of this type are typically paired with a code execution bug to take over a system. As always, Microsoft offers no indication of how widespread these exploits may be.

- CVE-2026-21533 - Windows Remote Desktop Services Elevation of Privilege Vulnerability
Don’t let the word “Remote” in the title fool you – this is a local bug that allows attackers to run code with SYSTEM privileges. It’s interesting that Microsoft lists “Improper privilege management” as the root cause for this issue. If the system is running Remote Desktop Services, it’s probably a juicy target for attackers to move laterally after an initial breach. Add this one to the list of patches to test and deploy immediately.

- CVE-2026-21513 - Internet Explorer Security Feature Bypass Vulnerability
Although long gone by many measurements, IE does still exist on Windows systems, and calling it always results in a vulnerability somehow. This bug manifests similarly to the Shell bug above, as it requires user interaction but could result in code execution. The bypass here is simply the ability to reach IE, which shouldn’t be possible. Again, test and deploy this fix quickly.

- CVE-2026-21525 - Windows Remote Access Connection Manager Denial of Service Vulnerability
It’s unusual to see DoS bugs being used in active attacks, but that’s what we have here. A null pointer deref in the Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Most null pointer derefs cause the application or service to crash, but it’s not clear if it will automatically restart. I would exercise caution and patch quickly either way.

Here’s the full list of CVEs released by Microsoft for February 2026:

CVE	Title	Severity	CVSS	Public	Exploited	TYPE
CVE-2026-21514	Microsoft Word Security Feature Bypass Vulnerability	Important	7.8	Yes	Yes	SFB
CVE-2026-21510	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	Yes	Yes	SFB
CVE-2026-21513	Internet Explorer Security Feature Bypass Vulnerability	Important	8.8	Yes	Yes	SFB
CVE-2026-21519	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-21533	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-21525	Windows Remote Access Connection Manager Denial of Service Vulnerability	Moderate	6.2	No	Yes	DoS
CVE-2026-21511	Microsoft Outlook Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2023-2804 *	Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo	Important	6.5	Yes	No	RCE
CVE-2026-24302	Azure Arc Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-24300	Azure Front Door Elevation of Privilege Vulnerability	Critical	9.8	No	No	EoP
CVE-2026-21532	Azure Function Information Disclosure Vulnerability	Critical	8.2	No	No	Info
CVE-2026-21522	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-23655	Microsoft ACI Confidential Containers Information Disclosure Vulnerability	Critical	6.5	No	No	Info
CVE-2026-21218	.NET and Visual Studio Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-21512	Azure DevOps Server Cross-Site Scripting Vulnerability	Important	6.5	No	No	XSS
CVE-2026-21529 †	Azure HDInsight Spoofing Vulnerability	Important	5.7	No	No	Spoofing
CVE-2026-21528	Azure IoT Explorer Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-21228	Azure Local Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-21531	Azure SDK for Python Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-21251	Cluster Client Failover (CCF) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20846	GDI+ Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-21523	GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-21518	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-21257	GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-21256	GitHub Copilot and Visual Studio Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21516	GitHub Copilot for Jetbrains Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21253	Mailslot File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21537 †	Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21259	Microsoft Excel Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-21258	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21261	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21527	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-21260	Microsoft Outlook Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-21229	Power BI Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-21236	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21238	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21241	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21517	Windows App for Mac Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21234	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21235	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-21246	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21232	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21240	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21250	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21244	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21247	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21248	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21255	Windows Hyper-V Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-21231	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21239	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21245	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21222	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21243	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20841	Windows Notepad App Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21249	Windows NTLM Spoofing Vulnerability	Important	3.3	No	No	Spoofing
CVE-2026-21508	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21237	Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21242	Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-1861 *	Chromium: CVE-2026-1861 Heap buffer overflow in libvpx	High	N/A	No	No	RCE
CVE-2026-1862 *	Chromium: CVE-2026-1862 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-0391	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Moving on to the Critical-rated bugs, the patch for Azure Front Door sounds frightening, but Microsoft has already fixed the bug and is just now documenting it. That’s also true for the bugs in Azure Arc and Azure Function. There are two Critical-rated bugs in the ACI Confidential Containers. The first allows a container escape while the second discloses secret tokens and keys. Either way, you’ll want to handle those quickly.

Taking a look at the other code execution vulnerabilities in this month’s release, we start with a frightening looking bug in Azure SDK for Python that has the highest CVSS this month of 9.8. A remote, unauthenticated attacker code gain code execution on an affected system via a maliciously crafted continuation token. It’s not clear why this isn’t rated Critical, but I would treat it as such. The three bugs in Hyper-V are actually local open-and-own bugs that require a user to open a malicious file on an affected system. That’s also true for the bug in Notepad. The bug in Power BI is confusing, because Microsoft says it requires authentication and could lead to an attacker running code as an authenticated user. There’s the poorly named “Azure Local Remote Code Execution Vulnerability”, but it requires a machine-in-the-middle (MitM) to exploit. The bug in Defender for Endpoint Linux is restricted to local subnets, but you’ll need to enable auto provisioning to get the patch. The final code execution bugs addressed this month are in GitHub Copilot. Two are command injections and the other is a Time-of-check time-of-use (toctou) race condition, but both could end up in code execution on affected systems.

Patches for Elevation of Privilege (EoP) bugs make up nearly 50% of this release, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. There are only two of note. The first is a command injection bug in GitHub Copilot that leads to executing code at the level of the targeted application. The second is a bug in a kernel that leads to SYSTEM but could also be used for a sandbox escape.

There’s a unusually high number of spoofing bugs in this month’s release, and the ones for Outlook are the most troubling. First, the Preview Pane is an attack vector. Secondly, the bugs could be used to relay NTLM credentials via just an email, which could result in credential disclosure. And you’ll need multiple patches to fully address these bugs. At least they can be applied in any order. There’s a UI misrepresentation bug in Exchange Server that could allow an attacker to either view some sensitive information or “make changes to disclosed information”. At what point does data become disclosed? That odd phrasing makes me think they are using AI to right some of their descriptions. The phrasing also appears in the patch for NTLM. That bug is triggered by opening a specially crafted Office doc, and while they explicitly say it could be used to relay NTLM creds, it sure seems that way. The patch for .NET and Visual Studio fixes a bug that allows attackers to bypass header validation, resulting in the service accepting a message it should reject. Finally, the bug in Azure HDInsight is really just a cross-site scripting (XSS) bug. The caveat here is that you need to restart Ambari server in both of the head nodes to have this fix updated. There is also an XSS in Azure Devops Server, but at least it is labelled as such.

There are a couple of additional security feature bypass bugs to discuss. The first is in Hyper-V and bypasses the Virtualization-based Security feature. The other is in GitHub Copilot and Visual Studio Code. It’s another command injection, but this one can be used to bypass authentication. Neat.

Looking at the remaining info disclosure bugs getting patched this month, most simply result in info leaks consisting of unspecified memory contents or memory addresses. The exception is the bug in Azure IoT Explorer. This bug could be used to view the contents of the target user’s local file system.

We end this month’s release with two DoS bugs: one in LDAP and one in GDI+. Neither descriptions from Microsoft provide any usable information.

No new advisories are being released this month.

Looking Ahead

I plan on being back home for the March release but wherever I’m at, you can rest assured that March 10, I’ll be here to provide my assessment of the release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The March 2026 Security Update Review

Sat, 25 Jul 2026 19:00:43 +0200

I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for March 2026

For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program. If you need to prioritize, the update for Acrobat likely has the most impact, with the patch fixing two Critical-rated and one Important bugs. The fix for Experience Manager is the largest this month with 33 CVEs addressed. However, these are simple cross-site scripting (XSS) bugs, so it’s not too exciting. The fix for Commerce is also quite large with 19 CVEs. Most of these are also XSS bugs, but there’s a few security feature bypass bugs in there, too. Adobe actually gives this patch a deployment priority of 2, but it’s not under active attack at the time of release.

The fix for Illustrator corrects seven bugs, including a few Critical-rated ones. The patch for Substance 3D Painter fixes nine different CVEs, all rated Important. That’s not the case for Substance 3D Stager, which fixes six different Critical bugs that could lead to arbitrary code execution. The patch for the Adobe DNG Software Development Kit (SDK) addresses one Critical and one Important bug. Finally, the update for Premiere Pro correct a single, Critical-rated bug that could lead to arbitrary code execution.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and beyond the update for Commerce, all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for March 2026

This month, Microsoft released 84 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, SQL Server, Hyper-V Server, and the Windows Resilient File System (ReFS). Counting the third-party and Chromium updates listed in the release, it brings to total number of CVEs to 94. Five of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, and the rest are rated Important in severity.

This volume is relatively typical for a March release, and the lack of bugs under active attack is a nice change from last month. There are two vulnerabilities listed as publicly known at the time of release, but none listed as actively exploited.

Let’s take a closer look at some of the more interesting updates for this month, starting with a bug with an AI slant:

- CVE-2026-26144 - Microsoft Excel Information Disclosure Vulnerability
This is a fascinating bug and an attack scenario we’re likely to see more often. The vulnerability is a simple cross-site scripting (XSS) bug in Excel, but an attacker could use it to cause the Copilot Agent to exfiltrate data off the target. This essentially makes it a zero-click information disclosure. Although not stated, the disclosure is likely at the level of the logged-on user, so there isn’t a privilege escalation component. Info disclosures rarely get rated Critical, but it makes sense here.

- CVE-2026-26110/CVE-2026-26113 - Microsoft Office Remote Code Execution Vulnerability
Another month and another pair of Office bugs where the Preview Pane is an exploit vector. I’ve lost count of how many of these bugs have been patched over the last year, but it’s just a matter of time until they start appearing in active exploits. The latest versions of Outlook allow you to hide the Preview Pane, but it isn’t clear if this would mitigate these attacks. The best option is still to test and deploy the update, but considering how many of these patches exist, it’s likely further updates will be needed to fully address these issues.

- CVE-2026-23669 - Windows Print Spooler Remote Code Execution Vulnerability
Just reading the title makes me twitch with remembrances of Print Nightmare from a few years ago. This bug works in the same manner as those exploits. An authenticated attacker sends specially crafted messages to an affected system to gain arbitrary code execution. No user interaction is required. Let’s hope we don’t end up in a new nightmare of spooler exploits. Test and deploy this one quickly.

- CVE-2026-23668 - Windows Graphics Component Elevation of Privilege Vulnerability
This vulnerability was submitted to the ZDI program by Marcin Wiązowski as two separate bugs, and it demonstrates the need for variant investigations when creating security patches. Both cases are caused by the lack of proper locking when performing operations on an object. However, in one case, it’s in the cdd.dll driver while the other is in the win32kfull driver. Either way, an attacker could use these to elevate privileges to SYSTEM and execute arbitrary code. Since the fix for both is to add object locking to the GDI object, the cases are combined into a single CVE. That’s not a problem, but it does show how variants can occur, and fixes should be as broad as possible.

Here’s the full list of CVEs released by Microsoft for March 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-26127	.NET Denial of Service Vulnerability	Important	7.5	Yes	No	DoS
CVE-2026-21262	SQL Server Elevation of Privilege Vulnerability	Important	8.8	Yes	No	EoP
CVE-2026-23651	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-26124	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-26122	Microsoft ACI Confidential Containers Information Disclosure Vulnerability	Critical	6.5	No	No	Info
CVE-2026-21536	Microsoft Devices Pricing Program Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-26144	Microsoft Excel Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26110	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-26113	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-26125	Payment Orchestrator Service Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-26131	.NET Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25177	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-26117	Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26130	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-23661	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-23662	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-23664	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-26121	Azure IOT Explorer Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-26118	Azure MCP Server Tools Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-23667	Broadcast DVR Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25190	GDI Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-25181	GDI+ Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-26030 *	GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable	Important	9.9	No	No	RCE
CVE-2026-23654 *	GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26141	Hybrid Worker Extension (Arc-enabled Windows VMs) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23665 †	Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23674	MapUrlToZone Security Feature Bypass Vulnerability	Important	7.5	No	No	SFB
CVE-2026-26123	Microsoft Authenticator Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26148 †	Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-25167	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.4	No	No	EoP
CVE-2026-26107	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26108	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26109	Microsoft Excel Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-26112	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26134	Microsoft Office Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26106	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26114	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26105	Microsoft SharePoint Server Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-24283	Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-25165	Performance Counters for Windows Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24282	Push message Routing Service Elevation of Privilege Vulnerability	Important	5.5	No	No	Info
CVE-2026-26115	SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-26116	SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-20967	System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-24285	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24291	Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25186	Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-23660 †	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24293	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25176	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25178	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25179	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-23656	Windows App Installer Spoofing Vulnerability	Important	5.9	No	No	Spoofing
CVE-2026-25171	Windows Authentication Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-23671	Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24292	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24295	Windows Device Association Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24296	Windows Device Association Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25189	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25174	Windows Extensible File Allocation Table Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25168	Windows Graphics Component Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-25169	Windows Graphics Component Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-23668	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25180	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-25170	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24297	Windows Kerberos Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-24287	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24289	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26132	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24288	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-25175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23669	Windows Print Spooler Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-24290	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23673	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25172	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-25173	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-26111	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-25185	Windows Shell Link Processing Spoofing Vulnerability	Important	5.3	No	No	Spoofing
CVE-2026-24294	Windows SMB Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26128	Windows SMB Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25166	Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-25188	Windows Telephony Service Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-23672	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25187	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-3536 *	Chromium: CVE-2026-3536 Integer overflow in ANGLE	Critical	N/A	No	No	RCE
CVE-2026-3538 *	Chromium: CVE-2026-3538 Integer overflow in Skia	Critical	N/A	No	No	RCE
CVE-2026-3539 *	Chromium: CVE-2026-3539 Object lifecycle issue in DevTools	High	N/A	No	No	RCE
CVE-2026-3540 *	Chromium: CVE-2026-3540 Inappropriate implementation in WebAudio	High	N/A	No	No	RCE
CVE-2026-3541 *	Chromium: CVE-2026-3541 Inappropriate implementation in CSS	High	N/A	No	No	RCE
CVE-2026-3542 *	Chromium: CVE-2026-3542 Inappropriate implementation in WebAssembly	High	N/A	No	No	RCE
CVE-2026-3543 *	Chromium: CVE-2026-3543 Inappropriate implementation in V8	High	N/A	No	No	RCE
CVE-2026-3544 *	Chromium: CVE-2026-3544 Heap buffer overflow in WebCodecs	High	N/A	No	No	RCE
CVE-2026-3545 *	Chromium: CVE-2026-3545 Insufficient data validation in Navigation	High	N/A	No	No	RCE

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, they are all cloud-native and require no user action. Microsoft has already remediated the vulnerabilities.

Moving on to the other code execution bugs, the vulnerabilities in SharePoint Server pop out first. Both require authentication, but it’s essentially the lowest level of authentication, so these would be ideal cases for lateral movement within an enterprise. There are the standard open-and-own cases within Office components. There an interesting sounding bug in the Windows Mobile Broadband Driver that requires physical access, but Microsoft doesn’t elaborate on the attack scenario beyond that fact. The bug in the System Image Manager Assessment and Deployment Kit (ADK) requires authentication. The bug in GDI requires user interaction. The remaining code execution bugs are in the RRAS protocol. We’ve seen bugs in this component in the past, but never in the wild. I wouldn’t ignore these, but I wouldn’t rush them out either.

Similar to last month, updates for Elevation of Privilege (EoP) bugs make up nearly half of this month’s release. And as we saw last month, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. The bugs in SQL Server allow attackers to elevate to SQL sysadmin privileges. The bug in the Azure MCP Server is more complex. It allows attackers to obtain the permissions associated with the MCP Server’s managed identity, which lets them perform actions that the managed identity is able to reach. The bug in the Azure AD SSH Login extension for Linux leads to root access, and it won’t be easy to patch. You’ll need to run the update instructions from the command line on each affected system. That’s the same case for the bug in the Linux Azure Diagnostic extension (LAD). There’s an odd bug in the Hybrid Worker Extension (Arc‑enabled Windows VMs) that leads to “ELEVATED” privileges, which is something I’ve never seen before. The bug in the Broadcast DVR component allows an attacker to go from low integrity level up to medium. There’s a bug listed as an EoP in the Push message Routing Service, but reading the description, Microsoft notes it could lead to an information disclosure. It’s likely this is an error and should be an Information Disclosure bug. The final EoP is in the Azure Portal Windows Admin Center and leads to SYSTEM. However, there’s no patch to remediate this bug. Instead, you need to install the latest version of the Windows Admin Center extension through the Azure Portal by hand.

There are two security feature bypass patches in the March release. The first is a bypass of the MapURLToZone method, which (as expected) allows attackers to bypass MapURLToZone protections. The third bypass is in Kerberos and could allow an attacker to either view some sensitive information or make changes to “disclosed” information. This is a race condition that occurs while the group policy is being reapplied, so the window to exploit this would be extremely small.

Looking at the remaining info disclosure bugs getting patched this month, only two result in info leaks consisting of unspecified memory contents or memory addresses. Ther others provide more interesting results. There are three bugs in the Azure IoT Explorer have some wide-ranging implications. According to Microsoft, exploitation could result in, “device connection information, authentication tokens, request data, file paths, and other information transmitted between the application and the IoT Hub.” The bug in Authenticator almost reads like a security feature bypass, as exploit results in the disclosure of a one‑time sign‑in code or authentication deep link. The attacker would receive the sign‑in information and could potentially use it to authenticate as the user, allowing access to information or services available to that account. The last info disclosure bug is in the Accessibility Infrastructure and allows an attacker to gain secrets or privileged information belonging to the user of the affected application.

There are only four spoofing bugs in the March release. The first is in SharePoint server and manifests as an XSS. The second bug is a Server-Side Request Forgery (SSRF) in the Azure IoT Explorer. The remaining two are a bit more cryptic. The bug in Windows Shell Link Processing results from the “exposure of sensitive information to an unauthorized actor,” and could lead to spoofing. That sounds like credential exposure, but it’s not explicitly called out. The final spoofing bug results from the insufficient verification of data authenticity in Windows App Installer. Again, this sounds vaguely like credential reflection, but without further information, we can only speculate.

Finally, there are four denial-of-service (DoS) bugs in the release, including one that’s listed as publicly known in the .NET Framework. As usual, Microsoft provides no actionable information about these bugs.

No new advisories are being released this month.

Looking Ahead

I plan on being at RSA for the first time in my career, so if you’re around, please stop by and say hello. I like it when people say hello. Otherwise, I’ll be back on April 14 with my assessment of that patch Tuesday release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Announcing Pwn2Own Berlin for 2026

Sat, 25 Jul 2026 19:00:42 +0200

If you just want to read the contest rules, click here.

Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and OffensiveCon. Outside of our shipping troubles, we had an amazing time and can’t wait to get back.

Last year, we added Artificial Intelligence as a category with great results. This year, we’re expanding this and splitting it into multiple different categories: AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products. In last year’s contest, NVIDIA targets had wins, losses, and collisions, so it will be interesting to see how they fare this year. The folks from AWS wanted to get into the fray as well, so they stepped up to co-sponsor this year’s event, which allows us to increase the reward for bugs in Firecracker. Of course, we have all of the returning categories as well, including web browsers, containers, servers, virtualization, and operating systems. There’s more than $1,000,000 in cash and prizes available for contestants. Last year, we awarded $1,078,750 for 28 unique 0-days over the three-day event. We’ll see if we can eclipse those numbers in 2026.

The contest begins on May 14, but registration closes on May 7, so don’t delay in getting those submissions in. We’re hoping for maximum participation, so set aside your vibe coding and show us what you can really do. We’re looking forward to some cutting-edge exploitation on display. For 2026, we have a total of 31 targets across 10 categories. Here is a full list of the categories for this year’s event:

-- Virtualization
-- Web Browser
-- Enterprise Applications
-- Servers
-- Local Escalation of Privilege
-- Containers
-- AI Database
-- Coding Agents
-- Local Inference
-- NVIDIA

Of course, no Pwn2Own competition would be complete without us crowning a Master of Pwn (Meister von Pwn?). Since the order of the contest is decided by a random draw, contestants with an unlucky draw could still demonstrate fantastic research but receive less money since subsequent rounds go down in value. However, the points awarded for each unique, successful entry do not go down. Someone could have a bad draw and still accumulate the most points. The person or team with the most points at the end of the contest will be crowned Master of Pwn, receive 65,000 ZDI reward points (enough for Platinum status), a killer trophy, and a pretty snazzy jacket to boot.

Let's look at the details of the rules for this year's event.

Virtualization Category

Some of the highlights for each contest can be found in the Virtualization Category, and we’re thrilled to see what this year’s event could bring with it. As usual, VMware is the main highlight of this category as we’ll have VMware ESXi return with an award of $150,000. Last year produced the first ESXi exploits in Pwn2Own history, so it will be interesting to see if we get more. Microsoft also returns as a target and leads the virtualization category with a $250,000 award for a successful Hyper-V Client guest-to-host escalation. Kernel-based Virtual Machine (KVM) is our final target in this category with a prize of $50,000.

There’s an add-on bonus in this category as well. If a contestant can escape the guest OS, then gain arbitrary code execution on the virtualization target and obtain arbitrary code execution in the guest operating system on a separate virtual machine managed by the same targeted virtualization target, they’ll earn another $50,000. That could push the payout on a ESXi bug to $200,000. This bonus is for KVM and ESXi only. Here’s a detailed look at the targets and available payouts in the Virtualization category:

Back to top

Web Browser Category

While browsers are the “traditional” Pwn2Own target, we’re continuously tweaking the targets in this category to ensure they remain relevant. We re-introduced renderer-only exploits a couple of years ago, and this year, we’ve increased the award to $75,000. In fact, we’ve increased the awards across the board for this category. Here’s a detailed look at the targets and available payouts:

Back to top

Enterprise Applications Category

Enterprise applications return as targets with Adobe Reader and various Office components on the target list once again. Attempts in this category must be launched from the target under test. For example, launching the target under test from the command line is not allowed. Prizes in this category run from $50,000 for a Reader exploit with a sandbox escape or a Reader exploit with a kernel privilege escalation, and $150,000 for an Office 365 application. Word, Excel, and PowerPoint are all valid targets. Microsoft Office-based targets will have Protected View enabled where applicable. Adobe Reader will have Protected Mode enabled where applicable.

This year, we’re adding a bonus for Copilot data exfiltration and Copilot action execution. Microsoft just patched a bug like this in Excel, so we know they are out there. If you’re able to exploit Copilot in addition to a Microsoft application, you’ll earn an additional $50,000. There are quite a few rules and scenarios around this add-on, so be sure to read the rules carefully and contact us with questions. Here’s a detailed view of the targets and payouts in the Enterprise Application category:

Back to top

The Server Category

The Server Category for 2026 focuses solely on the server components we’re most interested in. These servers are often targeted by everyone from ransomware crews to nation/state actors, so we know there are exploits out there for them. The only question is whether we’ll see any of the competitors bring one of those exploits to Pwn2Own. Last year, the bugs demonstrated in SharePoint ended up being exploited in the wild, so we know people are looking for these with great interest. Microsoft Exchange has been a popular target for some time, and it returns as a target this year as well, with a payout of $200,000. This category is rounded out by Microsoft Windows RDP/RDS, which also has a payout of $200,000. Here’s a detailed look at the targets and payouts in the Server category:

Back to top

Local Escalation of Privilege Category

This category is a classic for Pwn2Own and focuses on attacks that originate from a standard user and result in executing code as a high-privileged user. A successful entry in this category must leverage a kernel vulnerability to escalate privileges. Red Hat Enterprise Linux for Workstations returns as our Linux-based target, while Apple macOS, and Microsoft Windows 11 return as targets in this category. Prior exploits in this category have won Pwnie awards, so they’re always interesting to see. Here’s a detailed look at the targets and payouts in this category:

Back to top

The Container Category

We’re excited to have this category return for its third season, and we’re hopeful that even more contestants will target one of these container targets. For an attempt to be ruled a success against these three, the exploit must be launched from within the guest container/microVM and execute arbitrary code on the host operating system. Again, with help from AWS, Firecracker returns as a target with a prize of $100,000. Here are the targets and payouts for this category:

Back to top

AI Database Category

In the past, AI Hackathons have focused on using AI to develop vulnerabilities or other offensive frameworks. We’re opening up the models and various components themselves for exploitation. The first AI sub-category focuses on databases. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Database category:

Back to top

The Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a new category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

The Local Inference Category

We couldn’t leave local inference and LLMs out of Pwn2Own. These products claim to provide enhanced data privacy, zero-cost inference, lower latency, and fully offline functionality. We’ll see how the security stacks up. An attempt in this category must be launched from the contestant’s laptop within the contest network. Here are the targets and payouts for the Local Inference category:

Back to top

The NVIDIA Category

Our last AI sub-category focuses solely on NVIDIA products. For network accessible targets, an attempt must be launched from the contestant's laptop within the contest network. For NV Container Toolkit, the attempt must be launched from within a crafted container image and execute arbitrary code on the host operating system. For Megatron Bridge, entries that leverage vulnerabilities pertaining to pickle deserialization or that leverage a vulnerability when “trust_remote_code=true” are out of scope. Here are the targets and payouts for the NVIDIA category:

Back to top

Conclusion

The complete rules for Pwn2Own Berlin 2026 are found here. As always, we highly encourage entrants to read the rules thoroughly if they choose to participate. If you are thinking about participating but have specific configuration or rule-related questions, email us. Questions asked over X (nee Twitter), BlueSky, or other means will not be answered. Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. Registration for onsite participation closes at 5 p.m. Central European Time on May 7, 2026.

Be sure to stay tuned to this blog and follow us on Twitter, Mastodon, LinkedIn, or Bluesky for the latest information and updates about the contest. We look forward to seeing everyone in Germany, and we hope to see some of the best in the world show what they can do – vibe coded or not.

With special thanks to our Pwn2Own Berlin 2026 partners AWS, for providing their expertise and technology.

© 2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, ZERO DAY INITIATIVE, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

SharedRoot: Sandbox-Fehler in KI-Agent „Claude Cowork“ gibt VM Zugriff auf Mac-Dateien

Sat, 25 Jul 2026 19:00:32 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher zeigen, wie ein KI-Agent in „Claude Cowork“ eine Linux-VM verlassen kann, um auf dem Host-Mac beliebige Dateien zu lesen oder zu schreiben. Der Schlüssel liegt in einer gemeinsam genutzten Dateistruktur und einem Kernel-Weg, der aus einer unprivilegierten Nutzerumgebung Root-Rechte macht. Betroffen waren laut Angaben vor dem Patch rund 500.000 lokale […]

... den vollständigen Artikel »SharedRoot: Sandbox-Fehler in KI-Agent „Claude Cowork“ gibt VM Zugriff auf Mac-Dateien« lesen

Dieser Beitrag SharedRoot: Sandbox-Fehler in KI-Agent „Claude Cowork“ gibt VM Zugriff auf Mac-Dateien erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

Sat, 25 Jul 2026 18:59:26 +0200

Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

Executive summary

A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [1].

LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) CVE-2025-66376, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.

Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the Persistence and credential access section.

This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:

United States National Security Agency (NSA)
United States Federal Bureau of Investigation (FBI)
Netherlands Defence Intelligence and Security Service (MIVD)
Netherlands General Intelligence and Security Service (AIVD)
United States Cybersecurity and Infrastructure Security Agency (CISA)
United States Defense Counterintelligence and Security Agency (DCSA)
United States Department of Defense Cyber Crime Center (DC3)
United States Department of the Treasury
United States Naval Criminal Investigative Service (NCIS)
Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
New Zealand National Cyber Security Centre (NCSC-NZ)
United Kingdom National Cyber Security Centre (NCSC-UK)
Czech Republic National Cyber and Information Security Agency (NÚKIB)¹
Danish Defence Intelligence Service (DDIS)²
Estonian Foreign Intelligence Service (EFIS)³
Finnish Defence Intelligence (FDI)⁴
Finnish Security and Intelligence Service (SUPO)⁵
French General Directorate for Internal Security (DGSI)⁶
French National Cybersecurity Agency (ANSSI)⁷
Italian External Intelligence and Security Agency (AISE)⁸
Italian Internal Intelligence and Security Agency (AISI)⁹
Security and Intelligence Service of the Republic of Moldova (SIS RM)¹⁰
Polish Foreign Intelligence Agency (AW)¹¹
The Military Counterintelligence Service of Poland (SKW)¹²
Spain National Intelligence Centre (CNI)¹³
Sweden National Cyber Security Centre (NCSC-SE)¹⁴

The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the Mitigations section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed Indicators of compromise (IOCs).

As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.

For a downloadable list of IOCs, see:

AA26-204A.stix.xml (STIX XML)
AA26-204A.stix.json (STIX JSON)

Cybersecurity industry tracking

The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:

LAUNDRY BEAR
Void Blizzard [2]
CL-STA-1114 [3]
TA488 (formerly UNK_PitStop) [4]

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

Background

Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [1] [2]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.

The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [T1114.002]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [T1078], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence & Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [T1557].

Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [T1587.001] named “Улей” or “Ulej” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [T1114]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:

Last 90 days of emails,
Email address,
Password [T1589.001],
Global Address List (GAL) [T1087],
Two-factor authentication (2FA) tokens, and
Newly-created Application Passcode [T1098].

The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.

Targeting details

LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:

the Defense Industrial Base (DIB),
the federal and local government,
education,
energy,
law enforcement,
media,
non-governmental organizations, and
technology.

Technical details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FEND^TM version 1.4.0¹⁵. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and D3FEND tactics, techniques, and countermeasures.

Ulej is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit CVE-2025-66376 [Common Weakness Enumeration (CWE) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [T1074.002] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.

Reconnaissance

LAUNDRY BEAR uses the Ulej capability to exploit the CVE-2025-66376 vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [T1595] and fingerprinting datasets easily procured through various commercial vendors [T1596.005].

After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [T1589.002] from datasets offered by commercial vendors [T1597.002], open source intelligence [T1593], or previously exfiltrated data [T1597].

Resource development

The actors procure VPSs from a variety of providers [T1583.003], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [T1583] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for Ulej’s Flowerbed framework [T1608], which then receives and aggregates the data Ulej exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.

Flowerbed framework

Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:

Catcher,
Certbot,
Nginx, and
Gardener.

Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [T1048]. For additional information on Catcher, refer to the Exfiltration section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [T1048.002]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.

The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [T1588.007]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [T1588.002], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.

Initial access

To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [T1566]. Through exploitation of CVE-2025-66376, this JavaScript payload is immediately executed once the user views the malicious email [T1203], such as the one shown in Figure 1, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [T1199], as shown in the email metadata in Figure 2. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.

Figure 1: Example of malicious email

Figure 2: Headers from an example malicious email

According to the National Vulnerability Database (NVD), CVE-2025-66376 was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [5]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [T1587.004].

Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.

Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [T1027.017], as shown in Figure 3. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage CVE-2025-66376. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see Figure 3) [T1027.013]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [T1027.010], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [T1119]. The stages in order of appearance within the payload are as follows:

sendStartPing,
gather_email,
gather_environment,
gather_2fa_codes,
gather_app_password,
gather_device_status,
gather_oauth_consumers,
gather_autocomplete_password,
enable_mail_protocols,
gather_gal,
sendArchives, and
sendFinishPing.

Figure 3: Malicious payload of example email

Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [T1587].

Persistence and credential access

To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the Exfiltration section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [T1550.004], and the Zimbra campaign follows a similar trend.

The script used in this campaign tries to discover the victim’s email address during the gather_email stage [T1087]. The script searches for this email address in two ways. First, it examines the batchInfoResponse variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the Collection section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [T1185] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of null over HTTPS and does not attempt DNS exfiltration.

During the gather_autocomplete_password stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in Figure 4 and Figure 5. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in Figure 4. If there is no value in that input field, it checks the password input field shown in Figure 5. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of null is sent over HTTPS and DNS exfiltration is not attempted.

Figure 4: First illegitimate login HTML element

Figure 5: Second illegitimate login HTML element

LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the enable_mail_protocols stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.

ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the gather_app_password stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [T1556.006]. The SOAP request uses “ZimbraWeb” as the name of the application.

Additionally, the script also attempts to collect 2FA tokens. During the gather_2fa_codes stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.

Collection

As demonstrated in the Persistence and credential access section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the Persistence and credential access section, other SOAP commands executed to collect victim information are shown in Table 1.

**Table 1: Additional SOAP commands used**
SOAP Command	Namespace	Stage
GetInfoRequest	zimbraAccount	gather_environment
GetDeviceStatusRequest	zimbraSync	gather_device_status
GetOAuthConsumersRequest	zimbraAccount	gather_oauth_consumers
SearchGalRequest	zimbraAccount	gather_gal

The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.

During the gather_environment stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in Table 2) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.

**Table 2: ZCS webmail client types**
Indicator	Client Type	Associated Value
?client=advanced	Advanced	c
/h/	Standard	h
/modern/	Modern	m

As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&meta=0&query=date:-{DAY_OFFSET}d AND (not in:junk)”. The {DAY_OFFSET} value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of zd_comp_YYYY-MM-DD, and value of true, is saved to the window.top.localStorage property. This variable is saved regardless of whether the email is successfully exfiltrated.

According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a {DAY_OFFSET} of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the Exfiltration section.

The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the Exfiltration section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of gather_gal:{VAL}:api. The {VAL} placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder {DAY_OFFSET}, with a format of sendArchive:day-{DAY_OFFSET}.

Exfiltration

At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [T1048.003] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.

Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.

DNS exfiltration

DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, Ulej maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in Figure 6. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.

Figure 6: Structure for information exfiltrated by DNS

When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. Table 3 lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.

**Table 3: DNS exfiltration**
Type of Information	Exfiltration Stage	Data Type
Victim’s Email Address	gather_email	e
Client Type	gather_environment	c
Zimbra Version	gather_environment	v
URL at Time of Exploitation	gather_environment	url
2FA Scratch Codes	gather_2fa_codes	2fa
Newly Created Application Password	gather_app_password	pa
Harvested Autocomplete Password	gather_autocomplete_password	pw

HTTPS exfiltration

Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in Table 4. Traffic associated with HTTPS exfiltration will use the URL scheme shown in Figure 7.

**Table 4: HTTPS exfiltration types**
Content Type	URL Path
application/json	/v/p
application/octet-stream	/v/d

Figure 7: Structure for information exfiltrated by HTTPS

Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.

Table 5 provides a summary of the JSON-based exfiltration.

**Table 5: HTTPS JSON exfiltration**
Type of Information	Exfiltration Stage	JSON Key(s)
Victim’s Email Address	gather_email	email
Client Type, Version, and Current URL	gather_environment	client, version, full_url
Newly Created Application Password	gather_app_password	app_password
Harvested Autocomplete Password	gather_autocomplete_password	autocomplete_password

The script transmits all HTTPS exfiltration not identified in Table 5 using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. Table 6 summarizes the data exfiltrated in this format.

**Table 6: HTTPS binary exfiltration**
Type of Information	Exfiltration Stage	X-Filename Header
SOAP request for GetInfoRequest	gather_environment	zimbra_batch_analytics.json
SOAP request for GetScratchCodesRequest	gather_2fa_codes	zimbra_batch_analytics.json
SOAP request for GetDeviceStatusRequest	gather_device_status	zimbra_batch_analytics.json
SOAP request for GetOAuthConsumersRequest	gather_oauth_consumers	zimbra_batch_analytics.json
Victim Organization’s Global Address List	gather_gal	telemetry_{1-20}.json
Last 90 Days of Victim’s Emails	sendArchives	telemetryData_{0-89}.json

The script sends all exfiltrated data identified in Table 6 to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [T1560]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in Table 6 using the application/octet-stream content typing rather than application/json.

At the beginning and end of the collection and exfiltration activity, during the sendStartPing and sendFinishPing stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in Figure 2, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (start, finish, or error).

Catcher

Ulej exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the Resource development section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.

Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the Resource development section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.

The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.

However, if a query includes a domain formatted as shown in Figure 6 and Figure 7, the service saves a log file in JSON format to disk containing the following details of the DNS query:

Time of query,
Source IP address for query,
Queried domain, and
Type of query.

The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in Figure 6 and Figure 7. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:

Time,
Source IP address,
Request method,
Host,
Path,
Query string,
Headers, and
Base64 payload.

These JSON event log files and binary output files are then initially saved to the directory /root/hits/tmp and later moved to the /root/hits/ready directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in Figure 8 also executes hourly to remove all files last modified at least two days ago from the /root/hits/ready directory.

Figure 8: Command used for automated directory cleanup

Response strategies

Mitigations

In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.

All organizations that use the ZCS webmail service should immediately prioritize ensuring that their ZCS is not running a vulnerable version. A patch for CVE-2025-66376 was released for both 10.1.13 and 10.0.18 versions of ZCS [D3-AH]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [d3f:Isolate].

System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [D3-AH]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including CISA’s Known Exploited Vulnerabilities Catalog and NCSC-UK’s Responding to active exploitation of vulnerabilities guidance.

Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [D3-CH]. However, Application Passcodes may still be necessary and should be monitored closely.

Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [CPG 3.Q]. This will allow organizations to monitor for and identify suspicious network activity [CPG 4.B], such as:

Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [D3-NTA];
Frequent DNS queries for a suspicious domain with seemingly random subdomains [D3-DNSTA];
A sudden spike of connections to a server associated with a recently established domain [D3-NTCD]; and
Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [D3-NTCD].

Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the Exfiltration section of this advisory.

Indicators of compromise (IOCs)

Flowerbed infrastructure

The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (Disclaimer: Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) Table 7 provides details about the server infrastructure used to host Flowerbed, and Table 8 lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [D3-IAA].

**Table 7: Flowerbed server infrastructure**
Domain	IP Address	First Seen	Last Seen
zmailanalytics[.]com	216.252.238[.]104	8 July 2025	15 October 2025
zimbra-metadata[.]com	216.252.238[.]18	20 August 2025	14 October 2025
analyticemailmeter[.]com	37.120.247[.]228	24 September 2025	18 March 2026
emailanalytics.com[.]ua	185.86.79[.]95	24 September 2025	18 March 2026
mailnalysis[.]com	104.248.134[.]194	11 November 2025	17 February 2026
zimbrastat[.]com	64.226.124[.]190	18 December 2025	18 March 2026
zimbrasoft.com[.]ua	193.238.152[.]66	20 January 2026	18 March 2026
synacorzimbra[.]nl	216.252.238[.]64	3 February 2026	30 March 2026
istc-cloud[.]com	194.156.103[.]193	5 February 2026	30 March 2026

**Table 8: Flowerbed X.509 certificate SHA-1 hashes**
Associated Domain	X.509 SHA-1 Hash	First Seen	Last Seen
zmailanalytics[.]com	2e4f314bc9943cab5005d6fde0b271c74d47bc9d	8 Jul 2025	6 Aug 2025
*.i.zmailanalytics[.]com	50a87d926621dd06389ba50d86e0ff574ed713a8	6 Aug 2025	13 Oct 2025
*.i.zimbra-metadata[.]com	c5a72420e7bb308d078e62128430897f82194c95	20 Aug 2025	14 Oct 2025
*.i.analyticemailmeter[.]com	8959c4d29e29f02ea94ea8bb21c8df2594c5549d	24 Sep 2025	8 Nov 2025
*.i.emailanalytics.com[.]ua	62eb76432597694edb01c1fe57aab0cfe03a7178	25 Sep 2025	27 Sep 2025
*.i.mailnalysis[.]com	cddf5c3be1e07f28140aed165b929bf2d614922a	12 Nov 2025	17 Dec 2025
*.i.zimbrastat[.]com	18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8	18 Dec 2025	28 Dec 2025
*.i.zimbrasoft.com[.]ua	1b25041ececf2457eef0270fc1d785cec8ec9ded	21 Jan 2026	10 Feb 2026
*.i.synacorzimbra[.]nl	e4fe6466a4f9a4249fe330651e914e45bbdca44a	5 Feb 2026	22 Mar 2026
*.i.istc-cloud[.]com	b6b77c9a455225d525834a403ca9ef5481ed0447	12 Feb 2026	30 Mar 2026

LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:

ivanka.zurabishvili@proton[.]me,
zmul1@buildandconsulting[.]com,
garrysmithme@pinmx[.]net, and
hostingclient@pinmx[.]net.

Phishing distribution

LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.

The following email addresses have distributed payloads attributed to this campaign:

c.laurent.ejfa@proton[.]me,
j.moreau.epsc@proton[.]me,
liberty.insights@proton[.]me,
certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and
certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).

Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:

98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,
60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,
b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and
1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.

Post-compromise artifacts

Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.

This Ulej capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the /opt/zimbra/log/mailbox.log file [D3-PA]. A significant amount of SOAP request activity that aligns with what was described in the Persistence and credential access and Collection sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:

Many SearchGalRequest command requests from a single user over a short period of time;
Use of the CreateAppSpecificPasswordRequest command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and
Use of the GetScratchCodesRequest command.

While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [D3-PA]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of zd_comp_YYYY-MM-DD, as explained in the Collection section of this advisory.

While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”

In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [D3-MA]. If an email that has a payload exploiting CVE-2025-66376 is discovered, steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.

Remediation

In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to CVE-2025-66376.

Organizations should use identifiers from the IOCs section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.

All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [CPG 3.B] and creating unique credentials [CPG 3.C], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.

Works cited

[1] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf

[2] Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/

[3] Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. https://unit42.paloaltonetworks.com/russian-webmail-espionage/

[4] Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit

[5] Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/

Footnotes

¹ Národní úřad pro kybernetickou a informační bezpečnost
²Forsvarets Efterretningstjeneste
³Välisluureamet
⁴ Sotilastiedustelu
⁵ Suojelupoliisi
⁶ Direction générale de la sécurité intérieure
⁷ Agence nationale de la sécurité des systèmes d’information
⁸ Agenzia Informazioni e Sicurezza Esterna
⁹ Agenzia Informazioni e Sicurezza Interna
¹⁰ Serviciul de Informații și Securitate al Republicii Moldova
¹¹Agencja Wywiadu
¹²Służba Kontrwywiadu Wojskowego
¹³Centro Nacional de Inteligencia
¹⁴Nationellt Cybersäkerhetscenter
¹⁵ MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.

Acknowledgements

The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.

Disclaimer of endorsement

The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.

Purpose

This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

United States organizations

National Security Agency
Cybersecurity Report Feedback: CybersecurityReports@nsa.gov
Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov
Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov
Cybersecurity and Infrastructure Security Agency
CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472).
Federal Bureau of Investigation
If you or someone you know has fallen victim to this campaign, file a complaint with IC3.
Defense Counterintelligence and Security Agency
DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: DCSA.CI.CyberOps@mail.mil
Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117.
Media/Public Inquiries: dcsa.quantico.dcsa-hq.mbx.pa@mail.mil
Department of Defense Cyber Crime Center
Defense Industrial Base Inquiries and Cybersecurity Services: DC3.DCISE@us.af.mil
Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at https://dibnet.dod.mil
Media Inquiries / Press Desk: DC3.Information@us.af.mil
Naval Criminal Investigative Service
To report criminal activity impacting the United States Navy, go to www.ncis.navy.mil and click “Submit a Tip”

Dutch organizations

Defence Intelligence and Security Service (MIVD): https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid
General Intelligence and Security Service (AIVD): https://www.aivd.nl

Australian organizations

Australian Signals Directorate
Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

Canadian organizations

The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.
Report an incident or suspicious activity to the Cyber Centre by email at contact@cyber.gc.ca, online via the reporting tool Report a cyber incident - Canadian Centre for Cyber Security or by phone at 1-833-CYBER-88 (1-833-292-3788).

New Zealand organizations

New Zealand National Cyber Security Centre (NCSC-NZ): info@ncsc.govt.nz

United Kingdom organizations

Report significant cyber security incidents to ncsc.gov.uk/report-an-incident (monitored 24/7)

Estonia organizations

Estonian Foreign Intelligence Service (EFIS): info@valisluureamet.ee

Finnish organizations

Finnish Security and Intelligence Service: supo.fi/en/contact

French organizations

French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18.

Italian Organizations

Italian External Intelligence and Security Agency (AISE):
Visit https://www.sicurezzanazionale.gov.it/
Italian Internal Intelligence and Security Agency (AISI):
Visit https://www.sicurezzanazionale.gov.it/

Moldovan organizations

Security and Intelligence Service of the Republic of Moldova (SIS RM): cybersec@sis.md

Polish organizations

Polish Foreign Intelligence Agency (AW): ctiteam@aw.gov.pl

Appendix A: MITRE ATT&CK tactics and techniques

See Table 9 through Table 19 for all the threat actor tactics and techniques referenced in this advisory.

**Table 9: Reconnaissance**
Technique Title	ID	Use
Gather Victim Identity Information: Credentials	T1589.001	The payload attempts to intercept a victim’s password from their password manager.
Gather Victim Identity Information: Email Addresses	T1589.002	The payload attempts to grab the victim’s email address from various data stores.
Search Open Websites/Domains	T1593	This group likely leverages public information to support target development.
Active Scanning	T1595	Port scanning can be used by this group to assist with determining exploitability of identified targets.
Search Open Technical Databases: Scan Databases	T1596.005	Various public datasets can provide information to support discovery of exploitable targets.
Search Closed Sources	T1597	Previously exfiltrated data can be used to enhance target development efforts.
Search Closed Sources: Purchase Technical Data	T1597.002	Commercial datasets can also be used to support target development efforts.

**Table 10: Resource Development**
Technique Title	ID	Use
Acquire Infrastructure	T1583	This group used Mullvad VPN to anonymize traffic sent to operational infrastructure.
Acquire Infrastructure: Virtual Private Server	T1583.003	This group procured VPS servers from a variety of vendors.
Develop Capabilities	T1587	The Ulej capability was developed likely for use by this group to conduct spear phishing campaigns.
Develop Capabilities: Malware	T1587.001	Development of a novel payload that steals a victim’s emails and other sensitive account information.
Develop Capabilities: Exploits	T1587.004	Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript.
Obtain Capabilities: Tool	T1588.002	Open source tools, such as Evilginx2, have also been used by the group.
Obtain Capabilities: Artificial Intelligence	T1588.007	The group appears to have leveraged AI to support development efforts.
Stage Capabilities	T1608	Flowerbed is deployed to a procured server in the cloud.

**Table 11: Initial Access**
Technique Title	ID	Use
Valid Accounts	T1078	This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.
Trusted Relationship	T1199	The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.
Phishing	T1566	The actors used spear phishing to lure users into opening malicious email.

**Table 12: Execution**
Technique Title	ID	Use
Exploitation for Client Execution	T1203	An XSS vulnerability was leveraged to execute the JavaScript payload.

**Table 13: Persistence**
Technique Title	ID	Use
Account Manipulation	T1098	Enabling IMAP and Application Passcodes provides persistent access to the compromised account.
Modify Authentication Process: Multi-Factor Authentication	T1556.006	Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token.

**Table 14: Privilege Escalation**
Technique Title	ID	Use
Valid Accounts	T1078	This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.

**Table 15: Stealth**
Technique Title	ID	Use
Obfuscated Files or Information: Command Obfuscation	T1027.010	Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability.
Obfuscated Files or Information: Encrypted/Encoded File	T1027.013	The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload.
Obfuscated Files or Information: SVG Smuggling	T1027.017	The payload was contained in an “onload” attribute within an SVG image included in the malicious email.
Use Alternate Authentication Material: Web Session Cookie	T1550.004	Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate.

**Table 16: Credential Access**
Technique Title	ID	Use
Modify Authentication Process: Multi-Factor Authentication	T1556.006	Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token.
Adversary-in-the-Middle	T1557	Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies.

**Table 17: Collection**
Technique Title	ID	Use
Data Staged: Remote Data Staging	T1074.002	Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions.
Email Collection	T1114	This group has emphasized collection of emails.
Email Collection: Remote Email Collection	T1114.002	Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device.
Automated Collection	T1119	Upon execution, the JavaScript payload automatically collects all relevant information in stages.
Browser Session Hijacking	T1185	The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user.
Archive Collected Data	T1560	Emails are exfiltrated with GZIP compression.

**Table 18: Discovery**
Technique Title	ID	Use
Account Discovery	T1087	Stolen Global Access Lists provide the group with new users to target.

**Table 19: Exfiltration**
Technique Title	ID	Use
Exfiltration Over Alternative Protocol	T1048	Victim information was exfiltrated over both HTTPS and DNS.
Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	T1048.002	Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS.
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol	T1048.003	Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding.

Appendix B: MITRE D3FEND countermeasures

See Table 20 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

**Table 20: MITRE D3FEND Countermeasures**
Countermeasure Title	ID	Description
Application Hardening	D3-AH	Organizations should immediately prioritize patching CVE-2025-66376. Organizations should promptly apply software updates to all email systems.
Isolate	d3f:Isolate	Organizations that cannot feasibly patch should use alternative mail clients.
Credential Hardening	D3-CH	Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys.
Network Traffic Analysis	D3-NTA	Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization.
DNS Traffic Analysis	D3-DNSTA	Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains.
Network Traffic Community Deviation	D3-NTCD	Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. Organizations should monitor for connections to internal services, such as webmail, from VPN providers.
Identifier Activity Analysis	D3-IAA	Organizations should search for the listed known IOCs.
Process Analysis	D3-PA	Organizations should search ZCS log files for specific commands used by the malicious script. Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes.
Message Analysis	D3-MA	Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.

18 Enterprise-Architecture-Tools

Sat, 25 Jul 2026 18:59:25 +0200

Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens.

Foto: I Believe I Can Fly – shutterstock.com

Enterprise Architecture (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftsziele optimal zu unterstützen. Sie sorgen ebenfalls dafür, dass Unternehmen ihre Roadmaps für die digitale Transformation geordnet vorantreiben können. EA Tools bieten dafür unter anderem Collaboration-, Reporting-, Testing- und Simulationsfunktionen. Mit deren Hilfe lassen sich Modelle implementieren, die Geschäfts- und IT-Prozesse gezielt verbessern.

Um die beste Lösung für Ihr Unternehmen zu finden, sollten Sie zuerst prüfen, ob sich das jeweilige Tool mit Ihrem Technologie-Stack integrieren lässt. Anschließend gilt es abzuwägen, ob die Informationen, Diagramme und Tabellen, die die Software zur Verfügung stellt, für das Unternehmen auch einen echten Nutzwert haben.

Empfehlenswerte Enterprise-Architecture-Tools

Nachfolgend finden Sie einen Überblick über die wichtigsten Enterprise-Architecture-Tools – in alphabetischer Reihenfolge. Sie stellen einen Mix aus Visualisierungs-, Collaboration- und Project-Management-Funktionen bereit und unterstützen eine Vielzahl von Enterprise Architecture Frameworks.

Ardoq

Nachdem zuerst über einfache Formulare Informationen von Usern, Entwicklern und sonstigen Stakeholdern im Unternehmen eingesammelt wurden, lässt sich mithilfe von Ardoq ein digitaler Zwilling der gesamten Organisation erstellen. Der Ansatz setzt also darauf, die Menschen, die in ihren Rollen mit den verschiedensten Systemen arbeiten, realistisch in ihrer Arbeitswelt abzubilden.

Jede Mitarbeiterin und jeder Mitarbeiter im Unternehmen kann später von den Netzwerkvisualisierungen und Datenfluss-Diagrammen profitieren, um seine eigene Rolle optimal zu unterstützen und den Arbeitsplatz immer wieder anzupassen und zu modernisieren. Das Tool lässt sich mit den wichtigsten Cloud-Plattformen integrieren. Es bietet eine API, die individuelle Anpassungen in allen wichtigen Programmiersprachen (Python, C#, Java, etc.) ermöglicht.

Wichtigste Use Cases:

“Architektonischen Stress” bei Lastspitzen simulieren, falls größere Veränderungen bevorstehen;
Verstehen, wie verändertes Nutzerverhalten neue Anforderungen generiert;
Application Portfolio Management, um besser strategisch zu planen.

Atoll Group SAMU

Das EA-Tool SAMU macht die Enterprise Architecture sichtbar, indem es tiefe Verknüpfungen zwischen On-Premises-Systemen, dem Cloud-Layer und Tools für das Business Process Management aufzeigt. Das Tool der Atoll Group bietet vielfältige Integrationsmöglichkeiten, zum Beispiel mit Monitoring-Tools (etwa Tivoli, ServiceNow), Configuration-Management-Datenbanken (zum Beispiel CA, BMC) oder Service-Organisations-Tools (BMC, HPE). Alle Informationen fließen in ein zentrales Datenmodell ein, das um den zusätzlichen Input der Stakeholder weiter angereichert wird.

Wichtigste Use Cases:

Enterprise-Architektur visualisieren;
strategische Planungsprozesse und Architektur-Reviews mit Informationen unterfüttern;
mithilfe einer visuellen Verständnisgrundlage die Kommunikation verbessern.

Avolution Abacus

Dieses Tool erfasst die Breite und den Umfang der Unternehmensarchitektur mit Hilfe eines auf Diagrammen basierenden Dashboards. Die Integration mit gängigen Tools wie SharePoint, Excel, Visio, Google Sheets, Technopedia oder ServiceNow vereinfacht die Nutzung. Abacus wurde inzwischen auch um einen Machine-Learning-Layer ergänzt, der es Anwendern ermöglicht, ein Modell zu trainieren, das ihnen beispielsweise hilft zu erkennen, wer im Unternehmen für welches System verantwortlich ist.

Wichtigste Use Cases:

die IT für das gesamte Unternehmen “öffnen”, um ein allgemeines Verständnis der Datenflüsse zu erzeugen;
umfassendes Enterprise Modeling, um eine Roadmap für künftige Entwicklungen zu erstellen;
Business-Metriken tracken, die mit der Unternehmens-Performance zusammenhängen.

BOC Group ADOIT

ADOIT soll Teams dabei unterstützen, Ressourcen zu verwalten, Bedarfe vorherzusagen und Assets zu tracken. Dazu mappt das Tool jedes System oder Softwarepaket mit einem Objekt. Die Datenflüsse zwischen den Systemen werden in Beziehungen umgewandelt, die von diesen Objekten mithilfe eines anpassbaren Metamodells erfasst werden. Geschäftsprozesse können auf ähnliche Weise über ein gut integriertes Begleitprodukt namens ADONIS modelliert werden. ADOIT ist Web-basiert und lässt sich auch mit Tools wie Atlassian Confluence integrieren, um die Datenerfassung und -entwicklung zu beschleunigen.

Wichtigste Use Cases:

ein unternehmensweites Modell erstellen, das bei sämtlichen Teammitgliedern ein Verständnis über den Stack schafft – und wie man diesen verbessern kann;
vollständiger Zugriff auf EA-Daten über eine Mobile-Anwendung;
bei Fusionen und Übernahmen den Tech-Bereich durch genaues Asset-Mapping orchestrieren.

Bizzdesign Hopex

Nach der Übernahme von Mega International zählt die Hopex-Plattform zum Portfolio von Bizzdesign. Sie soll dabei unterstützen, Unternehmensanwendungen zu modellieren und dabei ein Verständnis der von ihnen unterstützten Geschäfts-Workflows schaffen. Dabei liegt ein Schwerpunkt auf den Bereichen Data Governance und Risikomanagement. Hopex basiert auf Microsoft Azure und stützt sich auf eine Reihe offener Standards wie GraphQL und REST Queries, um Informationen aus Komponentensystemen zu sammeln. Das Reporting ist mit den Office-Tools von Microsoft sowie mit grafischen Lösungen wie Tableau und Qlik integriert.

Wichtigste Use Cases:

datengestützte Erkenntnisse herbeiführen, um Cloud- und Anwendungsbereitstellung zu steuern;
akkurate Nutzungsmodelle erstellen, um Architekturanforderungen zu verstehen;
eine Bedarfsschätzung mit Umfragen und anderen Tools vornehmen, um für die Zukunft zu planen.

Bizzdesign Horizzon

Das Tool dient dazu, Business Workflows und den zugrundeliegenden Tech-Stack zu modellieren. Dazu bietet Horizzon ein Graph-basiertes Modell, das Daten von sämtlichen Stakeholdern einsammelt und diese an eine Analytics-Engine weitergibt. Im Ergebnis entstehen Diagramme, die den aktuellen Systemzustand widerspiegeln. Wichtige Schwerpunkte dieses Tools sind Change Management und Zukunftsplanung: Horizzon ist nicht zuletzt dafür konzipiert worden, die Risiken eines Redesigns zu minimieren. Das Toolset unterstützt die wichtigsten Frameworks ArchiMate, TOGAF und BPMN. Neben Mega hat Bizzdesign im Januar 2025 auch den EA-Geschäftsbereich der Software AG – Alfabet – übernommen.

Wichtigste Use Cases:

Vorhersage zukünftiger Anforderungen durch Predictive Modeling;
Orchestrieren von Workflows auf der Basis der technischen und der Business-Architektur;
Antizipieren von Risiken sowie Security- und Governance-Problemen durch die Modellierung von Datensicherheitsanforderungen.

Capstera

Das Tool von Capstera fokussiert darauf, die Business Architecture selbst abzubilden. Value und Process Maps helfen dabei, die Rollen der verschiedenen Unternehmensbereiche zu definieren und nachzuverfolgen. Dabei können im laufenden Prozess Verknüpfungen mit den zugrundeliegenden Softwarprodukten und Tools hinzugefügt werden.

Wichtigste Use Cases:

Reports erstellen, die sich erst einmal mit der Business-Architektur selbst beschäftigen;
Beziehungen zwischen Menschen, Abteilungen und Rollen analysieren;
die langfristige strategische Planung vorantreiben.

Clausmark Bee360

Teammitglieder, die Clausmarks Flaggschiffprodukt Bee360 (früher Bee4IT) verwenden, wollen eine einfache “Single Source of Truth” über die Workflows im Unternehmen. Ziel ist es, verschiedenen betrieblichen Rollen intelligentere Entscheidungen zu ermöglichen. Das Modul Bee360 FM (Finanzmanagement) bietet etwa die Möglichkeit, Kosten nachzuvollziehen und zuzuordnen. Die Anwender können verschiedene solcher Module miteinander verknüpfen, um EAM, Finanzmanagement, Portfolio Management und Agile Planning nahtlos zu integrieren – bei maximaler Transparenz.

Wichtigste Use Cases:

C-Suite-Ebene befähigen, Projekte zu managen und Assets zuzuweisen;
präzise digitale Zwillinge entwickeln, um ein Verständnis über Datenflüsse zu schaffen und künftige Erweiterungen zu planen;
integrierte Wissensdatenbank aufbauen, um alle digitalen Workflows zu tracken.

EAS

Das Essential-Paket von EAS (Enterprise Architecture Solutions) nahm als Open-Source-Projekt seinen Anfang und hat sich inzwischen zu einer kommerziell verfügbaren Cloud-Lösung weiterentwickelt. Das Tool erstellt ein Metamodell, das die Interaktionen zwischen Systemen und Geschäftsprozessen beschreibt. Ebenfalls enthalten sind Pakete, um gängige Business Workflows wie Datenmanagement oder DSGVO-Compliance zu tracken.

Wichtigste Use Cases:

den technischen Reifegrad der eigenen Architektur evaluieren;
Sicherheit und Governance durch besseres Asset Tracking optimieren;
wachsende Systemkomplexität kontrollieren und managen.

OrbusInfinity

Orbus Software hat Anfang 2025 die Akquisition seines Konkurrenten Capsifi abgeschlossen. Der Anbieter stellt mit OrbusInfinity eine Enterprise-Transformation-Plattform auf KI-Basis zur Verfügung, die schnellere, bessere Entscheidungen, Kosteinesparungen und Risikominimierung verspricht. Architecture-Teams sollen mit Hifle von OrbusInfinity mit einer Vielzahl von Stakeholdern interagieren können, um eine “digitale Blaupause” ihres Unternehmens zu generieren, die eine einheitliche Sicht auf das aktuelle und künftige Geschäft realisieren soll. Diverse Drittanbieter-Tools lassen sich außerdem mit der Plattform integrieren, darunter etwa von Microsoft, Flexera, ManageEngine oder ServiceNow.

Wichtigste Use Cases:

Stakeholder-Management;
Enterprise-Landschaften visualisieren;
Entscheidungsfindung und Datenanalyse automatisieren.

Planview Enterprise One

Planview bietet eine ganze Reihe von Produkten, mit denen Unternehmen Teamwork, Prozesse und die Enterprise Architecture nachvollziehen können. Die Enterprise Tools sind in drei Kategorien unterteilt: strategisches Portfolio-Management, Produktportfolio-Management und Projektportfolio-Management. Im Zusammenspiel entstehen hardware- und Software-übergreifende Layer, die rollenbasierte Perspektiven für Führungskräfte und Teammitglieder eröffnen. Das Toolset integriert mit gängigen Ticket-Tracking-Systemen wie Jira, um Workflow-Analysen und Reports zu erstellen. Inzwischen hat Planview nach einer Übernahme neue Tools in sein Portfolio integriert, die früher unter den Namen Daptiv, Barometer und Projectplace bekannt waren.

Wichtigste Use Cases:

eine langfristige, strategische Vision für die Architekturentwicklung aufbauen;
Entwicklungsarbeit auf Projektebene tracken und in eine beliebige Strategie integrieren;
mit Fokus auf die Customer Experience und die Produktstruktur den Change vorantreiben.

QualiWare Enterprise Architecture

Das Enterprise Architecture Tool von QualiWare ist Teil einer größeren Sammlung von Modellierungswerkzeugen, die darauf abzielt, sämtliche Geschäftsprozesse zu erfassen. Beispielsweise ist es möglich, einen digitalen Zwillinge zu bauen, mit dem sich Customer Journeys nachvollziehen lassen. Qualiware hat diverse KI-Algorithmen integriert, um Dokumentation und Process Discovery zu optimieren.

Wichtigste Use Cases:

ein kollaboratives Ökosystem für Business Manager aufbauen, das ein Verständnis von der Enterprise Architecture vermittelt;
architektonische Designelemente erfassen, um ein Wissens-Ökosystem rund um den Stack aufzubauen;
eine breite Beteiligung in Sachen Dokumentationserstellung und -überprüfung fördern.

Quest Erwin Evolve

Das Erwin Evolve Tool von Quest hat sich von einem Datenmodellierungs-Tool zu einem System für Enterprise-Architecture- und Geschäftsprozess-Modellierung weiterentwickelt. Um die Komplexität moderner, ineinandergreifender Softwaresysteme und der von ihnen gemanagten Geschäftsprozesse zu durchdringen, können Anwender auf benutzerdefinierte Datenstrukturen zurückgreifen. Das Web-Tool erstellt Modelle, rollenbasierte Diagramme und andere Visualisierungen, die in allgemein zugängliche Dashboards einfließen. Zum Paket gehört ein KI-basiertes Modellierungs-Tool, das Whiteboard-Skizzen integrieren kann.

Wichtigste Use Cases:

einen digitalen Zwilling für die strategische Modellierung der Enterprise Data Architecture erstellen;
Customer Journeys verstehen;
Services und Systeme mit Application Portfolio Management tracken.

SAP LeanIX Enterprise Architecture Suite

Die Tool-Sammlung von LeanIX umfasst unter anderem Enterprise Architecture Management und andere Bereiche, die für Aufgaben wie SaaS– und Value-Stream-Management wichtig sind – etwa um Cloud-Deployments und darauf laufende Services zu tracken. Die Daten die dabei über die IT-Infrastruktur gesammelt werden, fließen in ein grafisches Dashboard ein. Das Tool ist eng mit wichtigen Cloud-Workflow-Tools wie Confluence, Jira, Signavio und Lucidchart integriert. Das ist für Teams von Vorteil, die diese Tools bereits nutzen, um ihre Entwicklungsstrategien zu planen und umzusetzen. Seit November 2023 ist LeanIX Teil von SAP.

Wichtigste Use Cases:

Anwendungsmodernisierung und Cloud-Migration managen;
Obsoleszenz von Software-Services evaluieren;
Kosten kontrollieren und managen.

ServiceNow

Die Tool-Sammlung von ServiceNow lässt sich auf verschiedene Architekturtypen herunterbrechen, darunter Assets, DevOps, Security und Service. Die Tools katalogisieren die unterschiedlichen Hardware- und Softwareplattformen, um Workflows und Datenflüsse im Unternehmen abzubilden und zu verstehen. Ausführliche Reportings und detaillierte Dashboards ermöglichen Analysen, auf deren Grundlage Risiken minimiert und die Ausfallsicherheit der Systeme erhöht werden können.

Wichtigste Use Cases:

Tracken von Assets, Services und Systemen, die das Unternehmen ausmachen;
Governance-Themen, Risikobegrenzung, IT-Management und Security Operations werden in einer Plattform zusammengeführt;
durch die Integration von CRM-Tools lassen sich auch kundenorientierte Services managen.

Sparx Systems

Um Teams und Projekte verschiedener Größe und Komplexität zu unterstützen, hat Sparx vier Versionen seines EA-Tools entwickelt. Allen gemeinsam ist eine UML-basierte Modellierung, mit der sich die Komponenten komplexer Systeme tracken lassen. Eine Simulations-Engine ermöglicht “War Gaming” und vermittelt ein Verständnis darüber, wie sich Fehler ausbreiten und kaskadieren können. Sparx stellt zudem eine Vielzahl von vorgefertigten Design Patterns bereit, um Teams bei der Modellierung zu unterstützen.

Wichtigste Use Cases:

Nachfrage- und Lastveränderungen zur Prognose künftiger Anforderungen simulieren;
(potenzielle) Probleme durch eine Verbindungs-Matrix im Auge behalten;
Dokumentation erstellen.

Unicom System Architect

System Architect ist eines der Angebote aus Unicoms Team Blue. Es handelt sich um ein Tool, das ein Metamodell verwendet, um automatisiert so viele Daten wie möglich über die laufenden Systeme zu sammeln – manchmal auch durch ein Reverse Engineering von Datenflüssen. Dieses systemweite Datenmodell kann über benutzerdefinierte Dashboards Teammitgliedern aller Rollen zugänglich gemacht werden. Ein weiteres erwähnenswertes Feature: Die Ressourcenzuweisung lässt sich mit Hilfe von Simulationen optimieren.

Wichtigste Use Cases:

Was-wäre-wenn-Fragen zum Architekturmodell stellen;
ein Metamodell von Daten und Systemen aufbauen;
Migrations- und Transformationspläne erstellen.

ValueBlue BlueDolphin

Dieses EA-Tool sammelt Daten auf dreierlei Art:

Es importiert Basisdaten auf der Grundlage standardgesteuerter Automatisierung (ITSM, SAM).
Es arbeitet mit den Dateiformaten von Architekten und Systemdesignern – etwa ArchiMate oder BPMN.
Es gibt Fragebögen an andere Stakeholder heraus, die auf anpassbaren Vorlagen basieren.

Die aufbereiteten Informationen werden in einer visuellen Umgebung bereitgestellt, die Auskunft über die historische Entwicklung von Systemen gibt.

Wichtigste Use Cases:

systemweite Daten von internen und externen Stakeholdern automatisiert und formularbasiert erfassen;
zukunftsorientierte Reportings erzeugen, um den Change zu überwachen und voranzutreiben;
Kooperation und Zusammenarbeit durch offenes Data Reporting fördern.

(fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation CIO.com erschienen.

Akku im Sinkflug – wann lohnt der Tausch, wann muss ein neues Notebook her?

Sat, 25 Jul 2026 18:59:24 +0200

ParinPix / Shutterstock.com

Die Steckdose wird zum ständigen Begleiter, das Ladekabel zum wichtigsten Accessoire im Rucksack: Wenn der Notebook-Akku nachlässt, wächst unweigerlich der Frust im Alltag. Die schlechte Nachricht: Der chemische Alterungsprozess von Lithium-Ionen-Zellen ist unvermeidbar. Doch ein schwacher Akku bedeutet noch nicht zwingend, dass ein älterer Laptop in den Elektroschrott gehört. Oft lässt sich der Stromspeicher problemlos austauschen und die Reparatur ist wirtschaftlich sinnvoll. Aber nicht in jedem Fall. Wir zeigen, wie Sie sich an Fakten statt am Bauchgefühl orientieren und wann es Zeit wird, sich nach neuer Hardware umzusehen.

Diagnose: Fakten statt Bauchgefühl

Foundry

Bevor Sie Schraubenzieher zücken oder neue Hardware kaufen, muss geklärt werden: Ist Ihr Akku wirklich verschlissen, oder saugt ressourcenfressende Software im Hintergrund heimlich den Stromspeicher leer? Die Frage ist schnell beantwortet, denn sowohl Windows als auch macOS bieten tiefgreifende Diagnose-Tools, die sich mit wenigen

Unter Windows: Öffnen Sie die Windows-Eingabeaufforderung (CMD) oder PowerShell als Administrator und tippen Sie den Befehl

powercfg /batteryreport

ein. Windows generiert daraufhin eine detaillierte HTML-Datei, die tief ins System blicken lässt. Öffnen Sie die Datei unter dem angegebenen Pfad – z.B. „C:\battery-report.html“. Entscheidend sind hier zwei Werte: die Design Capacity (die ursprüngliche Nennkapazität Ihres Akkus ab Werk) und die Full Charge Capacity (die aktuell noch erreichbare Maximalkapazität). Liegt die aktuelle Kapazität unter 80 Prozent des Ursprungswertes, gilt ein Akku allgemein als verschlissen. Spätestens wenn er die 70-Prozent-Marke unterschreitet, wird der Kapazitätsverlust im Alltag oft zu einer spürbaren Einschränkung – das Bauteil ist Ende seines Lebenszyklus angekommen.

Bei macOS: Auf einem MacBook führt der Weg über das Apfel-Menü zu Systemeinstellungen → Allgemein → Info → Systembericht. Unter dem Reiter „Stromversorgung“ finden Sie die Anzahl der Ladezyklen sowie den Zustand. Apple garantiert in der Regel, dass ein Akku nach 1.000 vollständigen Ladezyklen noch mindestens 80 Prozent seiner ursprünglichen Kapazität halten kann. Fällt der Wert darunter, rät das System oft von selbst zum Service.

Schrauben oder schrauben lassen?

Auf iFixit finden Verbraucher Reparaturanleitungen, Ersatzteile und Werkzeug für zahlreiche Notebooks, Smartphones und andere Elektronikgeräte.

Foundry

Steht der Defekt fest oder ist die Alterung bereits weit fortgeschritten, folgt oft eine logistische Herausforderung. Die Hardware-Realität von 2026 ist Verbrauchern nämlich nicht gerade entgegengekommen – zumindest beim Akku: In vielen modernen Ultrabooks, Surface-Geräten oder MacBooks sind die Akkuzellen großflächig im Gehäuse verklebt. Das macht den Tausch für Laien gefährlich, weil bei einer Beschädigung der Zellen akute Brandgefahr besteht.

Der Gang zur Fachwerkstatt ist deshalb oft alternativlos – achten Sie hierbei am besten auf zertifizierte Betriebe, die eine Garantie auf das Ersatzteil gewähren. Anders sieht es bei reparaturfreundlichen Business-Geräten wie dem Lenovo ThinkPad T14 Gen 5 oder Vorreitern der Modularität wie dem Framework Laptop 16 aus: Hier brauchen Sie oft nur einen passenden Schraubendreher und zehn Minuten Zeit, um den Akku selbst zu tauschen. Wie Sie Ihren Akku am Laptop oder am Smartphone selbst tauschen können, erklären wir in diesem Ratgeber.

Achtung beim Teilekauf: Sparen Sie nicht am falschen Ende. Extrem billige Nachbau-Akkus von No-Name-Händlern auf großen Marktplätzen bergen nicht nur ein Brandrisiko, sondern schummeln oft auch bei der echten Kapazität. Greifen Sie unbedingt zu Originalteilen des Herstellers oder zu zertifizierten Ersatzteilen etablierter Drittanbieter (wie iFixit).

Wenn die Diagnose zeigt, dass Ihr Akku physisch noch fit ist, dann liegt das Problem vermutlich an Software mit Selbstbedienungsmentalität. Praktisch: Windows und macOS verfügen über integrierte Stromfresser-Finder. Unter Windows navigieren Sie zu Einstellungen → Strom und Akku → Akkunutzung. Dort listet Windows genau auf, welche Apps in den letzten Tagen am meisten Energie verbraucht haben. Auf dem Mac erfüllt die App Aktivitätsanzeige (Reiter Energie) denselben Zweck. Stoßen Sie hier auf Programme, die Sie gar nicht aktiv nutzen, sollten Sie deren Hintergrundaktivität einschränken oder die Software komplett deinstallieren.

💡 Infobox: Das neue Recht auf Reparatur (Stand 2026)

Das Recht auf Reparatur stammt von der Europäischen Kommission und dem EU-Parlament. Ziel des Gesetzespakets ist es, die wachsenden Berge von Elektroschrott auf dem Kontinent zu reduzieren und die Kreislaufwirtschaft zu stärken. Nach der Verabschiedung der EU-Richtlinie im Jahr 2024 hatten die Mitgliedsstaaten bis 2026 Zeit, die Vorgaben in nationales Recht umzusetzen – nun greifen die Regeln schrittweise und wirken sich zunehmend auf den Reparaturalltag aus.

Was Verbraucher davon haben:

Reparaturpflicht: Hersteller sind nun gesetzlich verpflichtet, für gängige Elektronikgeräte (wie Smartphones und Laptops) Reparaturen anzubieten – und das auch nach Ablauf der gesetzlichen Gewährleistung.
Zugang zu Ersatzteilen: Unabhängige Fachwerkstätten und ambitionierte Bastler erhalten leichteren Zugang zu Original-Ersatzteilen und offiziellen Reparaturanleitungen.
Weniger Software-Sperren: Praktiken wie das sogenannte “Parts Pairing” (bei dem Ersatzteile per Software blockiert werden, wenn sie nicht von einer offiziellen Vertragswerkstatt eingebaut wurden) werden stark eingeschränkt.
Mehr Wirtschaftlichkeit: Durch den faireren Wettbewerb sinken die Reparaturkosten, was den Tausch eines Akkus oft attraktiver macht als einen teuren Neukauf.

Wann lohnt sich der Tausch?

Um zu beurteilen, ob sich die Investition für den Austausch lohnt, hilft die bewährte 50-Prozent-Regel: Übersteigen die Kosten für die Reparatur (Ersatz-Akku plus eventuelle Arbeitszeit der Werkstatt) mehr als die Hälfte des aktuellen Restwerts des Notebooks, wird die Angelegenheit unwirtschaftlich.

Ein Rechenbeispiel: Ein vier Jahre altes Premium-Notebook, das früher mal 1.500 Euro gekostet hat, bringt auf dem Gebrauchtmarkt vielleicht noch 400 bis 500 Euro. Eine Investition von 120 Euro für einen fachgerechten Akkutausch ist dann noch durchaus sinnvoll und kann dem Gerät weitere zwei bis drei Lebensjahre verschaffen. Bei einem ohnehin leistungsschwachen 400-Euro-Plastikbomber aus dem Jahr 2021 ist eine 100-Euro-Reparatur jedoch (jenseits von Nostalgiegründen) kaum zu vertreten und gilt als unwirtschaftlich.

Wann ein Neukauf wirklich sinnvoll ist

Mal ehrlich: Der Akku ist oft nur das offensichtlichste Symptom eines veralteten Systems. Wer über eine Reparatur nachdenkt, sollte objektiv prüfen, ob die restliche Hardware den heutigen Anforderungen noch gewachsen ist – oder ob man mit einem neuen Laptop besser fährt:

Windows 10 Support-Ende: Das offizielle Support-Ende von Windows 10 (Oktober 2025) liegt bereits hinter uns. Privatanwender in der EU haben zwar Glück im Unglück: Wer mit einem Microsoft-Konto angemeldet ist, erhält die Extended Security Updates (ESU) im ersten Jahr bis Oktober 2027 kostenlos. Doch spätestens im Herbst 2027 ist endgültig Schicht im Schacht. Geräte, deren Prozessoren nicht offiziell für Windows 11 zertifiziert sind (ältere CPUs vor der Intel Core 8. Generation oder AMD Ryzen 2000er-Serie), stoßen dann an ihre praktische Lebensdauergrenze. Ohne den auslaufenden ESU-Schutz sollten Sie ab diesem Zeitpunkt bei betroffenen Windows-Geräten nicht mehr in einen neuen Akku investieren.
Speicher-Flaschenhälse: Verlöteter, nicht aufrüstbarer Arbeitsspeicher von 8 GB stößt selbst bei ausschließlicher Browser-Nutzung und Office-Anwendungen oft an seine Grenzen.
Träge Performance: Wenn das Notebook nicht nur schnell leer ist, sondern beim Öffnen von Programmen ins Schwitzen kommt und der Lüfter permanent auf Hochtouren läuft, bringt auch der stärkste neue Akku kein flüssiges Arbeitsgefühl zurück.

Zeit für einen neuen Laptop?

Wenn kein (sinnvoller) Weg mehr am Neukauf vorbeiführt, ist das nicht immer eine schlechte Nachricht: Moderne Geräte punkten nicht nur mit deutlich mehr Ausdauer jenseits der Steckdose – sie bringen auch spürbar mehr Tempo und Sicherheit, effizientere Hardware und oft angenehm leise Kühlung in Ihren Alltag.

Fazit und Checkliste: Akku tauschen oder Neukauf?

Die Entscheidung zwischen Werkstatt und Neuanschaffung ist am Ende des Tages ein Abwägen von Kosten, Nutzen und Sicherheit. Die folgende Checkliste hilft dabei, das Schicksal Ihres Notebooks zu klären:

Der Tausch lohnt sich, wenn:

der Laptop noch alle Leistungsanforderungen im Alltag erfüllt.
Windows 11 offiziell unterstützt wird (oder macOS/Linux aktuell ist).
die Gesamtreparatur weniger als 50 % des Restwerts kostet.
das Gehäuse unbeschädigt ist und Scharniere sowie Tastatur noch zuverlässig funktionieren.

Ein Neukauf ist besser, wenn:

das Betriebssystem (z. B. Windows 10) keine Sicherheitsupdates mehr erhält.
das Gerät durch 8 GB RAM oder eine alte CPU ohnehin ein Flaschenhals im Alltag ist.
Displayschäden oder defekte Ports weitere, teure Reparaturen erfordern.
die Reparatur den Zeitwert des Geräts deutlich übersteigt.

(PC-Welt)

Why Are Flats in Porur Becoming the First Choice for Chennai Homebuyers?

Sat, 25 Jul 2026 18:58:00 +0200

In this post, I will show you why flats in Porur are becoming the first choice for Chennai Homebuyers. Buying a home is an important decision that depends on location, daily convenience, future growth, and quality of life. Over the last few years, Porur has become one of the most preferred residential areas in Chennai. […]

The post Why Are Flats in Porur Becoming the First Choice for Chennai Homebuyers? appeared first on SecureBlitz Cybersecurity.

Sovereign AI has become the public-sector CIO’s control problem

Sat, 25 Jul 2026 18:57:42 +0200

In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving into AI, and most sovereign-AI debates answer the wrong version of it.

They ask whether a country can build its own model on domestic data and hardware. For the United States and China, which together hold more than 90% of global AI data-center capacity, per a January 2026 Tony Blair Institute analysis, that question is worth asking. However, for almost every other government, it is the wrong place to start. The operative question is narrower: Once AI is embedded in public services, who controls the stack?

The 5 layers of public-sector control

For a CIO, sovereign AI means enforceable control across the AI lifecycle; model ownership is a separate question. Control has five layers:

Data control: Where sensitive public data sits, and whether it can train a vendor’s model.
Model control: Which models clear which workloads, and under what validation.
Infrastructure control: Whether critical workloads run in approved environments.
Operational control: Whether AI-assisted actions are logged, monitored and reversible.
Vendor control: Whether the agency keeps portability, audit rights and a real exit.

Those five layers are the control plane for public-service AI. Floyd Dcosta recently made the enterprise case in “AI without sovereignty is just outsourced intelligence”: capability is what a tool can do; authority over how and when it does it is something a buyer can quietly lose. For public services, losing that authority plays out in the public eye.

Public-sector AI risk differs from enterprise risk. A retailer’s bad recommendation costs a sale; a government’s AI touches benefits, tax enforcement, policing and emergency response, raising the bar to due process, records retention and continuity of operations. A government that cannot reconstruct an AI-assisted decision lacks operational sovereignty, even in a domestic data center.

Evaluating risk: Concentration, jurisdiction and shadow AI

Foreign dependency is a real risk, but the exposure that matters is a sudden cutoff: A model you cannot audit, switch or exit, shut off by someone else’s order. A vendor’s nationality is a poor guide to that risk; control is. Two markers matter. The first is concentration. In July 2024, a single faulty CrowdStrike update crashed about 8.5 million Windows machines, disrupting airlines, hospitals, banks and governments worldwide. No attacker was involved; one homogeneous dependency failed everywhere at once. The lesson points away from vendor nationality and toward uniformity as the fault line, making portability and provider diversity resilience controls.

The second is jurisdiction. In June 2025, Microsoft’s legal director for France told a Senate inquiry, under oath, that it could not guarantee that French public-sector data, even in French data centers, would be protected against US demands under the 2018 CLOUD Act. No such request had been made, and EU data has stayed in the EU since January 2025; senators called the assurance purely declarative. For the most sensitive data, residency does not equal control; the parent’s jurisdiction can matter as much as the server’s. Three US hyperscalers hold about 70% of the European cloud market, while European providers’ share fell from 29% in 2017 to roughly 15%. Concentration plus jurisdiction is the exposure a CIO must price. I have watched teams treat vendor selection as the moment risk was solved; it rarely was.

The wrong response is self-isolation. Most countries will never build frontier models, advanced chips, hyperscale clouds and talent pipelines at once; the Tony Blair Institute calls full self-sufficiency “too expensive, too slow and, for most countries, simply impossible.” The better test is workload sensitivity. Low-risk uses, such as drafting, translation and summarization, can run on commercial platforms with controls; high-risk uses, such as benefits eligibility, fraud investigation and healthcare triage, demand stricter control over data, model behavior and auditability.

Mandating domestic-only provision before a competitive option exists inverts sovereignty. Europe 2031, a five-year scenario from June 2026 by European technologists and policy researchers, illustrates the failure mode: A 2027 “buy European” mandate lands as offensive cyber capability spreads, and agencies that switched to weaker providers are locked out and paying ransoms. The scenario is fiction; the mechanism is not. Leverage comes from being indispensable, not half-hearted self-sufficiency. The closer-to-home effect is shadow AI: Mandate an inferior sanctioned tool and staff bypass it, the way shadow IT grows up around tools people find too slow. A rule that pushes sensitive work into ungoverned shadow AI reduces control instead of adding it.

Regulation and data-residency rules belong in any serious strategy, but carry failure modes. Blanket localization raises hosting costs and slows adoption without guaranteeing control, and a “sovereign cloud” on a foreign parent’s stack can amount to sovereignty theater. The more useful pattern tiers requirements by sensitivity. India’s BHASHINI shows the application layer done well: A public platform serving 100 million-plus inferences a month across 22-plus languages on a vendor- and cloud-agnostic design that keeps data and switching rights public. Sovereignty resides in the portability, not in a national model.

Building an operational sovereignty strategy

Public trust is the constraint sovereignty rhetoric tends to skip. The OECD’s 2025 review of government AI warns that opaque systems make AI-assisted decisions hard to explain and can give public servants false confidence in tools that fail quietly. State-controlled AI is the same problem from the other side: A government that deploys models against its own citizens without audit or record has gained control and lost accountability. An agency that can log, explain and reverse an AI-assisted action can defend it to citizens, courts, auditors and elected officials. If it cannot, it has bought access and called it sovereignty.

None of this is new. AI sovereignty repeats earlier fights over cloud, telecom, semiconductors and cybersecurity. Europe’s flagship cloud project, GAIA-X, became a cautionary tale; the Dutch technologist Bert Hubert called it an “expensive distraction” that produced no European cloud, the familiar result of ambition without absorptive capacity. Cloud taught governments that outsourcing infrastructure does not outsource accountability; telecom, that vendor dependency becomes strategic exposure; chips, that supply chains matter before a crisis; cybersecurity, that trust must be verified continuously. AI inherits all four at once.

Over the next five to ten years, some countries will build national platforms, more will build trusted cloud and trusted model regimes, and most will run hybrids that pair domestic data control with global model access. Trade policy will harden those choices: Export controls on compute and data-localization rules will pull the vendor market into blocs that track alliances more than open markets. For a CIO, that turns a vendor and hosting decision into a five-year bet on whose rules and supply chains will still hold. The ones that succeed will treat sovereignty as an operating requirement, backed by leverage, not a slogan. Start with the control plane before the model: Most agencies will never own the model, and the controls are what decide whether the AI they do run stays accountable. Even when procurement policy is dictated from above, these questions remain within the CIO’s authority:

Can we classify AI workloads by public-service risk?
Can we prove where sensitive data goes across training, retrieval, inference, logging and retention?
Can we restrict which models are approved for which data classes and functions?
Can we reconstruct an AI-assisted action in enough detail to explain it?
Can we change providers without losing continuity or institutional knowledge?
Can we explain the system to citizens, regulators, auditors and elected officials?

A “no” to any of these does not mean the agency lacks AI. It means the agency has access it does not yet control. Public institutions can use global innovation without surrendering public authority, but only once they know what to hold, what to rent and where dependency turns into risk.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Fake-Jobs gehören jetzt zu den Scam-Top-5

Sat, 25 Jul 2026 18:55:19 +0200

Betrüger locken mit Home-Office-Stellen, Nebenjobs und hohen Gehältern. Eine neue Studie zeigt: Fake-Jobs gehören inzwischen zu den fünf größten Scam-Kategorien weltweit.

Rechteausweitung RefluXFS gefährdet Linux-Systeme mit XFS-Dateisystem

Sat, 25 Jul 2026 18:52:54 +0200

Eine Schwachstelle im Linux-Kernel namens RefluXFS ermöglicht lokalen Nutzern Root-Rechte auf XFS-Dateisystemen. Patches stehen zur Verfügung.

Tags: #Cyber Security | #Linux

Rechteausweitung RefluXFS gefährdet Linux-Systeme mit XFS-Dateisystem - it-daily.net

Sat, 25 Jul 2026 18:52:43 +0200

Patches stehen zur Verfügung. Sicherheitsforscher des Unternehmens Qualys haben unter der Bezeichnung RefluXFS beziehungsweise CVE-2026-64600 eine ...

SpaceX's Starship Megarocket Hits Key Milestones in 'Lucky 13' Test Flight

Sat, 25 Jul 2026 18:52:27 +0200

SpaceX's Friday launch of its massive Starship rocket "went quite smoothly," reports CNN, with a SpaceX spokesperson calling this mission "Lucky Number 13" (as the 13th integrated flight test for a Starship spacecraft with a Super Heavy rocket booster): During Starship V3's inaugural test, there were numerous engine issues as several on the booster failed to relight and the Starship spacecraft experienced a nail-biting engine outage. SpaceX also was forced to replace six engines on this vehicle ahead of today's flight because of a likely issue with moisture that prevented at least four from starting up correctly during an initial launch attempt last week... [Friday's Super Heavy rocket booster] fired all 33 of its engines in a pristine performance off the launchpad. The rocket booster also managed to relight 13 engines, as planned, to steer itself back toward a controlled landing. Only when Super Heavy attempted to relight its engines for a controlled landing burn over the Gulf waters did problems arise. The landing was still controlled, though Huot said the vehicle was traveling a bit faster than the company had hoped when it made touchdown. (SpaceX always intended to discard this Super Heavy booster in the ocean.) The Starship spacecraft had no obvious performance issues, making it all the way through its engine burn and managing to reignite one engine mid-flight as part of a test. It also made a controlled splashdown in the Indian Ocean — executing its "softest splashdown" to date in a "dream scenario," according to SpaceX's Dan Huot. The touchdown came about an hour after takeoff, as planned. During its coasting phase, Starship also deployed 20 Starlink test satellites, paving the way for operational missions later down the line in which SpaceX plans to deploy large batches of these satellites in a single launch. In another big win, SpaceX said it was able to make contact with each of those satellites. CNN adds that SpaceX "is facing intense pressure to get Starship ready for a crucial NASA test flight next year that could pave the way for the next moon landing. This flight was also the first for SpaceX as a publicly traded company. Last week's aborted launch attempt sparked a selloff, and shares are still trading below their IPO price. "To cap off the roaring success of today's flight test, SpaceX shared some stunning visuals of the upper Starship spacecraft sailing through space."

Read more of this story at Slashdot.

OpenAI's Rogue Agent Went Unnoticed For a Week

Sat, 25 Jul 2026 18:52:27 +0200

An anonymous reader quotes a report from Reuters: The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn't notice until well after the threat was contained and the FBI was alerted, according to people familiar with the investigation. The agent -- a program capable of making decisions and executing complex tasks with little or no human oversight -- attempted to break out of its isolated testing environment at OpenAI around July 9, according to two of the people. The intrusion at Hugging Face, which operates as a repository for AI tools and models, began two days later on July 11 and lasted until July 13, said Thomas Wolf, Hugging Face's co-founder. It took several more days for OpenAI to realize its agent was behind the hack, and the two companies only communicated about it for the first time on or around July 20, according to Wolf and three of the people familiar with the investigation. OpenAI's public disclosure, on July 21, thatone of its agents had slipped out of control and carried out the break-in at Hugging Facedrew global attention. But many details of the hack, including how long the agent went rogue and OpenAI's belated knowledge of it, are being reported here for the first time. Hugging Face is preparing a public timeline of the hack, Wolf said, adding that he could not speak to what happened at OpenAI. In a statement, OpenAI said the hack was unprecedented and "marks an important moment for AI safety." It added that it was reviewing the incident with outside advisers and would eventually publish a technical report. "Does that mean that they left it unattended and didn't realize what it was doing? Or maybe they did and didn't know how to contain it? Both are equally dangerous and alarming," asked Marley Smith, the principal intelligence specialist at the nonprofit World Ethical Data Foundation. "The models lie, they cheat, they hack," said Jeffrey Ladish, whose organization, Palisade Research, studies the capabilities and motivations of AI agents. Ladish said the hack should spark broader questions over how much all the leading AI companies are willing to invest in onerous security measures while locked in a race with one another to deploy the best and fastest models. "There has to be government oversight," Ladish said, "because it won't happen otherwise."

Read more of this story at Slashdot.

Risks of Parkinson's Disease May Increase With Prolonged Exposure to Road Traffic Noise

Sat, 25 Jul 2026 18:52:26 +0200

A large Danish study found a modest but consistent association between long-term road traffic noise exposure and higher Parkinson's disease risk, with a 3% increase for every 11.5 dB rise in noise at the most exposed side of a home. The Guardian reports: The researchers modeled noise exposure at the most and least exposed exterior of the residence of each participant and calculated the difference in noise levels. The magnitude of the effect was modest but consistent; at the most exposed facade, for every 11.5dB rise in noise level, the risk of Parkinson's disease rose by 3% over the study period. Having a quiet part of the home may mitigate the association between exposure to road traffic noise and higher risk of Parkinson's disease, according to the findings. The study, published in Jama Neurology, included 3.1 million Danish participants aged 40 and over, and followed them for 18 years. It was established using nationwide health register data, making it the largest study on road traffic noise and Parkinson's disease. Previous research linked the rise in neurological disorders, including Parkinson's disease, with exposure to environmental toxins. Environmental risk factors such as air pollution, microplastics and pesticides have become the main focus of prevention strategies. The study is one of the first to make the link to noise pollution.

Read more of this story at Slashdot.

Trump Threatens New Tariffs Against EU Over Google Fine

Sat, 25 Jul 2026 18:52:26 +0200

President Trump threatened a "substantial" new tariff on the European Union after Brussels fined Google more than $1 billion over alleged illegal trade practices. "The European Union will pay a very big price for this illegal and highly unethical conduct, which I have consistently warned them about," Trump wrote on Truth Social. "The penalties will be entirely reversed and, we anticipate, a substantial TARIFF to be placed on them at the earliest possible moment." Politico reports: The president's threat came just a day after U.S. Trade Representative Jamieson Greer warned that the EU's action against Google -- two fines totaling over $1 billion -- could imperil the bloc's relationship with the White House. At risk: the Turnberry deal, which Trump and European Commission President Ursula von der Leyen signed last fall, that capped U.S. tariffs on EU exports at 15 percent. [...] But the president's social media post could signal a coming breach. "The United States of America is not a 'PIGGYBANK' for Europe, nor will we allow it to be!" Trump wrote.

Read more of this story at Slashdot.

Wine 11.14 Released

Sat, 25 Jul 2026 18:52:26 +0200

Wine 11.14 is out with initial WoW64 mode support on FreeBSD, allowing 32-bit Windows applications to run on a 64-bit system without relying on 32-bit multilib support. The release also adds Start Menu icon support in Wine Explorer, 7.1 format conversions in DirectSound, AES-GMAC support in BCrypt, and 21 bug fixes affecting apps and games including Adobe Reader, Heroes of the Storm, and Age of Empires I and II. Additional details can be found at WineHQ.org.

Read more of this story at Slashdot.

Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning

Sat, 25 Jul 2026 18:52:24 +0200

Is the previous tutorial Vulnerability Scanning with OpenVAS 9.0 part 1 we’ve gone through the installation process of OpenVAS on Kali Linux and the installation of the virtual appliance. In this tutorial we will learn how to configure and run a vulnerability scan. For demonstration purposes we’ve also installed a virtual machine with Metasploitable 2 [...]

The post Vulnerability Scanning with OpenVAS 9 part 2: Vulnerability Scanning appeared first on Hacking Tutorials.

Vulnerability Scanning with OpenVAS 9 part 1: Installation & Setup

Sat, 25 Jul 2026 18:52:24 +0200

A couple years ago we did a tutorial on Hacking Tutorials on how to install the popular vulnerability assessment tool OpenVAS on Kali Linux. We’ve covered the installation process on Kali Linux and running a basic scan on the Metasploitable 2 virtual machine to identify vulnerabilities. In this tutorial I want to cover more details [...]

The post Vulnerability Scanning with OpenVAS 9 part 1: Installation & Setup appeared first on Hacking Tutorials.

Installing Rogue-jndi on Kali Linux

Sat, 25 Jul 2026 18:52:21 +0200

Following the previous tutorial in which we looked at the log4j vulnerability in VMWare vSphere server, I got some questions about how to set up a malicious LDAP server on Linux. The attacker controlled LDAP server is required to provide the malicious java class (with a reverse shell for example) in response to the forged [...]

The post Installing Rogue-jndi on Kali Linux appeared first on Hacking Tutorials.

Anzeige: Tapo C610 Solarkamera für außen noch kurz für nur 66 Euro bei Amazon

Sat, 25 Jul 2026 18:52:14 +0200

Die Tapo C610 überwacht kabellos, dreht sich bis 360 Grad und filmt nachts in Farbe. Bei Amazon ist sie kurzzeitig günstiger zu haben. (Smart Home, Security)

(g+) House & Home: How smart tech is being weaponised in the home

Sat, 25 Jul 2026 18:52:10 +0200

Remote access to domestic devices is increasingly being used to manipulate, intimidate and disturb. Policymakers and tech companies are grappling with safeguards. Von Emma Jacobs (Security, Tracking)

Ubuntu: Root-Lücke in snapd gefährdet unzählige Linux-Systeme

Sat, 25 Jul 2026 18:52:07 +0200

Zwei Race Conditions in snap-confine verleihen Angreifern unter Linux Root-Zugriff. Mehrere Ubuntu-Versionen sind per Default anfällig. (Security, Ubuntu)

RefluXFS: Kernel-Bug verleiht auf Millionen von Linux-Systemen Root-Zugriff

Sat, 25 Jul 2026 18:52:03 +0200

Eine Sicherheitslücke im Linux-Kernel lässt Angreifer beliebige Dateien auf XFS-Volumes überschreiben. Root-Rechte sind damit leicht zu beschaffen. (Sicherheitslücke, Fedora)

I've used Linux for 30 years, and this free security suite does it all - almost perfectly

Sat, 25 Jul 2026 18:51:50 +0200

Linux may be the most secure OS available, but it can always use extra security. BastionGuard 2 promises some serious security.

One of these 13 gadgets could be the hero your junk drawer needs (here's why)

Sat, 25 Jul 2026 18:51:48 +0200

From tiny box cutters to bug-bite healers, these handy gadgets totally earn their place in your home for their form and function.

I fixed my home office's spotty Wi-Fi with Samsung's free diagnostic tool - and it took just minutes

Sat, 25 Jul 2026 18:51:45 +0200

A recent uptick in lag and disconnects led me to reevaluate my home office setup. Here's how I validated my solution.

YouTube für Smart TVs: Kommentare direkt am Smart TV abgeben – neue Funktion jetzt im Testlauf (Video)

Sat, 25 Jul 2026 17:02:29 +0200

Sehr viele Nutzer konsumieren YouTube nicht nur am PC oder Smartphone, sondern bekanntlich zu einem stark wachsenden Anteil auch am Smart TV. Google hat daher schon vor längerer Zeit einen Schwerpunkt auf die App für Google TV gesetzt und testet jetzt eine interessante neue Funktion: Einer unserer Leser konnte jetzt direkt am Smart TV per Fernbedienungs-Diktat Kommentare absetzen.

Mehr lesen: YouTube für Smart TVs: Kommentare direkt am Smart TV abgeben – neue Funktion jetzt im Testlauf (Video)

Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren

Der Beitrag YouTube für Smart TVs: Kommentare direkt am Smart TV abgeben – neue Funktion jetzt im Testlauf (Video) erschien zuerst auf GoogleWatchBlog.

New stable kernel for ext4 users

Sat, 25 Jul 2026 15:44:05 +0200

Greg Kroah-Hartman has released the 6.12.98 stable Linux kernel with a single fix for a file descriptor leak in ext4. Users of the ext4 filesystem should upgrade.

CVE-2026-43213 | Linux Kernel up to 6.18.15/6.19.5 wifi error_code null pointer dereference (Nessus ID 329305)

Sat, 25 Jul 2026 12:08:19 +0200

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.15/6.19.5. Affected by this issue is the function error_code of the component wifi. Executing a manipulation can lead to null pointer dereference. This vulnerability is handled as CVE-2026-43213. The attack can only be done within the local network. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2026-43226 | Linux Kernel up to 6.19.5 denial of service (Nessus ID 329305)

Sat, 25 Jul 2026 12:08:14 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.19.5. The impacted element is an unknown function. Such manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2026-43226. The attack can only be initiated within the local network. No exploit exists. You should upgrade the affected component.

CVE-2026-43283 | Linux Kernel up to 6.19.5 net dma_free_coherent buffer overflow (Nessus ID 329305)

Sat, 25 Jul 2026 12:08:05 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.19.5. This issue affects the function dma_free_coherent of the component net. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2026-43283. The attack is only possible within the local network. No exploit exists. You should upgrade the affected component.

CVE-2026-43167 | Linux Kernel up to 6.6.127/6.12.74/6.18.15/6.19.5 xfrm_dev_unregister reference count (Nessus ID 329305)

Sat, 25 Jul 2026 11:51:47 +0200

A vulnerability labeled as critical has been found in Linux Kernel up to 6.6.127/6.12.74/6.18.15/6.19.5. This impacts the function xfrm_dev_unregister. The manipulation results in improper update of reference count. This vulnerability is reported as CVE-2026-43167. The attacker must have access to the local network to execute the attack. No exploit exists. The affected component should be upgraded.

CVE-2026-43175 | Linux Kernel up to 6.12.74/6.18.15/6.19.5 clk rs9_driver_data out-of-bounds write (Nessus ID 329305)

Sat, 25 Jul 2026 11:51:42 +0200

A vulnerability was found in Linux Kernel up to 6.12.74/6.18.15/6.19.5. It has been declared as critical. This impacts the function rs9_driver_data of the component clk. The manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-43175. The attack needs to be approached within the local network. There is no available exploit. It is recommended to upgrade the affected component.

CVE-2026-43199 | Linux Kernel up to 6.12.74/6.18.15/6.19.5 net/mlx5e mlx5e_ipsec_init_macs information disclosure (Nessus ID 329305)

Sat, 25 Jul 2026 11:51:38 +0200

A vulnerability described as critical has been identified in Linux Kernel up to 6.12.74/6.18.15/6.19.5. Impacted is the function mlx5e_ipsec_init_macs of the file net/mlx5e. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-43199. The attack needs to be initiated within the local network. No exploit is available. Upgrading the affected component is recommended.

CVE-2026-43191 | Linux Kernel up to 6.19.5 denial of service (Nessus ID 329305)

Sat, 25 Jul 2026 11:51:33 +0200

A vulnerability classified as critical has been found in Linux Kernel up to 6.19.5. Impacted is an unknown function. This manipulation causes denial of service. This vulnerability is registered as CVE-2026-43191. The attack requires access to the local network. No exploit is available. It is recommended to upgrade the affected component.

CVE-2026-43205 | Linux Kernel up to 6.19.5 dpsw_get_attributes out-of-bounds write (Nessus ID 329305)

Sat, 25 Jul 2026 11:51:25 +0200

A vulnerability was found in Linux Kernel up to 6.19.5. It has been rated as critical. This affects the function dpsw_get_attributes. Performing a manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-43205. The attack needs to be approached within the local network. There is no available exploit. Upgrading the affected component is advised.

GE-Proton 11-3 brings better OptiScaler integration, AMD FSR4 improvements and lots of game fixes

Sat, 25 Jul 2026 11:14:37 +0200

GE-Proton 11-3 (and 11-2 just before) is a huge release for the popular compatibility layer for SteamOS / Linux.

Read the full article on GamingOnLinux.

Schwarz Digits eröffnet Campus mit 680-Quadratmeter-Mediensaal

Sat, 25 Jul 2026 10:16:32 +0200

Schwarz Digits, die IT- und Digitalsparte der Schwarz Gruppe, hat in Bad Friedrichshall ihren neuen Firmencampus eröffnet. Auf 15,5 Hektar Fläche bietet das „Home of Digits" verteilt auf fünf terrassenartig gestaffelte Gebäude Platz für bis zu ...

Increasing app discovery and engagement on Google TV

Sat, 25 Jul 2026 10:15:47 +0200

Posted by Paul Lammertsma, Developer Relations Engineer

With over 300 million monthly active devices across Google TV and Android TV, it’s clear that the living room is a massive, distinct platform for apps to accelerate growth. Today, we’re excited to share Google TV features and developer tools designed to increase the discoverability of your content and prepare your app for future TV experiences.

Drive discovery and engagement with Gemini

Last year, we brought our AI voice assistant, Gemini, to our platform, so that people can easily find what to watch, learn something new on the big screen, and get everyday tasks done with just their voice.

Since launch, we’ve made improvements to how Gemini provides tailored responses to questions. Gemini shares a mix of visuals, videos, and text to help users find what they need, when they need it. For our streaming partners, Gemini is a helpful discovery engine—pulling from your app's metadata to surface your relevant content to viewers.

Declare support for pointing modality

The TV experience that we once knew is changing. Gemini is changing the way we discover and stream content with voice, but how we use the remote is evolving, too.

Pointer remotes bring motion-controlled input to the big screen, unlocking faster user navigation across the Google TV Home page and within content-heavy apps. To ensure your app is ready for this shift and provides a great experience for all users, now is the time to start thinking about pointing input. Here’s how to get started:

1. Adapt your TV app UI Library

You’ll need support for hover states, scrollable containers, and cursor clicks to enable pointer remote interactions for your app on Google TV. While implementation varies by UI stack, Jetpack Compose streamlines this transition, as most core components handle these multi-modal interactions natively out of the box.

Hover state: Every focusable element on your screen (buttons, movie posters, setting toggles) needs a clear visual feedback mechanism for a hover state. This is often subtler than a focus state but critical for feedback.
Scrollable containers: Pointer remotes will also have a small circular touchpad for scrolling. Users can use this touchpad to scroll up or down, or left or right in your app. Your app will need to respond to touch events to scroll.
Cursor clicks: Many TV apps today expect a simple D-pad OKAY button “click.” With a pointer remote, a user may “click” on an element that’s not the D-pad focus state, but is instead from a hovered state (similar to a mouse click).

2. Test pointing interactions with a mouse today

To see how your app handles hover, scroll, and clicks, simply connect a bluetooth mouse or wired mouse to your Google TV. Keep in mind that a mouse has more precise control, since users are closer to the screen and typically rest the mouse in a stable position. Pointer remotes can often be less precise, since users are sometimes 10 feet away from the screen, making rough gestures with the remote from their couch. As a TV designer or developer, you can mitigate this lack of input precision by having larger hover targets for elements.

3. Declare TV app support for pointer remotes on Google Play

Finally, tell Google Play that your TV app is designed to work with a pointer. This ensures that users with pointer remotes will be able to easily find, install, and interact with your app.

Within your AndroidManifest.xml, declare the meta-data tag, android.software.leanback.supports_touch. This tag informs the platform that your TV app “spatially supports touch,” since pointer remotes simulate touch events from a distance.

AndroidManifest.xml

...

Tips:

The android.software.leanback feature declaration indicates that your app supports D-pad navigation and is intended for distribution only on TV devices via Google Play.
The new software attribute of android.software.leanback.supports_touch declares that in addition to D-pad, you have ensured that your TV app works well for pointer/cursor experiences via mouse (of today) and pointer remotes (of future).
If you haven't already, now is the time to adopt Jetpack Compose. Hover, scroll, and clicks are common input modalities that are supported on various form factors, and building your app with an adaptive UI framework enables code reusability and reduced maintenance.

Onboard the Engage SDK

The Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement.

Resumption: Partners can easily display a user's paused video within the 'Continue Watching' row from the Home page.
Entitlements: The Engage SDK streamlines entitlement management, which matches app content to user eligibility. Users appreciate this because they can enjoy personalized recommendations without needing to manually update all their subscription details. This allows partners to connect with users across multiple discovery points on Google TV.
Recommendations: The Engage SDK even highlights personalized recommendations based on content that users watched inside apps.

It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. To get started, head to goo.gle/engage-tv to learn more.

We're excited to see how our latest Gemini experience and developer tools will optimize your discovery and drive user engagement on our platform.

Explore this announcement and all Google I/O 2026 updates on io.google.

17 Things to know for Android developers at Google I/O

Sat, 25 Jul 2026 10:15:45 +0200

Posted by Matthew McCullough, VP, Product Management, Android Developer

Today at Google I/O, we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcements for Android developers; you can also see what was announced last week in The Android Show: I/O Edition. Stay tuned over the next two days as we dive into all of the topics in more detail!

Build High Quality Android Apps Using Agents

1: Android CLI: helping you build with any agent, LLM, and tool

Android CLI is now stable. It offers programmatic tools that allow any AI agent, including Claude Code, Codex, or Antigravity, to perform core Android tasks much more easily and efficiently. With today’s release, it also provides a bridge to tap directly into the "heavy-lifting" power of Android Studio to give you the production-ready polish needed for professional Android development. By leveraging the new android studio commands, developers can now grant their preferred agents the ability to perform semantic symbol resolution, analyze files for warnings, and even render Jetpack Compose previews. This release also enables official support for "Journeys" through new Android skills, which enables agents to execute end-to-end UI tests under your direction. Watch the developer keynote, and tune into the What’s New in Android tools talk for more information.

You can now easily install Android CLI for use with Google Antigravity 2.0.

2: Build production-ready apps with ease in Google AI Studio

Developers and creators can now build native Android apps, simply with a prompt in Google AI Studio. The apps are built with development best practices like Jetpack Compose, Kotlin, and APIs that leverage our recommended developer patterns. Google AI Studio enables developers to prototype, iterate via an embedded emulator, and deploy to physical devices without heavy local installations. Developers are then able to take those apps and share them to Android devices, as well as share them with others for testing through Google Play Console’s internal testing track. If a developer wants to prepare their app for a wider release, they’re able to take it to Android Studio for advanced debugging, testing, and UI polish. Watch the developer keynote, and tune into the What’s New in Android tools talk for more information.

Use the embedded Android Emulator to create Android apps in Google AI Studio

3: Accelerating AI coding assistance with Android Bench

Android Bench is our LLM leaderboard for Android development challenges. The goal is to accelerate model improvements, so you have more useful options for AI assistance. Many of you have been using open-weight models for AI assistance, so we’re now adding commonly used ones, such as Gemma 4, to the leaderboard, so you can see how LLMs that offer offline access and additional flexibility for power-users measure up. We're continuously working on increasing the difficulty of challenges we’re giving LLMs, to continue encouraging more useful improvements.

4: Convert iOS apps to Android with the Migration Assistant in Android Studio

The Migration Assistant in Android Studio is designed to port apps from platforms like iOS, React Native, or web frameworks to native Android. By simply selecting an existing project, developers can have the agent intelligently map features, convert assets like storyboards and SVGs, and implement Android best practices using Jetpack Compose and our recommended Jetpack libraries. This effectively transforms what used to be weeks of manual porting into a streamlined agentic workflow that only takes hours. We shared a preview of the incoming feature in the developer keynote.

A sneak peek of the Migration Assistant converting an iOS app into a native Android app

Building AI Into Your Apps

5: Building Intelligent Apps with generative AI

Generative AI enables you to create apps that are more intelligent, personalized, and agentic than ever before. This year, we introduced the latest advancements in on-device intelligence with a preview of Gemini Nano 4 for tasks like data extraction and summarization. We also expanded cloud capabilities via Firebase AI Logic, allowing developers to leverage Gemini models with robust grounding (including URL, Maps, and web search) to build smarter, more capable assistants. Furthermore, we unveiled our hybrid inference approach and the new Agent Development Kit (ADK) for Android, alongside communication protocols like AG-UI and A2UI that simplify the creation of autonomous, agentic experiences. To start integrating these powerful features, explore the developer documentation, and watch the technical deep dive session where we showcase all these technologies.

6: Experiment with AppFunctions today

AppFunctions is an Android platform API with an accompanying Jetpack library to simplify building Android MCP integrations. It empowers your apps to behave like on device MCP servers, contributing functions that act as tools for use by agents and assistants. AppFunctions integration with Gemini is currently in a private preview with trusted testers, and you can begin preparing your apps already. You can sign up for the Early Access Program and start experimenting using the API guidance, sample, and skill today.

The Future is Adaptive

7: Android is now Compose First; Views are now in maintenance mode.

Compose is our standard for UI development, and we are moving to a Compose-first approach for all future guidance and libraries. Building on five years of evolution, the latest releases deliver a more mature toolkit, from the highly customizable Styles API to refined shared element transitions and enhanced input support. These updates allow you to build beautiful, adaptive apps with less code and better performance. Learn more about what Compose-first means for Android Development in our blog post.

Build Android UI with Compose

8: Building seamless Android experiences across devices with Jetpack Compose

The Android ecosystem is now Adaptive by Default, moving fluidly across phones, foldables, tablets, cars, XR, and expanding usages with Googlebook and connected displays. With over 580 million large-screen devices, and users on multiple devices spending up to 14x more on apps, the investment in adaptive design presents a massive opportunity. Jetpack Compose is the definitive engine for this transition, offering core tools like our latest Jetpack Navigation 3 release, new experimental Grid and FlexBox layouts, enhanced non-touch input support, and CameraX for correct camera previews across any window size. Furthermore, new skills in Android Studio make updating your existing app to adopt these adaptive patterns easier than ever. Notability’s Android debut sets a new standard for premium productivity apps. Built with Jetpack Compose, Navigation 3, and Kotlin Multiplatform, it delivers an intuitive, adaptive experience across devices.

9: Create seamless experiences for Googlebook

Last week we announced Googlebook, a high-performance laptop that provides a large-screen canvas for your existing apps. Building with adaptive principles today helps ensure your app will work on Googlebook. Get started by reviewing relevant design guidance and developer guidelines for desktop experiences. Try out the new Desktop Emulator available in the Android Studio Canary to to test your apps for this form factor today.

New Desktop Android Emulator

10: Unified widget development experience with Jetpack Glance

Android 17 marks a shift toward a single, Compose-based development model for all widgets. By unifying the experience across mobile, Wear OS, and cars through Jetpack Glance, you can soon scale UI components across the ecosystem with a familiar workflow.

The breakthrough this year is the integration of RemoteCompose. On mobile and cars, it powers high-fidelity animations, while on Wear OS, it allows Wear Widgets (formerly Tiles) to render complex UI logic natively on remote surfaces. This ensures peak performance on low-power hardware while allowing a cohesive user journey—like checking a flight status on your car dashboard and seeing gate change updates on your wrist.

Four widgets are shown cycling through in the Android Auto interface. A clock, a contact card, Google Home favorites and a photo.

11: Expand your reach on the road with Android for Cars
To help you expand your reach when you build in-car experiences, we're making it easier to build once and deliver your apps to Android Auto and Android Automotive OS. With the latest releases of the Car App Library, you can build customized, distraction-optimized templated media apps for both platforms. We're introducing new components and template capabilities to give you increased flexibility and more options for laying out content. Parked experiences are expanding too, with immersive video playback coming to Android Auto for phones running Android 17. You can easily adapt your video apps for these parked experiences; apply now to the early access program to publish in these beta categories and learn more about the latest updates in our blog.

12: Accelerate your development with Android XR Developer Preview 4

Inspired by the innovative experiences you’ve built for the platform, we’re continuing to mature our tools with Developer Preview 4 of the Android XR SDK. A key milestone in this journey is the transition of our core libraries, XR Runtime, Jetpack SceneCore, and ARCore for Jetpack XR, moving to Beta soon to provide a more stable and performant foundation. We are also accelerating hardware access through the Android XR Developer Catalyst Program, where you can apply for XREAL’s Project Aura, audio glasses, or display glasses developer kits. Watch The latest in Android XR session or read our blog to see how these updates help you build experiences across the ecosystem.

Early preview of the Geospatial API in ARCore for Jetpack XR, enabling high-precision anchoring of digital content to real-world locations.

13: Android is your new home for professional-grade media experiences

Android 17 streamlines the entire media lifecycle with a production-ready toolkit. High-fidelity capture is now simplified with the CameraXViewfinder Composable, which handles complex scaling and responsiveness on foldables and tablets. For post-production, the new Media3 AI Effects library provides a single interface for premium features like Magic Eraser and Studio Sound, automatically optimizing for the device's hardware.

The pipeline is completed by CodecDB, offering chipset-specific encoding recommendations to eliminate export noise, and a new Scrubbing Mode in ExoPlayer for ultra-smooth seeking. Whether you’re compositing multi-asset edits with Media3 Transformer or using the streamlined CastPlayer API, these updates ensure a professional-grade experience with significantly less development overhead.

Low Light Boost and Magic Eraser in action

14: Increase app discovery and engagement on Google TV

Pointer remotes, which enable motion-controlled input, will be a future way for users to interact with Google TV as it unlocks faster user navigation. App developers can start declaring support for pointing input to ensure their apps are discoverable on future TVs with pointer remotes. Additionally, the Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement. It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. Get all the details in our blog.

15: Performance: the foundation of a great app experience

To help developers navigate memory limits in Android 17, we've launched a suite of optimization tools. The R8 Configuration Analyzer identifies keep rules that are bloating your binary, while ProfilingManager and the integrated LeakCanary in Android Studio streamline memory leak detection. Furthermore, the new Android Performance Analyzer offers advanced AI integration for complex trace analysis and automated SQL query generation to pinpoint performance bottlenecks.

And The Latest on Driving Business Growth

16: What’s new in Google Play

Today's updates from Google Play help expand your reach and scale your business with less complexity. We’re redefining Play Store discovery with an immersive, short-form video format called Play Shorts, while expanding your audience beyond the store with app discovery in the Gemini app on Android and web. Plus, we’re introducing powerful new capabilities like agentic catalog management for seamless bulk price and SKU updates, and using Gemini models to enable Play Console to pre-populate store listings from imported documents—making global localization effortless.

Gemini will provide users with app suggestions during a search

17: And of course, Android 17

Android 17 includes new performance & system architecture improvements (in addition to app memory limits) like a lock-free MessageQueue and a GC with more frequent, less intensive young-generation collections to ensure system-wide stability and smoother UIs. The new contact picker and eyedropper API help minimize the use of sensitive permissions and unnecessary access to user data.

Review the behavior changes to make sure your app is ready for Android 17, including background audio hardening and SMS OTP protection. Get ready to target Android 17 (API 37) with changes such as mandatory large-screen resizability, certificate transparency by default, and restricted local network access. You can start testing today by enrolling your device in the Beta or using the latest 17.0 emulator images.

One more thing. the third beta of our Android 17 quarterly platform release (QPR1) just came out, and it contains a minor SDK release to support a few features that just couldn't wait for QPR2.

Check out all of the Android & Play Content at Google I/O

This was just a preview of some of the updates for Android developers at Google I/O. Tune into What’s New in Android for the latest news and announcements and follow Google I/O for much more over the following week!

Building Premium Android Experiences at Google I/O ‘26

Sat, 25 Jul 2026 10:15:42 +0200

Posted by Ataul Munim, Android Developer Relations Engineer

A truly differentiated Android experience is about delivering premium delight wherever your users are. At Google I/O ‘26, we showcased how the latest advancements in the Android ecosystem can help you elevate your app's quality while maximizing development efficiency.

To help you build apps that stand out, we're diving into the key tools and libraries designed to optimize your core performance, extend the surfaces of your app to other devices, and streamline how your app handles high-quality media.

Here is a recap of the essential updates and sessions you need to know to deliver a next-level experience across form factors!

Maximize app performance and ROI with the R8 Configuration Analyzer

A premium experience is only as good as its foundation, and a performant foundation is what allows your app to scale across the Android ecosystem. This is especially true with the release of Android 17, which introduces conservative, device RAM-based app memory limits to target extreme memory leaks and outliers before they cause system-wide instability. To stay below these new system thresholds and prevent your app from being terminated, having a lean footprint is no longer optional: it’s a critical requirement.

This year, we’re making it easier to build highly optimized, fast apps by introducing the R8 Configuration Analyzer in Android Studio. R8 is your most powerful tool for improving app performance, but its effectiveness is often limited by overly broad "keep rules" that prevent the compiler from stripping away unused code. The new Configuration Analyzer provides optimization, obfuscation, and shrinking scores, allowing you to identify specific rules that are preventing the benefits of R8 optimization.

By optimizing their R8 configurations, developers at Monzo achieved a 30% improvement in cold starts and a 35% reduction in ANRs. Smaller, faster code isn't just about efficiency; it's about ensuring your app has the memory headroom to deliver delight on every form factor, from the phone to the car.

Extend your reach with a unified approach to Widgets on Phones, Watches and Cars

User interaction is shifting toward quick, glanceable moments—short bursts of information that keep users connected without needing to open the full app. To help you increase the reach of your app content, we are unifying the development experience across the Android ecosystem with Jetpack Glance. By using a consistent, Compose-based model, you can elevate the content most important to your users straight to the phone’s home screen, Wear Widgets (previously Tiles!), and cars with a familiar workflow.

In order to help users engage with your content and features, even outside your app, we are making widgets more expressive and adaptive with RemoteCompose. On Wear OS, RemoteCompose allows you to use the Compose tools you’re already comfortable with to define UI logic that renders natively on remote surfaces, ensuring that your glanceable experiences remain highly performant and responsive even on resource-constrained hardware. On mobile and cars, RemoteCompose is used as a new framework giving Widgets new expressive capabilities.

You can use Jetpack Glance (together with RemoteCompose on Wear) to deliver a cohesive user journey. Whether it’s viewing flight status on the car dashboard, checking a gate change on a watch, or managing a boarding pass from a phone widget, this shared approach maximizes your app’s presence while keeping your development effort focused and efficient.

Supercharge your media pipeline with a complete, production-ready toolkit

Android has become a world-class home for the entire media lifecycle, and we are simplifying the journey from the first capture to the final playback. By leveraging Jetpack CameraX and Media3, you can build professional-grade experiences that feel native across the entire ecosystem.

It starts with high-fidelity capture using the CameraXViewfinder Composable, which ensures your preview remains perfectly scaled and responsive on any form factor, including foldables and tablets. Use this to build adaptive capture experiences like a picture-in-picture view for multi-tasking, or that take advantage of modern features like high-frame-rate or slow-motion capture with CameraX v1.5.

The new Media3 AI Effects library will provide a unified interface for premium features like Image & Video Enhance, Magic Eraser, and Studio Sound. This allows you to focus on the creative intent while Media3 handles the heavy lifting of choosing the most efficient and reliable path for the device. Then, use the latest improvements in multi-asset editing with Media3 Transformer to composite your edited videos together!

Complete the pipeline with tools designed for professional-grade export and viewing, including:

CodecDB, which offers data-driven encoding recommendations tailored to specific chipsets, ensuring your exported videos maintain high visual quality with minimal noise or blurriness
Scrubbing Mode in ExoPlayer to provide the buttery-smooth seeking experience users expect from premium media apps
Enhanced Cast support with the new CastPlayer API in Media3

By unifying these technical pillars, you can build a cohesive, high-performance media journey that delivers both delight for your users and high ROI for your development team.

For more details, check out the premium Android experience YouTube playlist.

Android 17 is here

Sat, 25 Jul 2026 10:15:36 +0200

Posted by Matthew McCullough, VP of Product Management, Android Developer

Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.

Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the Android Open Source Project (AOSP). This allows you to examine the source code for a deeper understanding of how Android works.

Let's dive deeper into Android 17.

An intelligence system

With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the Model Context Protocol. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.

The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.

/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}

We’ve also launched an AppFunctions agent skill that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.

The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a test agent app that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at goo.gle/eap-af for a chance to be among the first apps to deploy AppFunctions to production.

Adaptive-first

Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over 580 million large screen devices in the hands of users and the forthcoming launch of Googlebooks, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an adaptive-first development standard.

No resizability/orientation restrictions on large screens

To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on large screen devices (sw > 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on app category in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.

Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP

Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:

App Bubbles: Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.
The Bubble Bar: On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.
Desktop interactive PiP: In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.

App Bubbles and Bubble Bar in action

Activity recreation updates

To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including CONFIG_KEYBOARD, CONFIG_KEYBOARD_HIDDEN, CONFIG_NAVIGATION, CONFIG_TOUCHSCREEN, and CONFIG_COLOR_MODE).
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new android:recreateOnConfigChanges manifest attribute.

Continue On

Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.

Handoff Suggestion on a Tablet

class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}

Go adaptive-first with Jetpack Compose

To help you adapt your apps to meet the new Android 17 requirements, we've launched the Jetpack Compose adaptive skill. This AI-powered developer workflow helps you implement the best adaptive practices:

Adaptive navigation: Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.
Multi-pane layouts: Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.
FlexBox & Grid APIs: Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.
Advanced non-touch input: Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.
Dynamic window states: Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.

Android is Compose-first

Compose offers the easiest way to build adaptive apps, and that's just one of the many reasons we believe that all Android UI should be built with Compose. To that end, Android development is now Compose-first. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.

TIP
Ready to migrate? Use our AI-driven XML to Compose Migration Skill to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.

Performance & efficiency

App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.

App memory limits

Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking.

Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:

R8 Optimizer: The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new R8 configuration analyzer to make sure your app is getting the most from R8.

The R8 Configuration Analyzer

LeakCanary in Android Studio Panda: The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.
ApplicationExitInfo: If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".
On-Device Anomaly Detection: Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.

val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)

And, we're working to surface more in-field memory metrics to you within Google Play Console.

Generational garbage collection

Android 17 introduces more frequent, less resource-intensive young-generation collections to ART's Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.

Lock-Free MessageQueue

For apps targeting SDK 37 or higher, the core android.os.MessageQueue now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private MessageQueue fields and methods. The peekWhen and poll APIs have been added to TestLooperManager for instrumentation testing without relying on MessageQueue internals.

Static final fields now truly final

Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s SetStaticField methods family will immediately crash the application.

Custom notification view restrictions

To reduce memory usage we are further restricting the size of custom notification views. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.

Privacy & Security

Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.

Privacy-preserving choices

Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:

System-Level Contact Picker: Utilizing ACTION_PICK_CONTACTS, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad READ_CONTACTS permission. It also fully supports work/personal profile separation.
Customizable Photo Picker aspect ratio: UsingPhotoPickerUiCustomizationParams, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.
System-rendered Location Button: A new system-rendered location button that you can embed in your app grants precise location access for the current session only.
EyeDropper API: A new system-level API, ACTION_OPEN_EYE_DROPPER, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.

val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}

Picking a color from anywhere on the screen with the system EyeDropper

Local network access

Apps targeting Android 17 now either require the ACCESS_LOCAL_NETWORK runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because ACCESS_LOCAL_NETWORK falls under the existing NEARBY_DEVICES permission group, users who have already granted other NEARBY_DEVICES permissions will not be prompted again.

SMS OTP protection

Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:

WebOTP Format: Delayed for all apps that are not the intended recipient (domain mismatch).
Standard SMS OTP: Delayed for all apps targeting SDK 37+.
Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the SMS Retriever or SMS User Consent APIs.

Post-Quantum Cryptography (PQC)

Android 17 is ready for the next generation of cryptographic security:

Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.
Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.

Safer native dynamic code loading

If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError

Smarter password protection for physical inputs

With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.

Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).

These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields.

Smarter password protection for physical inputs

Media and camera features that empower creators and delight users

Android 17 introduces new creator features that give access to pro-quality cameras and media, all while improving the experience for consumers.

Eclipsa Video: HDR video standard built upon the SMPTE ST 2094-50 specification that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.
RAW14 image format: New support for the RAW14 image format provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.
Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.
Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.
Versatile Video Coding (H.266): Enables OEMs to add codec support by defining the video/vvc MIME type in MediaFormat, adding new VVC profiles in MediaCodecInfo, and integrating support into MediaExtractor.
Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.
Constant Quality for Video Recording: SetVideoEncodingQuality in MediaRecorder configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.

Better support for hearing aids

Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new AudioDeviceInfo.TYPE_BLE_HEARING_AID constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.
Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.

CameraX and Media3

CameraX and Media3 have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture, smooth media playback, and creative and complex editing experiences.

We've released an agent skill that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.

Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.

Get your apps, libraries, tools, and game engines ready!

If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.

Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps running on and targeting Android 17 to focus your testing, including the following:

Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints on large screens.
Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.
Enable CT by default: Certificate transparency (CT) is enabled by default. (On Android 16, CT is available but apps had to opt in.)
Local network protections: Apps targeting SDK 37 or higher have local network access blocked by default. Switch to using privacy preserving pickers if possible, and use the new ACCESS_LOCAL_NETWORKpermission for broad, persistent access.
Background audio hardening: Starting in Android 17, the audio framework enforces restrictions on background audio interactions including audio playback, audio focus requests, and volume change APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the updated guidance.
NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare FEATURE_NEURAL_PROCESSING_UNIT in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the LiteRT NPU delegate, vendor-specific SDKs, as well as the deprecated NNAPI.

Get started with Android 17

Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can use the 64-bit system images with the Android Emulator in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.

Getting the Android 17 beta on partner devices

Android 17 is available in beta on handset, tablet, and foldable form factors from partners including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.

For the best development experience with Android 17, we recommend that you use the latest Canary build of Android Studio Quail. Once you’re set up, here are some of the things you should do:

Test your current app for compatibility, learn whether your app is affected by changes in Android 17, and install your app onto a device or Android Emulator running Android 17 and extensively test it.

Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.

For complete information on Android 17 please visit the Android 17 developer site.

Android developer verification: Building a safer ecosystem together

Sat, 25 Jul 2026 10:15:33 +0200

Posted by Matthew Forsythe, Director Product Management, Android App Safety

July 15, 2026: Updated Play Console requirements for Play developers

To meet Android developer verification and updated Play Console Requirements, Play developers must register their Play apps in Play Console. While 99% of apps on Play have been registered automatically, you should check your Play Console Home page to register any remaining apps by September 30, 2026 to avoid global removal from Google Play and ensure a seamless user installation experience.

You can also use Play Console to register apps you distribute outside of Google Play to ensure they can be installed on certified Android devices.

Last year, we introduced Android developer verification to strengthen ecosystem security and stop malicious actors from hiding behind anonymity to release harmful apps. Millions of apps have been registered since the verification launched in March, covering nearly all installs on Google Play and a large majority of installs from outside of Google Play. We appreciate the feedback and partnership from industry leaders, developers, and Android communities that helped us design this experience and drive strong adoption.

Initial launch across seven stores and four countries

These new developer verification protections will take effect on September 30, 2026, starting with users in Brazil, Indonesia, Singapore, and Thailand.

This rollout is an industry-wide effort to create a safer ecosystem. We will begin by verifying app installations from the following stores:

Google (Google Play)
Honor (HONOR App Market)
OPlus (OPPO App Market)
Samsung (Galaxy Store)
Transsion (Palm Store)
vivo (V-Appstore)
Xiaomi (GetApps)

Following this initial phase with our partners, we will expand these protections globally for all apps on certified Android devices in 2027.

Automate your workflow with new APIs

To further streamline app registration, we are launching a suite of developer-requested APIs to help you register apps in bulk or directly through your continuous integration and deployment (CI/CD) pipelines. The Android Developer ID Status API will let you check if a package name has already been registered, and the Android Developer Console API will let you register and manage package names directly within your development environment. Both APIs also support OAuth delegation, allowing third-party platforms, like Android app stores, to perform these operations natively on your behalf.

We'll launch these APIs over the next few months.

What’s next

June 2026: Starting this month, we are rolling out a new system service that will be automatically installed on most Android devices. This service will be used later this year to verify developer registration.
July 2026: We’ll launch the Android Developer ID Status API globally and begin early access for the Android Developer Console API. Early access also starts for limited distribution accounts on Android Developer Console. This new type of Android developer account is designed for students, hobbyists, and learners and lets you share your apps to up to 20 devices without a government-issued ID or a fee.
August 2026: Limited distribution accounts and the new Android Developer Console API will launch globally. We’ll also launch an advanced flow for installing apps from unverified developers, which includes security checkpoints to resist coercion scams, while allowing power users to maintain the ability to sideload apps from unverified developers.
September 30, 2026: App registration becomes required for participating stores in Brazil, Indonesia, Singapore, and Thailand. Unregistered apps can be sideloaded with Android Debug Bridge (adb) or advanced flow.
2027 and beyond: After incorporating the feedback from our partners, users, and developer community, we’ll expand the Android verification requirement globally.

Get started with Android developer verification

If you distribute apps in Brazil, Indonesia, Singapore, or Thailand via the stores listed above, please ensure your verification is complete by the September deadline.

Google Play developers: Most Play developers are already verified, and over 99% of their apps have been registered. Go to your Play Console Home page to see your app’s verification status, and register apps you want to continue distributing that weren't automatically registered.
Developers who distribute only outside of Google Play: Sign up for the Android Developer Console today to register your apps.

Students and hobbyists: Sign up here for early access to limited distribution accounts to help us refine the feature with your feedback.

Thank you for helping us build a safer Android ecosystem. Stay tuned for more updates as we approach September and the 2027 global rollout.

Schwarz Digits eröffnet Campus mit 680-Quadratmeter-Mediensaal

Sat, 25 Jul 2026 10:15:02 +0200

Valve Will Finally Let You Build Your Own Steam Machine With SteamOS For Desktop

Sat, 25 Jul 2026 10:12:56 +0200

With the price of the new Steam Machine starting at $1,049, you might want to consider making your own Steam Machine instead. An anonymous reader quotes a report from The Verge: Valve says that "starting with the SteamOS 3.8 release, you can put together your own Steam Machine using whatever PC parts you want." SteamOS 3.8.10 launched last week with a slew of updates, including "improved compatibility with recent Intel and AMD platforms." Alongside that improved compatibility, Valve is giving gamers the green light to install SteamOS on their own desktops. In an interview with The Verge, Valve's Pierre-Loup Griffais said Valve has been "rolling out improvements to [SteamOS] so it's more compatible with desktop hardware," including eventual support for Nvidia graphics. Griffais says Valve has "a growing team" working on Nvidia driver support for SteamOS, adding, "We're collaborating with Nvidia very closely." While he mentioned that Nvidia support might not come this year, Griffais emphasized that "it's certainly something that we're working on in the background." It's technically been possible to run SteamOS on your own hardware for a while now, but compatibility has been mostly limited to AMD systems. So far installing it has also required using a Steam Deck recovery image, a process that, speaking from experience, is much less straightforward than the installation process for most other Linux distributions. Trying to run SteamOS on Intel or Nvidia hardware has not been easy so far. According to Griffais, Valve is working to change that, which could mean that down the line, you'll be able to run SteamOS on just about any gaming PC hardware you want, including Nvidia. For the more immediate future, Griffais says SteamOS in its current state should offer a "good experience" on console-like PC setups: "If you have something that is similar to the use case of a Steam Machine, where you have a PC that's gonna be plugged into a TV, and has a single hard drive that you're not going to try and dual boot [] you can put SteamOS on there, and you'll have an experience that is very similar to a Steam Deck docked or a Steam Machine, with some caveats, of course," like a lack of HDMI-CEC support. But "the core bits of the experience are there. The SteamOS graphics driver, the shader precompilation [...] you can get at all of that with the SteamOS." Griffais says SteamOS does not yet offer an easy way to dual-boot alongside Windows or another operating system, but envisions "a time where it's a better experience to install on your desktop and have it coexist with a different operating system."

Read more of this story at Slashdot.

Linux Foundation Launches Akrites To Coordinate AI-Driven Open Source Security

Sat, 25 Jul 2026 10:12:54 +0200

BrianFagioli writes: The Linux Foundation has announced Akrites, a new initiative to coordinate vulnerability disclosure and remediation for critical open source software as AI dramatically speeds up vulnerability discovery. Founding members include AWS, Google, Microsoft, OpenAI, Red Hat, NVIDIA, IBM, Cisco, JPMorganChase, and others. Akrites will provide a shared Security Incident Response Team (SIRT), a standardized coordinated vulnerability disclosure process, and act as a "maintainer of last resort" for abandoned but widely used packages. The goal is to reduce duplicate reports, avoid conflicting patches, and help upstream maintainers address vulnerabilities before they can be exploited. As AI makes it easier to find security flaws, can a coordinated industry effort help protect open source, or does it risk giving large corporations too much influence over the ecosystem? "Akrites is the largest coordinated effort in history to create systems and deploy tooling that leverages the collective power of the community to make everyone safer," the Linux Foundation said in an open letter. "Akrites participants will contribute engineering resources; work to build and ship fixes; or fund the engineers who do. Some companies have contributed mightily already. The reality is, collectively, we need to contribute more."

Read more of this story at Slashdot.

Decades-Old Bash Tricks Expose AI Coding Agents To Supply Chain Attacks

Sat, 25 Jul 2026 10:12:50 +0200

Slashdot reader wiredmikey writes: AI security researchers have uncovered a structural security flaw dubbed GuardFall that allows decades-old Bash shell tricks to bypass safeguards in most open source AI coding agents. By exploiting shell behaviors such as quote removal and variable expansion, attackers can hide malicious commands in repositories, README files, Makefiles, or other content consumed by AI agents. If executed — particularly in auto-approve or CI environments—the commands can steal credentials, compromise developer systems, or enable software supply chain attacks. According to researchers at Adversa AI, the 11 popular open source AI coding agents tested, only one successfully blocked all of the Bash trick techniques.

Read more of this story at Slashdot.

Ask Slashdot: Which Apps Aren't Available on Linux?

Sat, 25 Jul 2026 10:12:48 +0200

Have you ever needed a Linux application which only exists in the Windows world? Long-time Slashdot reader BrendaEM writes: Windows does have a lot of useful app (but smaller than "power apps"). Some of these are closed source, some are open, but they're not all available in Linux yet. My list would have to contain Gimp Tookit versions of: IrfanView image manager, which I think is unequaled in Linux (though it does work to some extent under Wine). I also miss the full version of 7-Zip, because of its better compression settings, which File-Roller does not provide, though the Linux port p7zip is available (though unnoticed by common distributions). Lastly, I think that Notepad++ would be a good addition to Linux. That last one drew some pushback from long-time Slashdot reader jesco. "If there's one area where Linux shines, then it's the availability of high-quality text editors. Last time I looked Kate was still pretty nice, and there's Emacs, Vim and Neovim" if you're partial to command lines. But are there any daily-drive apps you still find yourself needing? Share your own thoughts in the comments. Which apps aren't available on Linux?

Read more of this story at Slashdot.

Valve Releases Proton 11 With Huge Linux Gaming Improvements

Sat, 25 Jul 2026 10:12:46 +0200

BrianFagioli writes: Valve has released Proton 11.0-1, a major update to its Windows compatibility layer for Linux that makes more games playable while fixing a long list of bugs affecting existing titles. The release restores compatibility for many EA games after a recent EA App update, moves classics like Resident Evil (1996), Resident Evil 2 (1998), Dino Crisis, and SHOGUN: Total War from Proton Experimental into the stable release, and adds support for games including Gothic 1 Classic, X-Plane 12, Breath of Fire IV, and Deadly Premonition. Valve also fixed crashes in HELLDIVERS 2, restored No Man's Sky VR support, improved Steam Overlay compatibility with EA games, addressed KDE and GNOME desktop issues, and rebased Proton on Wine 11.0 with updated graphics components. The full list of changes can be found here.

Read more of this story at Slashdot.

Windows Drops Under 60% in Global Desktop OS Share

Sat, 25 Jul 2026 10:12:44 +0200

StatCounter's June 2026 data shows Windows made up 56.55% of global desktop OS usage, dropping Microsoft's share below 60% for the first time in years. Linux, meanwhile, reached 4.39%, "one of its strongest recent showings in the company's desktop OS statistics," reports Linuxiac. From the report: Apple's desktop platforms also remain a major part of the picture. StatCounter lists OS X at 11.89% and macOS at 4.48% for June 2026, meaning Apple's combined desktop presence remains comfortably ahead of Linux in the global chart. Chrome OS follows with 1.21%. Of course, StatCounter's numbers should be read for what they are: web usage statistics, not a direct count of installed operating systems. The company calculates its Global Stats from page views across websites using its tracking code, analyzing details such as browser, operating system, and screen resolution. In other words, the figures reflect measured web activity rather than the number of machines actually installed worldwide.

Read more of this story at Slashdot.

Google Hands Open Health Stack To the Linux Foundation

Sat, 25 Jul 2026 10:12:42 +0200

BrianFagioli writes: The Linux Foundation intends to launch the Open Health Stack Software Foundation, a new vendor-neutral home for the Google Open Health Stack project. Google is contributing the project code and assets while Google.org is providing a $3 million grant. The initiative is also backed by Microsoft, Anthropic, and the World Health Organization, with the goal of building open source, AI-ready digital health infrastructure. Will moving the project under Linux Foundation governance accelerate adoption, or is this simply another foundation that most developers will never interact with? The new project will focus on core HL7 FHIR technologies for healthcare interoperability, the Open Health Stack Player deployment toolkit, and AI Commons -- a model-agnostic healthcare AI initiative being co-developed with the World Health Organization. A notable part of the announcement is its planned Implementer Program, which aims to give startups, small businesses, and local developers in low- and middle-income countries a formal role in governance. In other words, the effort is not just about building healthcare software standards, but about making sure the people implementing them in underserved markets help shape the project too.

Read more of this story at Slashdot.

Linus Torvalds on AI, Junk Patches, Humans, and Godzilla

Sat, 25 Jul 2026 10:12:40 +0200

Linus Torvalds once said LLMs might bring a 10X increase to programmer productivity. But speaking at Open Source Summit India 2026, he now says that number was "not scientific," reports ZDNet. "That was pulled out of my ass number, obviously." Today, he continued, "we're at the point where hopefully it creates more productivity than it takes away," but "we certainly saw more junk being generated by LLMs than we saw useful code up until the like early this year.... it can actually be a huge drain on resources when it takes humans a lot of effort to figure out that, hey, this machine-generated report was not true." Even now, he said, "most of the good ones require more than just the LLM," because "we've had to push back quite a bit... if you find a bug with an LLM, it's not enough to just ask the LLM to make a bug report and then throw it over the fence to us. We want to see a suggested patch; we want to see the human who ran the LLM act as a kind of back-and-forth." Torvalds described many AI-generated patches as "mindless band-aid kind of patches... they may fix the immediate problem, but the kind of bug remains, and it just is waiting in the hallway to hit you in another place." For his own toy projects, he uses LLMs as prototypers: "I use them as a way to prototype things... quite often the code is not usable in that form, but it's a great way to try something out," while insisting that for kernel-level fixes, "LLMs, in my experience, have not been at that level yet." Torvalds acknowledged that some AI-found issues have been "absolutely, stunningly, I mean, interesting in a painful kind of way," especially security problems that "show up in the technology press two days later." Despite the embarrassment, he said, "I'm very much not a shoot-the-messenger kind of person. I think we're much better off with LLMs finding bugs, even when they are embarrassing, and they are things that we should probably have found two decades ago." Torvalds also said he's using AI "for my own toy projects... Every time I travel to some new place, and this is the first time I've been to India, I send the kids pictures of where I am, and for some strange reason, Godzilla seems to follow me around and gets added to those pictures." ZDNet notes that Torvalds concluded, "There are many useful and less useful uses for AI," and "I think Godzilla is a great place to stop." Thanks to Slashdot reader joshuark for sharing the article.

Read more of this story at Slashdot.

Linus Torvalds on Rust, C, Bugs, and AI Patch-Checking Tools

Sat, 25 Jul 2026 10:12:38 +0200

"Git and email are the two really only tools I use," Linus Torvalds said at Open Source Summit India 2026. But ZDNet reports that he also shared his thoughts on Rust, C, and patch-checking tools: "I use Google as a way to look things up." He added, "I'm unusual; most of the other maintainers end up using many more tools, and I think a lot of them are starting to use AI tools for patch checking," while he "works at a higher level. I work with people, not tools." When asked about Rust both in Git and the kernel, he pushed back against hype: "I'm not sure Rust is going to take over the world. I still think Rust is very interesting, [but] I still find C to be a much simpler tool." Torvalds continued, "I'm much more excited about all the tools we have for verification of C," including "automated patch verification tools" and "automated email checking tools for patches like Sashiko." Summing up, Torvalds told the Mumbai audience: "I'm more of a hack-and-slash kind of person, and I still like the raw and simple power of C, and I don't think that's going to change." Torvalds also warned against overestimating Rust's benefits: "Rust fixes a few easy bugs that you can make in C, but it does not fix the logic errors, right? It does not think for you, and when you write incorrect code, the language does not matter. The end result will be incorrect." On mixed C/Rust code bases, he pointed out that guarantees are limited: "The guarantees that Rust give you only apply in the Rust-only parts of your code base, and wherever you interact with C code, all bets are off," with most Rust code in Linux talking to "core kernel C code" that is "much better quality... because that code has been tested in every single environment." At the same time, Torvalds pointed out, "some of our big and more high-profile bugs in the kernel lately have been logic errors" rather than the kind of memory errors Rust prevents. "It was just bad programming, which sadly happens even in carefully maintained subsystems and important kernels that are supposed to be very secure."

Read more of this story at Slashdot.

Linus Torvalds To Critics of AI Coding On Linux: 'Fork It. Or Just Walk Away.'

Sat, 25 Jul 2026 10:12:30 +0200

Linus Torvalds says the Linux kernel will not ban AI-assisted coding tools, and if anti-AI absolutists have a problem with that, they can "fork it" or "walk away." An anonymous reader quotes a report from Ars Technica: Writing in a lengthy post on the Linux kernel mailing list this week, Torvalds said that "Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away." The statement came amid a lengthy thread arguing about the use of Sashiko, an "agentic Linux kernel code review system" that its creators claim can, in tests, independently find 53.6 percent of the bugs that would end up being fixed by human coders in later commits. But the tool can also waste maintainers' time by sending "false positive" reports of bugs that don't exist, at a rate Sashiko's maintainers estimate is "well within [the] 20% range." In discussing whether maintainers should be subjected to a flood of these kinds of automated, AI-powered bug report emails (true or false), one poster cited the Software Freedom Conservancy's recent statement that the open source community "should support, not just tolerate, those who outright reject LLM-gen-AI systems" and that "every FOSS contributor deserves self-determination regarding LLM-gen-AI." In the face of that statement, Torvalds said that he rejects those who demand that their open source projects not accept any LLM-generated code or revisions. "We're not forcing anybody to use [LLM tools], but I will very loudly ignore people who try to argue against other people from using it," Torvalds said. Torvalds said his position on this is a pragmatic one that's "based on technical merit. Not fear of new tools." And when it comes to utility, Torvalds said that "AI is a tool, just like other tools we use. And it's clearly a useful one. It may not have been that 'clearly' even just a year ago, but it's no longer in question today. Anybody who doubts that clearly hasn't actually used it." [...] While Torvalds acknowledged that "AI isn't perfect," he urged detractors to compare the output of these tools to the performance of human code maintainers. "Anybody who points to the problems at AI had better be looking in the mirror and pointing at themselves at the same time," Torvalds wrote. "Because it's not like natural intelligence is always all that great either."

Read more of this story at Slashdot.

Rust Will Help Linux Succeed and Makes Coding Fun, Says Greg Kroah-Hartman

Sat, 25 Jul 2026 10:12:26 +0200

ZDNet reports on June's Open Source Summit India 2026 in Mumbai, where Linux stable kernel maintainer Greg Kroah-Hartman gave a talk titled "Rust and Linux: How the Rust Language is Going to Help Linux Succeed." Kroah-Hartman said in his keynote that "the [Linux] kernel is moving toward Rust. Git is moving toward Rust. Lots of projects are starting to move toward Rust." He didn't always feel that way. Kroah-Hartman added, "A number of years ago, when a friend of mine said, 'Ah, you got to try this new language. It's called Rust.' I was like, 'What? No, C is great.' His friend continued, "'No, no, no! It makes programming fun again.' I'm like, 'Nah, programming is fun in C.' He was right. I should have done it then. Rust is actually fun. It makes programming fun. It takes a lot of stuff away from having to worry about the compiler, which can fix a lot of your problems for you, and it makes code a little bit better." So, Kroah-Hartman has moved from being a Rust skeptic to one of its strongest champions inside the kernel. He now regards Rust as a permanent part of Linux, not an experiment. His case is straightforward: Rust's ownership and type system can eliminate most of the "stupid little tiny things" that dominate kernel Common Vulnerabilities and Exposures (CVEs), while making life easier for overworked maintainers. "Rust," in short, "makes my life so much easier...." In India, he said Linux sees "about 13 CVEs a day" and has been running at "almost nine changes an hour" for a decade or more. Most of those vulnerabilities, he argued, are not exotic attacks but simple C mistakes — unchecked pointers, forgotten unlocks, and sloppy cleanup paths: "This is what we're fixing 13 times a day. Small, trivial, little bugs like this all the time.... I've seen every CVE the kernel has done in the past 25 years. I think 80% would be gone, just because they would be caught by Rust." The remaining 20% are the logic bugs he'd prefer to focus on...." Moreover, Rust is becoming the default for new work in key subsystems. "New drivers for some subsystems are only going to be accepted in Rust...." he said. Binder, the Android IPC mechanism at the heart of billions of devices, now has parallel C and Rust implementations in the kernel. The C version "will go away soon," leaving the Rust version "as the bedrock of all Android devices going forward."

Read more of this story at Slashdot.

(g+) Von Apple zu Linux: Alter Mac statt teurer Neukauf

Sat, 25 Jul 2026 10:09:28 +0200

Macs eignen sich oft hervorragend für Linux. Worauf beim Umstieg zu achten ist und welche Distributionen sich anbieten. Ein Ratgebertext von Antonio Zambito (Linux, Apple)

Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider

Sat, 25 Jul 2026 09:19:52 +0200

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this advisory in response to ransomware actors leveraging unpatched instances of a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) to compromise customers of a utility billing software provider. This incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp RMM since January 2025.

SimpleHelp versions 5.5.7 and earlier contain several vulnerabilities, including CVE-2024-57727—a path traversal vulnerability.¹Ransomware actors likely leveraged CVE-2024-57727 to access downstream customers’ unpatched SimpleHelp RMM for disruption of services in double extortion compromises.¹

CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 13, 2025.

CISA urges software vendors, downstream customers, and end users to immediately implement the Mitigations listed in this advisory based on confirmed compromise or risk of compromise.

Download the PDF version of this report:

AA25-163A Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (PDF, 420.49 KB )

Mitigations

CISA recommends organizations implement the mitigations below to respond to emerging ransomware activity exploiting SimpleHelp software. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. These mitigations apply to all critical infrastructure organizations.

Vulnerable Third-Party Vendors

If SimpleHelp is embedded or bundled in vendor-owned software or if a third-party service provider leverages SimpleHelp on a downstream customer’s network, then identify the SimpleHelp server version at the top of the file /SimpleHelp/configuration/serverconfig.xml. If version 5.5.7 or prior is found or has been used since January 2025, third-party vendors should:

Isolate the SimpleHelp server instance from the internet or stop the server process.
Upgrade immediately to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerability advisory.²
Contact your downstream customers to direct them to take actions to secure their endpoints and undertake threat hunting actions on their network.

Vulnerable Downstream Customers and End Users

Determine if the system is running an unpatched version of SimpleHelp RMM either directly or embedded in third-party software.

SimpleHelp Endpoints

Determine if an endpoint is running the remote access (RAS) service by checking the following paths depending on the specific environment:

Windows: %APPDATA%\JWrapper-Remote Access
Linux: /opt/JWrapper-Remote Access
MacOs: /Library/Application Support/JWrapper-Remote Access

If RAS installation is present and running, open the serviceconfig.xml file in /JWrapper-Remote Access/JWAppsSharedConfig/ to determine if the registered service is vulnerable. The lines starting with indicate the server addresses where the service is registered.


SimpleHelp Server
Determine the version of any SimpleHelp server by performing an HTTP query against it. Add /allversions (e.g., https://simple-help.com/allversions) to query the URL for the version page. This page will list the running version.
If an unpatched SimpleHelp version 5.5.7 or earlier is confirmed on a system, organizations should conduct threat hunting actions for evidence of compromise and continuously monitor for unusual inbound and outbound traffic from the SimpleHelp server. Note: This is not an exhaustive list of indicators of compromise.

 Refer to SimpleHelp’s guidance to determine compromise and next steps.³
Isolate the SimpleHelp server instance from the internet or stop the server process.
Search for any suspicious or anomalous executables with three alphabetic letter filenames (e.g., aaa.exe, bbb.exe, etc.) with a creation time after January 2025. Additionally, perform host and network vulnerability security scans via reputable scanning services to verify malware is not on the system.
Even if there is no evidence of compromise, users should immediately upgrade to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerabilities advisory.⁴

If your organization is unable to immediately identify and patch vulnerable versions of SimpleHelp, apply appropriate workarounds. In this circumstance, CISA recommends using other vendor-provided mitigations when available. These non-patching workarounds should not be considered permanent fixes and organizations should apply the appropriate patch as soon as it is made available.
Encrypted Downstream Customers and End Users
If a system has been encrypted by ransomware:

Disconnect the affected system from the internet.
Use clean installation media (e.g., a bootable USD drive or DVD) to reinstall the operating system. Ensure the installation media is free from malware.
Wipe the system and only restore data from a clean backup. Ensure data files are obtained from a protected environment to avoid reintroducing ransomware to the system.

CISA urges you to promptly report ransomware incidents to a local FBI Field Office, FBI’s Internet Crime Compliant Center (IC3), and CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 1-844-Say-CISA).
Proactive Mitigations to Reduce Risk
To reduce opportunities for intrusion and to strengthen response to ransomware activity, CISA recommends customers of vendors and managed service providers (MSPs) implement the following best practices:

Maintain a robust asset inventory and hardware list [CPG 1.A].
Maintain a clean, offline backup of the system to ensure encryption will not occur once reverted. Conduct a daily system backup on a separate, offline device, such as a flash drive or external hard drive. Remove the device from the computer after backup is complete [CPG 2.R].
Do not expose remote services such as Remote Desktop Protocol (RDP) on the web. If these services must be exposed, apply appropriate compensating controls to prevent common forms of abuse and exploitation. Disable unnecessary OS applications and network protocols on internet-facing assets [CPG 2.W].
Conduct a risk analysis for RMM software on the network. If RMM is required, ask third-party vendors what security controls are in place.
Establish and maintain open communication channels with third-party vendors to stay informed about their patch management process.
For software vendors, consider integrating a Software Bill of Materials (SBOM) into products to reduce the amount of time for vulnerability remediation.

An SBOM is a formal record of components used to build software. SBOMs enhance supply chain risk management by quickly identifying and avoiding known vulnerabilities, identifying security requirements, and managing mitigations for vulnerabilities. For more information, see CISA’s SBOM page.



Resources

Health-ISAC:Threat Bulletin: SimpleHelp RMM Software Leveraged in Exploitation Attempt to Breach Networks
Arctic Wolf: Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access
CISA: #StopRansomware Guide

Reporting
Your organization has no obligation to respond or provide information back to FBI in response to this advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.
FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.
Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.
CISA and FBI do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (report@cisa.gov) or by calling 1-844-Say-CISA (1-844-729-2472).
SimpleHelp users or vendors can contact support@simple-help.com for assistance with queries or concerns.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by CISA.
Version History
June 12, 2025: Initial version.
Notes
1. Anthony Bradshaw, et. al., “DragonForce Actors Target SimpleHelp Vulnerabilities to Attack MSP, Customers,” Sophos News, May 27, 2025, https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/.
2. For instructions for upgrading to the latest version of SimpleHelp, see SimpleHelp’s security vulnerability advisory.
3. To determine possibility of compromise and next steps, see SimpleHelp’s guidance.
4. For instructions for upgrading to the latest version of SimpleHelp, see SimpleHelp’s security vulnerability advisory.



Defending Against China-Nexus Covert Networks of Compromised Devices
Sat, 25 Jul 2026 09:10:14 +0200


Defending against china-nexus covert networks of compromised devices
executive summary
Defending against China-nexus covert networks of compromised devices 
Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it 
Summary
With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners: 

Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)
Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)
Germany Federal Office for the Protection of the Constitution -   Bundesamt für Verfassungsschutz (BfV)
Germany Federal Intelligence Service – Bundesnachrichtendienst (BND)
Germany Federal Office for Information Security - Bundesamt für Sicherheit in der Informationstechnik (BSI)
Japan National Cybersecurity Office (NCO) - 国家サイバー統括室
Netherlands General Intelligence and Security Service - Algemene Inlichtingen- en Veiligheidsdienst (AIVD)
Netherlands Defence Intelligence and Security Service - Militaire Inlichtingen- en Veiligheidsdienst (MIVD)
New Zealand National Cyber Security Centre (NCSC-NZ)
Spain National Cryptologic Centre – Centro Criptológico Nacional (CCN)
Sweden National Cyber Security Centre - Nationellt cybersäkerhetscenter (NCSC-SE)
United States Cybersecurity and Infrastructure Security Agency (CISA)
United States Department of Defense Cyber Crime Center (DC3)
United States Federal Bureau of Investigation (FBI)
United States National Security Agency (NSA) 

Its purpose is to provide network defenders with the tools needed to defend against China-nexus cyber actors and their tactic of using large scale networks of compromised devices (covert networks) to route their cyber activity. 
Introduction  
Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices. 

The NCSC believes that the majority of China-nexus threat actors are using these networks (hereafter “covert networks”), that multiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices. 


Anyone who is a target of China-nexus cyber actors may be impacted by the use of covert networks. They have been used by Chinese state-sponsored actors Volt Typhoon to pre-position offensive cyber capabilities on critical national infrastructure. The group Flax Typhoon used a different covert network of compromised infrastructure to conduct cyber espionage. 


The use of covert networks of compromised devices - also known as botnets - to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.  


This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organizations being targeted by cyber activity using a covert network as an access vector.
Covert Networks 
Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. Actors have been observed using them for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim. They can also be used for general deniable internet browsing, allowing threat actors to research exploitation techniques, new TTPs, and their victims without attribution. Some covert networks are also used by legitimate customers to browse the internet, making it challenging to attribute malicious activity. 

There is evidence that covert networks used by China-nexus actors are created and maintained by Chinese information security companies. A network known to network defenders as Raptor Train, which in 2024 infected more than 200,000 devices worldwide, was controlled and managed by the Chinese company, Integrity Technology Group. This company was also assessed by the FBI to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon. 



Botnet operations represent a significant threat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyber attacks – NCSC Director of Operations, Paul Chichester 



Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale. Raptor Train was made up of thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices. The KV Botnet used by Volt Typhoon was mainly made up of vulnerable Cisco and NetGear routers. The edge devices were vulnerable because they were “end of life” – out of date and no longer receiving updates or security patches by their manufacturers. 


The cyber security industry has been aware of examples of these networks for some time and has publicly reported on the widespread scale of the threat and its implications. Mandiant Intelligence produced a public blog in May 2024 talking about covert networks in which they highlighted a key issue for defenders – indicator of compromise (IOC) Extinction. If a particular threat group could now come from one of many covert networks, each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective. This is compounded by the dynamic nature of these networks where new nodes will be added as old devices are patched or removed from use. 
Typical Network Topology
The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network. 

Because of this, a description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date – and for most network defenders would not be practically useful. 


However, most covert networks of compromised devices use the same basic set up. Understanding this generalized structure can aid researchers and defenders by helping them to understand which part of a network they may have found, and how to defend against it. 




  
      




      A diagram illustrating the basic setup of a covert network.
  

The diagram above illustrates the basic setup of a covert network, where typically an actor will connect to the network via an on-ramp or entry node. Their traffic will be forwarded through multiple compromised devices, used as traversal nodes, before exiting the network from an exit node, usually in the same geographic region as the target. 
Protective Advice 
Defending from attackers using covert networks is not straightforward, and defensive tactics will be different based on the levels of resource and the nature of the target organization. General advice for good cyber security practice should be followed, and some key messages can be found in the appendix of this advisory.  


The following advice is specifically tailored to steps which can be taken to combat the risk of attacks coming from large, dynamic networks of compromised devices. 


Further guidance for all organizations facing cyber security threats is available on the NCSC website. 
This guidance should be considered alongside all applicable laws and regulations of the UK and co-sealing countries relating to the security of networks and data. It will be each organization’s responsibility to ensure compliance with any such laws and regulations. Organizations should note that following the recommended actions set out below will not remove all risks.
All organizations

The NCSC recommends the following steps for all affected organizations to either take themselves, or ask their managed service and/or security providers to investigate for them: 

Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connecting to them.
Baseline normal connections, especially to corporate virtual private networks (VPNs) or other similar services.

Would you expect connections from consumer broadband ranges?


Leverage available dynamic threat feeds which include covert network infrastructure.
Implement multifactor authentication for remote connections.

Smaller organizations should consider creating and actioning a free NCSC Cyber Action Toolkit. 
Larger or more at-risk organizations


Some more comprehensive measures may be appropriate if the risk to an organization is high enough, to be conducted either in-house or through a security provider:  

Apply IP address allow lists rather than deny lists for connections to corporate VPNs for remote workers.
Use geographic allow lists or profile incoming connections based on operating system, time zones, and/or organization specific system configuration settings.
Implement zero trust policies for connections.
Enforce machine certificates for Secure Sockets Layer (SSL) connections.
Reduce the internet-facing presence of the IT estate.
Investigate machine learning techniques to profile normal network edge activity to detect and block anomalies. 

The NCSC's Cyber Essentials can help protect organizations of all sizes. 
Largest or most at-risk organizations 
If Advanced Persistent Threat (APT) tracking is part of an organization’s in-house capability, or if it is part of the service provided by a security vendor, consider tracking China-nexus covert networks as APTs in their own right.

Active hunting – look for connections from IP addresses likely to be part of a covert network of compromised devices, for instance those hosting SOHO routers or IoT devices.
Track and map covert networks reported by industry or government by looking at banners and certificates.
Use threat reporting and threat feeds to create and implement dynamic blocklists and create alert rules to detect incoming threats.
Consider using NetFlow feeds to look upstream and map covert networks to find new nodes. 

The NCSC Cyber Assessment Framework provides guidance for organizations under the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  
MITRE ATT&CK® 
This advisory has been compiled with respect to the MITRE ATT&CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. 






Tactic 






ID 






Technique 






Procedure 










Resource Development 






T1584.005 






Compromise Infrastructure: Botnet 






Botnets are used as core components of covert networks 








Resource Development 






T1584.008 






Compromise Infrastructure: Network Devices 






Devices are compromised and added to botnets 








Resource Development 






T1583.003 






Acquire Infrastructure: Virtual Private Server 






Virtual private servers (VPS) are used in covert networks, typically as on-ramps 








Command and Control 






T1090.003 






Proxy: Multi-hop Proxy 






Used by China-nexus cyber actors to route traffic 










 Appendix: Cyber Security Best Practices 
In addition to the protective advice outlined in this advisory, a number of cyber security best practices will also be useful in defending against the activity described in this advisory. 

Protect your devices and networks by keeping them up to date: use the latest supported versions, apply security updates promptly, use antivirus and scan regularly to guard against known malware threats. See NCSC Guidance: https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software
Prevent and detect lateral movement in your organization’s networks. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/preventing-lateral-movement
Implement architectural controls for network segregation. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/10-steps-network-security
Set up a security monitoring capability so you are collecting the data that will be needed to analyze network intrusions. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes and https://www.ncsc.gov.uk/information/logging-made-easy
Use modern systems and software. These have better security built-in. If you cannot move off out-of-date platforms and applications straight away, there are short term steps you can take to improve your position. See NCSC Guidance:  https://www.ncsc.gov.uk/collection/mobile-device-guidance/managing-the-risks-from-obsolete-products
Restrict intruders' ability to move freely around your systems and networks. Pay particular attention to potentially vulnerable entry points such as third-party systems with onward access to your core network. During an incident, disable remote access from third-party systems until you are sure they are clean. See NCSC Guidance: https://www.ncsc.gov.uk/guidance/preventing-lateral-movement and https://www.ncsc.gov.uk/guidance/assessing-supply-chain-security.
Deploy a host-based intrusion detection system. A variety of products are available, free and paid-for, to suit different needs and budgets.
Further information: Invest in preventing malware-based attacks across various scenarios.  See NCSC Guidance: https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks 

Disclaimer  
This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by co-sealers. UK readers should refer to the NCSC website for information about NCSC assured services. 



This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.  


Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk.  


All material is UK Crown Copyright © 










CVE-2026-43036 | Linux Kernel up to 6.12.80/6.18.21/6.19.11 net skb_header_pointer injection (Nessus ID 329305)
Sat, 25 Jul 2026 09:00:09 +0200
A vulnerability was found in Linux Kernel up to 6.12.80/6.18.21/6.19.11. It has been classified as critical. Affected by this vulnerability is the function skb_header_pointer of the component net. The manipulation leads to injection.

This vulnerability is documented as CVE-2026-43036. The attack requires being on the local network. There is not any exploit available.

Upgrading the affected component is recommended.


CVE-2026-43053 | Linux Kernel up to 6.19.11 xfs_attr3_node_inactive denial of service (Nessus ID 329305)
Sat, 25 Jul 2026 09:00:01 +0200
A vulnerability was found in Linux Kernel up to 6.19.11. It has been declared as critical. This issue affects the function xfs_attr3_node_inactive. Such manipulation leads to denial of service.

This vulnerability is documented as CVE-2026-43053. The attack requires being on the local network. There is not any exploit available.

It is recommended to upgrade the affected component.


The Rust Programming Language Blog: Announcing Rust 1.96.0
Sat, 25 Jul 2026 08:37:36 +0200
The Rust team is happy to announce a new version of Rust, 1.96.0. Rust is a programming language empowering everyone to build reliable and efficient software.
If you have a previous version of Rust installed via rustup, you can get 1.96.0 with:
$ rustup update stable
If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.96.0.
If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel (rustup default beta) or the nightly channel (rustup default nightly). Please report any bugs you might come across!

What's in 1.96.0 stable

New Range* types
Many users expect Range and related core::ops types to be Copy, but this is not the case: they implement Iterator directly, and it is a footgun to implement both Iterator and Copy on the same type so this has been avoided. RFC3550 proposed a set of replacement range types that implement IntoIterator rather than Iterator, meaning they can also be Copy. The standard library portion of that RFC is now stable, introducing:

core::range::Range
core::range::RangeFrom
core::range::RangeInclusive
Associated iterators

A Rust version in the near future will also add core::range::RangeFull and core::range::RangeTo as re-exports from core::ops (these do not implement Iterator and already implement Copy), and core::range::legacy::* as the new home for the current ranges. Range syntax like 0..1 still produces the legacy types for now, but will be updated to core::range types in a future edition.
With these stabilizations, it is now possible to store slice accessors in Copy types without splitting start and end:
use core::range::Range;

#[derive(Clone, Copy)]
pub struct Span(Range<usize>);

impl Span {
    pub fn of(self, s: &str) -> &str {
        &s[self.0]
    }
}
The new RangeInclusive also makes its fields public, unlike the legacy version which avoided exposing the exhausted iterator state. This isn't a concern with the new type since it must be converted to begin iteration.
Library authors should consider making use of impl RangeBounds in public API, which accepts both legacy and new range types. If a concrete type is needed, prefer using new ranges as this will eventually become the default.

Assert matching patterns
The new macros assert_matches! and debug_assert_matches! check that a value matches a given pattern, panicking with a Debug representation of the value otherwise. These are essentially the same as assert!(matches!(..)) and debug_assert!(matches!(..)), but the printed value improves the possibility of diagnosing the failure.
These new macros have not been added to the standard prelude, because they would collide with popular third-party crates that provide macros with the same name. Instead, they should be manually imported from core or std before use.
use core::assert_matches;

/// [Random Number](https://xkcd.com/221/)
fn get_random_number() -> u32 {
    // chosen by a fair dice roll.
    // guaranteed to be random.
    4
}

fn main() {
    assert_matches!(get_random_number(), 1..=6);
}

Changes to WebAssembly targets
WebAssembly targets no longer pass --allow-undefined to the linker which means that undefined symbols when linking are now a linker error instead of being converted to WebAssembly imports from the "env" module. This change prevents modules from linking unless all linking-related symbols are defined to catch bugs earlier and prevent accidental issues with symbol naming or similar.
Undefined linking-related symbols are often indicative of build-time related bugs or misconfiguration. If, however, the old behavior is intended then it can be re-enabled with RUSTFLAGS=-Clink-arg=--allow-undefined or by editing the source code and using #[link(wasm_import_module = "env")] on the block defining the symbol.
This change was previously announced on this blog, and now takes effect in Rust 1.96.

Stabilized APIs

assert_matches!
debug_assert_matches!
From for AssertUnwindSafe
From for LazyCell
From for LazyLock
core::range::RangeToInclusive
core::range::RangeFrom
core::range::RangeFromIter
core::range::Range
core::range::RangeIter


Two Cargo advisories
Rust 1.96 contains fixes for two vulnerabilities for users of third-party registries.


CVE-2026-5223 is a medium severity vulnerability regarding extraction of crate tarballs with symlinks.


CVE-2026-5222 is a low severity vulnerability regarding authentication with normalized URLs.


Users of crates.io are not affected by either vulnerability.

Other changes
Check out everything that changed in Rust, Cargo, and Clippy.

Contributors to 1.96.0
Many people came together to create Rust 1.96.0. We couldn't have done it without all of you. Thanks!


Firefox Nightly: Backup for a Rainy Day – These Weeks in Firefox: Issue 202
Sat, 25 Jul 2026 08:37:35 +0200
Highlights

The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!

This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.
You will be able to manage this feature in Settings under Sync (for now)




You can read more about the feature here


As followups to the recent addition to the WebExtension tabs API to support the new SplitView tabs feature, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window – Bug 2029099 / Bug 2029534
Adaptive autofill has been enabled on Nightly.

Previously, autofill only completed domains (e.g. typing red autofilled reddit.com). Now it can also complete full URLs for pages you visit often (e.g. red → reddit.com/r/firefox), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.

If you run into issues or have feedback, you can file a bug here!




Markus Stange [:mstange] implemented dynamic toolbar on top in RDM (#1978145), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android

dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled
it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom




Friends of the Firefox team
Resolved bugs (excluding employees)
Script to find new contributors from bug list
Volunteers that fixed more than one bug

Amin Amir
aoia7rz7l
Chukwuka Rosemary
DrSeed
Frédéric Wang Nélar
japandi
John Iweh
jonathancabera
Josh Aas
Keji Bakare
kofoworola shonuyi
konyhéa
liz
Mathew Hodson
Okhuomon Ajayi
Oluwatobi
ROSHAAN
Sam Johnson

New contributors (🌟 = first patch)

 Anthony Mclamb: Disable the legacy Edge migrator
 Amin Amir

🌟Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled
Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs
🌟 Amine Zroual: Omitted maxResults property not handled correctly in getRecentlyClosed


any1here: install_sig_alt_stack incorrectly checks mmap’s return value
🌟 Armin Ulrich: Fix MessageHandlerRegistry.sys.mjs calling getExistingMessageHandler with an unused second argument
japandi

Cannot remove amazon.com from top sites list
The height of the pinned tabs area should be responsive to the number of pins
Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations


Nathan Johnson [:narjoDev]: Remove browser.display.use_system_colors pref
DrSeed

Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting
The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again


Keji Bakare:

Split view’s focus-outline is clipped on the right side of left tab
White space on the right side of left panel in split view


🌟 gotyaoi: Reload toolbar button is active on about:newtab
Itoro James: [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it
John Iweh: The notification dot is not displayed if the tab is in a Split View
🌟 John Iweh: sidebar-shown attribute remains when sidebar.revamp is false
🌟 jonathancabera:

The Move tab to Split View option is also displayed for the tabs that are within the Split View
A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled
Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode


Aloys: Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67
liz:

Create test to ensure maxRenderCountEstimate is never being set to Infinity in virtual-list component in Fx View
Button accessible name does not convey its function: missing topic context (Settings dialog > Topics dialog > buttons Following/Unfollow/Blocked/Unblock)


Mary cathline: Tab Group Label does not respect touch density in vertical tab bar
🌟 Brandon Lucier: Popups opened with window.open give window type normal instead of popup
karan68: [dialog] New Shortcut dialog needs a label/accessible name
🌟 Vector: Button does not programmatically indicate that it opens a dialog (Recent activity section > story card > ••• disclosure > Delete from History button)
🌟 Osoble: Update font size and weight for synced tabs device name headers in Firefox View
konyhéa:

Add test for sync admin disabled to browser_syncedtabs_errors_firefoxview.js
Check all second paramaters for TestUtils.waitForCondition in Fx View test files
Recently Closed Tabs, Tabs from Other Devices, and History pages should have Cmd / Ctrl + Click on a link open the link in the new background tab.


Noble Chinonso: #shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled
Pranjali Srivastava: Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)
Okhuomon Ajayi:

More spacing is needed between the tab note icon and the close icon on the tab
The tabs in vertical mode collapsed state are positioned differently in Split View
Keep vertical split view tabs stacked vertically even when the sidebar is expanded when expand on hover is enabled
Vertical split view tabs can be too big or small when tabs are overflowing


🌟 Rishan: Fix duplicated arrow function in browser_history_sidebar.js
Chukwuka Rosemary:

“Forget About This Site” context menu option missing from Firefox View history
Long strings are not displayed properly on the about:opentabs page search filed
Add test for Forget This Site option in Fxview history context menu.


ROSHAAN:

🌟Tab note background colour is incorrect for default light theme
 [win/linux] The splitter between content areas does not match Figma spec
Fix typo in OpenInTabsUtils.confirmOpenInTabs()


Sameeksha: Disclosure button expanded/collapsed state not programmatically defined (Customize button)
kofoworola shonuyi:

🌟Actually hide or remove sidebar-shown attribute when in fullscreen.
Add a test for checking sidebar-shown attribute in fullscreen mode


🌟 Sayd Mateen: Page URL is displayed as tab name when page’s contains about:reader?
 


Oluwatobi:

Unable to delete selected history entries from sidebar
Incorrect Sidebar button state/tooltip hover text
The city name heading level doesn’t follow the correct heading level order


Nishchay [:nish]: Unable to add tabs to old closed tab groups (tabGroupState.splitViews is undefined)

 
Project Updates
Add-ons / Web Extensions
Addon Manager & about:addons

In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) – Bug 2032014

NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes



WebExtensions Framework

Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors – Bug 2033173

Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!


Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail – Bug 2034329

Thanks to Simon Farre for promptly investigating and fixing this recent regression!



WebExtension APIs

Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted – Bug 1392125

Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!



DevTools

Artem Manushenkov fixed an issue where autosuggestion popup was removing overridden indicators from properties in the Inspector (#1983408)
Andrea Marchesini [:baku] fix DevTools cookie header serialization for long cookies, which could lead to cookies not being visible in Netmonitor (#2031299)
Julian Descottes [:jdescottes] fixed a toolbox crash that was happening we couldn’t find a localization file (e.g. when using a language pack on Nightly) (#2028930)
Nicolas Chevobbe [:nchevobbe] improved @container tooltip so it show the value of variables used in style()(#2030239), has enough contrast in dark mode (#2033782) and contains a link to select the container (#2031688)




Hubert Boma Manilla (:bomsy) is making good progress on migrating the Console to CodeMirror 6 (#2032758, #2026569)

Fluent

We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!


Migration Improvements

Thanks to dao for fixing a recent alignment issue in the migration wizard dropdown
Thanks to volunteer contributor Anthony Mclamb for his patch that disables the legacy EdgeHTML Edge migrator! Once that finishes rolling out, presuming no surprises, we’ll go ahead and remove the migrator entirely.

New Tab Page

Nova for New Tab has ridden the trains to Beta! It will be enabled by default, globally, when Firefox 151 goes out to release on May 19th

It’s possible that we’ll do a train-hop coupled with an experiment to enable HNT Nova for a few clients a bit earlier.


Maxx Crawford enabled Nova designs for New Tab, rolling out the updated layout, widgets, and customization panel behind HNT Nova flags.
Maxx Crawford fixed the Nova content feed to render the intended four‑column layout by correcting CSS grid breakpoints.
Maxx Crawford resolved a first‑load failure in the Weather widget by fixing init order and fetch timing, eliminating the “Oops” error.
Maxx Crawford synchronized the Weather toggle between about:preferences#home and the panel via the shared showWeather pref to prevent desync.
Maxx Crawford updated Nova grid focus order to align tab flow with visual order for keyboard users.
Maxx Crawford fixed critical UI issues in Lists and Timer widgets covering overflow, controls, and layout stability.
Maxx Crawford guarded document.dir access in Nova render paths to avoid startup cache worker errors and improve startup stability.
Rolf added a new normalization method for the inferred interest vector to stabilize topic relevance across sessions.
Rolf prevented unnecessary content refreshes during Pocket New Tab experiments, reducing jank and bandwidth.
Sameeksha defined the Customize button’s expanded/collapsed state programmatically using aria-expanded for better a11y.
liz clarified follow/unfollow/blocked button names with topic context so screen readers announce clear actions.
Vector marked the Delete from History control as opening a dialog via aria-haspopup=dialog for assistive tech.
Scott Downe fixed a regression that flipped the Wallpapers pref off, restoring user selections.
Irene Ni corrected privacy link color and focus styles for contrast and keyboard visibility.
Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.
Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.

Search and Urlbar

Marco has fixed a couple of issues with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.
Work continues on the new separate search bar to improve the functionality, e.g. allowing middle click to perform a search in a new tab, avoiding performing a search when adding a search engine.
Work also continues on the new Nova layouts.

Smart Window

uplifted 10 bugs to 150.0.1 dot release addressing initial user feedback from diary study and Connect

jump to bottom of conversation 2028692
stop streaming button 2029204
back/forward navigation from assistant 2029229
dark mode for various chips 2024499


search engine switching from smart bar 2021973
Nova styling within smart window 2026794

Storybook/Reusable Components/Acorn Design System

Dustin converted moz-breadcrumb-group variables into JSON design tokens Bug 2029181 – Convert moz-breadcrumb-group variables into JSON design tokens
Dustin converted moz-box-* variables into JSON design tokens Bug 2029180 – Convert moz-box-* variables into JSON design tokens
Dustin converted moz-promo variables to JSON design tokens Bug 2029190 – Convert moz-promo variables into JSON design tokens
Dustin converted moz-reorderable-list variables to JSON design tokens Bug 2029191 – Convert moz-reorderable-list variables into JSON design tokens
Dustin converted moz-visual-picker variables to JSON design tokens Bug 2029193 – Convert moz-visual-picker-item variables into JSON design tokens
Dustin updated browser-shared.css so it passes use-design-tokens Bug 2022985 – Update browser-shared.css so it passes use-design-tokens
Dustin updated popup.css so it passes use-design-tokens Bug 2022979 – Update popup.css so it passes use-design-tokens
Jon added opacity tokens and added opacity to use-design-tokens stylelint rule  Bug 1955325 – Create opacity tokens
Jon converted toolbar design tokens to JSON Bug 2017970 – Convert toolbar design tokens to json
Anna fixed moz-select with panel-list drop-down size inconsistency Bug 2032365 – Applications Action drop-down menus sometimes have a different size when opened
Anna fixed issue with the disabled state of moz-radio component Bug 2027123 – moz-radio disabled state cannot be changed while the moz-radio-group is disabled
Anna updated moz-button and moz-box-button components to prevent label corruption when accesskeys are present and the label changes.   Bug 2022326 – moz-button with accesskey label becomes corrupted when l10nId updates dynamically

UX Fundamentals

The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – 2027209
In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – 2031837

Settings Redesign

Tim converted settings related to Accessibility page to config-based pane Bug 1968116 – Convert settings related to Accessibility page to config-based settings
Benjamin converted Privacy & Security page to the config-based pane Bug 1968112 – Convert settings related to Privacy & Security page to config-based settings
Finn integrated Firefox Labs page into setting-pane config Bug 2021047 – Integrate Firefox Labs page into setting-pane config
Anna converted Firefox Updates section to config-based prefs Bug 1990961 – Convert Firefox Updates section to config-based prefs
Mark Kennedy added moz-promo, that is welcoming users to the redesigned settings Bug 2015093 – Add a moz-promo to welcome users to the redesign




Anna added possibility to search for actions in the redesigned “Applications” section Bug 2020370 – It’s no longer possible to search for actions in the new “Applications” section
Anna fixed the Settings navbar layout breakage



50 macOS Tips and Tricks Using Terminal (the last one is CRAZY!)
Sat, 25 Jul 2026 08:36:50 +0200
Author: NetworkChuck - Bewertung: 31462x - Views:990975 
I know your password. Change it with Dashlane: https://www.dashlane.com/networkchuck50 (Use code networkchuck50 to get 50% off) 



In this video, NetworkChuck shows you the top 50 MacOS terminal commands you NEED to know. Now, while Mac OS is unix-based and very similar to Linux, it has its nuances and things worth paying attention to. Things like, making your Macbook talk, finding wifi passwords, diving into the matrix and taking a trip to the aquarium, all from your terminal. 









🔥🔥Join Hackwell Academy: https://ntck.co/NCAcademy







**Sponsored by Dashlane















SUPPORT NETWORKCHUCK

---------------------------------------------------

➡️NetworkChuck membership: https://ntck.co/Premium

☕☕ COFFEE and MERCH: https://ntck.co/coffee



Check out my new channel: https://ntck.co/ncclips



🆘🆘NEED HELP?? Join the Discord Server: https://discord.gg/networkchuck



STUDY WITH ME on Twitch: https://bit.ly/nc_twitch



READY TO LEARN??

---------------------------------------------------

-Learn Python: https://bit.ly/3rzZjzz

-Get your CCNA: https://bit.ly/nc-ccna



FOLLOW ME EVERYWHERE

---------------------------------------------------

Instagram: https://www.instagram.com/networkchuck/

Twitter: https://twitter.com/networkchuck

Facebook: https://www.facebook.com/NetworkChuck/

Join the Discord server: http://bit.ly/nc-discord



0:00   ⏩  Intro

0:12   ⏩  say

0:23   ⏩  security find-generic-password -wa Wifi

0:40   ⏩  pbcopy

0:54   ⏩  command + option + shift + v

1:08   ⏩  caffeinate

1:20   ⏩  command + shift + 3

1:53   ⏩  defaults write com.apple.screencapture name

 2:10  ⏩  defaults write com.apple.screencapture type

 2:19  ⏩  default write com.apple.screencapture location ~/Desktop/screenshots

2:40   ⏩  passwd

4:11   ⏩  cd

4:17   ⏩  ls

4:20   ⏩  pwd

4:26   ⏩  whoami

4:32   ⏩  mv

4:36   ⏩  cp

4:41   ⏩  ditto

4:48   ⏩  df -h

4:51   ⏩  nano

5:00   ⏩  man

5:09   ⏩  open

5:18   ⏩  ping

5:25   ⏩  ifconfig

5:36   ⏩  grep

5:43   ⏩  awk

5:53   ⏩  traceroute

6:04   ⏩  dig

6:12   ⏩  ps

6:21   ⏩  top

6:31   ⏩  kill

6:47   ⏩  which $SHELL

6:56   ⏩  bash

7:00   ⏩  zsh

7:05   ⏩  uptime

7:10   ⏩  killall mDNSResponder….and more

7:15   ⏩  qlmanage

7:22   ⏩  diff

7:27   ⏩  curl

7:42   ⏩  leave

7:54   ⏩  history

7:59   ⏩  disable gatekeeper

8:20   ⏩  brew

8:46   ⏩  cmatrix

9:02   ⏩  asciiquarium

9:13   ⏩  toilet

9:31   ⏩  tetris

9:48   ⏩  python3

10:18 ⏩  shutdown

10:33 ⏩  sudo touch id





AFFILIATES & REFERRALS

---------------------------------------------------

(GEAR I USE...STUFF I RECOMMEND)

My network gear: https://geni.us/L6wyIUj

Amazon Affiliate Store: https://www.amazon.com/shop/networkchuck

Buy a Raspberry Pi: https://geni.us/aBeqAL

Do you want to know how I draw on the screen?? Go to https://ntck.co/EpicPen and use code NetworkChuck to get 20% off!! 







#MacOS #Terminal #brew



SHOCKING NEW OpenAI Robotics Tech + Tesla Reveals Optimus AI Robot Update | Meta AI CACTI
Sat, 25 Jul 2026 08:36:47 +0200
Author: AI News - Bewertung: 343x - Views:10943 
- In a world-changing breakthrough, Microsoft researchers have integrated OpenAI’s ChatGPT with robotics and other devices, enabling the use of natural language to control various devices, including drones, robot arms, home assistant robots and more, allowing humans to easily communicate their intentions to robots just like they would to another human, bridging the gap between man and machine. Tesla’s Optimus AI robot can now walk short distances by itself, carry an object of its arm's size, and use basic tools with the help of artificial intelligence. CACTI from Meta AI consists of four stages that handle data collection, data augmentation, visual representation learning, and imitation policy training separately to enable scalability in robot learning. 



AI Marketplace: https://taimine.com/

Deep Learning AI Specialization: https://imp.i384100.net/GET-STARTED



AI News Timestamps:

0:00 New OpenAI Robotics Tech With ChatGPT

5:06 Tesla Optimus AI Robot News

6:15 Meta AI CACTI Robot Imitation Learning



#technology #tech #ai



Why Gaming on Linux Suddenly Matters
Sat, 25 Jul 2026 08:36:39 +0200
Author: Techquickie - Bewertung: 24191x - Views:665011 
Click this link https://boot.dev/?promo=TECHQUICKIE and use my code TECHQUICKIE to get 25% off your first payment for boot.dev. Thank you Boot.Dev for Sponsoring! 



From broken drivers to the Steam Deck selling millions, Linux gaming has gone from "is this the year?" to "wait, it actually works now." But getting here took a decade of tinkering, a billion-dollar bet from Valve, and an open-source community that refused to quit. In this video we talk to Valve and the Batocera project about how Linux quietly became a real threat to Windows - and why Microsoft is playing catch-up.



Leave a reply with your requests for future episodes.



► SHOP OUR PRODUCTS: https://lttstore.com

► GET A VPN: https://www.piavpn.com/TechQuickie

► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane

► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners



Purchases made through some store links may provide some compensation to Linus Media Group. Affiliate links powered in part by https://affilimate.com/



Linus Sebastian is an investor in Framework Computer, Inc and HexOS by Eshtek.



Chapters

------------------------------------

0:01 Is this the year of Linux gaming?

0:43 Why Microsoft is usually better

2:03 How Valve is fighting back

3:37 Sponsor 

4:14 Steamdeck saved the day

4:50 Windows claps back 

6:27 Valve is putting up a fight 

7:40 Watch another video



Linux-Gaming 2026: Ist Bazzite besser als Windows?
Sat, 25 Jul 2026 08:36:04 +0200
Author: PC-WELT - Bewertung: 347x - Views:9175 
Gaming unter Linux? Ich dachte: Gefrickel, Treiber-Hölle und am Ende doch wieder Windows.



Nach einer Woche mit Bazzite auf meinem Gaming-PC lag ich ziemlich daneben.



Bazzite ist eine Linux-Version für Gaming: Steam, Controller-Support und GPU-Treiber sind direkt vorbereitet. Viele Windows-Spiele laufen dank Proton überraschend problemlos.



Wichtig vor dem Download: Check dein Spiel auf ProtonDB. Dort siehst du, ob es läuft und welche Proton-Version empfohlen wird.



PC-WELT-Check: Linux-Gaming ist nicht mehr nur was für Bastler – vor allem, wenn du hauptsächlich über Steam zockst. Bei Epic, GOG & Co. wird es mit Tools wie Lutris oder Heroic etwas hakeliger.



Zockst du schon mit Linux?

-

#Steam #GamingPC #PCGaming #Linux



Ich brauche Windows nicht mehr! Bazzite vs. CachyOS
Sat, 25 Jul 2026 08:35:50 +0200
Author: PC-WELT - Bewertung: 1109x - Views:21055 
Gaming auf Linux war lange kompliziert oder scheiterte gleich am Game-Support. Doch die Zeiten sind vorbei - dank Distros wie Bazzite oder CachyOS macht Zocken auf Linux mittlerweile richtig Bock. Doch welche Gaming-Distro ist die beste? Was sind die Unterschiede zwischen Bazzite und CachyOS? Das hab ich mir mal genauer angeschaut.



► https://youtu.be/Zz-qL5JRm4s



► https://youtu.be/j0pM0S3wmbc



► https://www.youtube.com/watch?v=mVXONaHZvFU



► Zum PC-WELT T-Shirt-Shop:

https://pcwelt.myspreadshop.de



► Unterstützt uns, werdet Kanalmitglied für nur 99 Cent im Monat und erhaltet exklusive Vorteile (jederzeit kündbar):

https://www.youtube.com/pcwelt/join 



► News, Tests und Tipps zum Thema Gaming & eSports: https://www.pcwelt.de/gaming



► PC-WELT auf Instagram: https://instagram.com/pcwelt/

► PC-WELT auf Facebook: https://www.facebook.com/pcwelt/

► PC-WELT auf Twitter: https://twitter.com/pcwelt



0:00 – Intro: Ist Linux-Gaming 2026 die bessere Wahl?

0:52 – Was ist CachyOS? (Arch Linux & Rolling Releases)

1:29 – Warum CachyOS schneller läuft (CPU-Optimierung & Compiler-Standards)

2:57 – Installation & Dual-Boot im Vergleich

3:38 – Anpassbarkeit: Desktops & Bootloader

3:59 – Systemsicherheit: Die "Atomic Updates" von Bazzite

4:32 – Software-Quellen: CachyOS (Pacman & AUR) vs. Bazzite (Flatpaks)

5:46 – Out-of-the-Box: Wer ist schneller spielbereit?

6:36 – Spiele-Performance & das Nvidia-Treiber-Problem unter Linux

7:01 – Fazit: Welches OS ist besser für dich?

7:39 – Handheld-Gaming (Steam Deck & Co.): Bazzite weiterhin vorn?

8:15 – Outro



--------



Unser Equipment (Affiliate-Links):



🎥Kameras:

https://amzn.to/3WUf0Ud

https://amzn.to/44VCdHC

https://amzn.to/3KdbGMe





🔭Objektive:

https://amzn.to/3uLfZ9p

https://amzn.to/2NkGoFd

https://amzn.to/3iXV3GJ



➡️ Stative:

teuer: https://amzn.to/2DIlCeV

günstig: https://amzn.to/2IHm026

Einbein: https://amzn.to/2T0WbPG



📺Field Monitore:

Atomos Ninja: https://amzn.to/4dR0q5Y



🎤Mikros:

Lavalier: https://amzn.to/2IxIlzm

Headset: https://de-de.sennheiser.com/hsp-essential-omni

Shotgun: https://amzn.to/2HdVKIT



➡️ Kamera-Cages & Zubehör:

SmallRig-Cages: https://amzn.to/4atoPM4

Damit habt Ihr alles im Griff:https://amzn.to/2SmfptN



➡️ Schulter-Rig: https://amzn.to/3Rm9ZQX



--------



Auf dem PC-WELT-Kanal findet Ihr alles rund um das Thema PCs & (Gaming-)Hardware. Bei uns gibt's alle wichtigen Infos, Tests und Hands-ons rund um die spannendsten Geräte.



--------



Einige Links können Affiliate-Links sein. Kauft Ihr über einen solchen Link ein Produkt, erhalten wir eine kleine Provision. Am Kaufpreis ändert sich für Euch dadurch nichts.



--------



► Alle News, Hands-ons und Gewinnspiele findet Ihr in dieser Playlist:

https://www.youtube.com/playlist?list=PLVC_WMwVwvSjZfr6GlSyy-bNEXm9b-lN3



LUG: LinOs Fürstenfeldbruck
Sat, 25 Jul 2026 08:32:40 +0200
Wir sind ein Stammtisch von Linux & OpenSource Freunden, die sich im Regelfall 1x im Monat zusammensetzen und austauschen. 2 weitere Donnerstage im Monat sind für Installationshilfen und OpenSource geplant. Interessierte Menschen und Neulinge sind herzlich willkommen, wir helfen gern beim Umstieg.


Artikel: Pro-Linux nach dem Mai 2020
Sat, 25 Jul 2026 08:32:26 +0200
Wie wir bereits angekündigt haben, werden wir Ende Mai das Schreiben von Nachrichten einstellen. Pro-Linux wird in der Folge weiter zugänglich sein, aber entsprechend eine stark verringerte Aktivität aufweisen.


Windows-10-Ende: Linux-Anbieter jubelt über Rekord-Downloads
Sat, 25 Jul 2026 08:23:22 +0200
Der Umstieg von Windows auf Linux gilt unter vielen Nutzern noch immer als großer Schritt. Immer mehr Anwender sind aufgrund des Windows-10-Endes inzwischen aber zu diesem bereit, da die Alternative wohl im Kauf neuer Hardware bestehen würde. (Weiter lesen)


‘I thought, I’ve tried everything else, why not give AI a shot?’: the long-lost family reunited by ChatGPT
Sat, 25 Jul 2026 07:28:08 +0200
Avtar spent decades wondering what happened to the mother he never got to know. Thousands of miles away, Nicci was haunted by the story of a half-brother given away before she was born. How did a chatbot bring them together?
As a small boy growing up in Amritsar, India, in the 1960s, Avtar Singh used to hear whispers. Your mum isn’t really your mum, the rumours would say. Your mum lives abroad. Avtar didn’t really pay any attention to it. “I thought, the neighbours are just making up stories.” But the stories were true: the woman raising Avtar was actually his grandmother. When he was too young to remember it, his father had emigrated to Canada to work as a teacher, leaving Avtar in the care of his paternal grandparents. His grandfather, a police officer, was a fearsome authoritarian, but his grandmother brought him up with tenderness, as if he were her own son. She called him by his nickname, Titu. He felt loved.
When Avtar was around eight years old, he was told about his family in Canada: his dad, his mum and a little brother were waiting for him there, and he would soon travel to join them. Just after his ninth birthday, Avtar found himself sitting on a plane, dressed in a three‑piece suit and tie. He was travelling alone. He had never flown before. He didn’t speak a word of English. He landed in Halifax, Nova Scotia, on Christmas Eve, 1968; his family met him at the airport and took him home. “I didn’t know what to think,” Avtar, now 66, tells me in a video call from his home in Abbotsford, British Columbia. “Before I knew it, it was the first week of January, and I was put in school.”
 Continue reading...


I've used Linux for 30 years, and this free security suite does it all - almost perfectly
Sat, 25 Jul 2026 06:39:09 +0200
Linux may be the most secure OS available, but it can always use extra security. BastionGuard 2 promises some serious security.


I fixed my home office's spotty Wi-Fi with Samsung's free diagnostic tool - and it took just minutes
Sat, 25 Jul 2026 05:53:54 +0200
A recent uptick in lag and disconnects led me to reevaluate my home office setup. Here's how I validated my solution.


Linux Mint 22.3 “Zena” – BETA Release
Sat, 25 Jul 2026 05:09:59 +0200
This is the BETA release for Linux Mint 22.3 “Zena”. Linux Mint 22.3 is a long term support release which will be supported until 2029. It comes with updated software and brings refinements and many new features to make your desktop even more comfortable to use. New features: This new version of Linux Mint contains […]


Linux Mint 22.3 “Zena” released!
Sat, 25 Jul 2026 05:09:56 +0200
The team is proud to announce the release of Linux Mint 22.3 “Zena”. Linux Mint 22.3 is a long term support release which will be supported until 2029. It comes with updated software and brings refinements and many new features to make your desktop even more comfortable to use. New features: This new version of […]


Monthly News – February 2026
Sat, 25 Jul 2026 05:09:50 +0200
Hi everyone, First of all, thank you for your support and your donation! And many thanks to all the people involved in helping Linux Mint. Here’s a preview of what we worked on recently, and which will be featured in the next release. Sensors A page dedicated to sensors was added to the System Reports […]


Monthly News – March 2026
Sat, 25 Jul 2026 05:09:45 +0200
Hi everyone, Before we start with the news, I’d like to apologize for posting so late. Release Strategy In February I mentioned we were at a crossroads and that it was the right time to consider important changes. The following decisions were made: Linux Mint will adopt a longer development lifecycle. The next release is […]


Monthly News – April 2026
Sat, 25 Jul 2026 05:09:42 +0200
Hi everyone, Thank you for your support and your donations! Many thanks to everyone involved in helping Linux Mint. HWE ISOs Earlier this month we announced a longer development cycle and the decision not to release until Christmas 2026. To address compatibility issues with brand new hardware, we decided to start publishing updated ISO images […]


Monthly News – May 2026
Sat, 25 Jul 2026 05:09:34 +0200
Hi everyone, We’ve got a lot of exciting news this month! But first of all, let us thank everyone involved in helping our project. Many thanks for your support and your donations! Note that the improvements and features mentioned in this blog post are planned for the next version of Linux Mint, which is scheduled […]


Monthly News – June 2026
Sat, 25 Jul 2026 05:09:17 +0200
Hi everyone, Many thanks to all the people who donate and sponsor our project! Note: The improvements and features mentioned in this blog post are planned for the next version of Linux Mint, which is scheduled for Christmas this year. Wayland We worked really hard on Wayland and we got to the point where it […]


CVE-2022-40304 | Oracle Communications Cloud Native Core Network Slice Selection Function Oracle Linux xml external entity reference (EUVD-2022-43601 / Nessus ID 211168)
Sat, 25 Jul 2026 03:55:39 +0200
A vulnerability has been found in Oracle Communications Cloud Native Core Network Slice Selection Function 22.3.1/22.4.1 and classified as critical. The impacted element is an unknown function of the component Oracle Linux. This manipulation causes xml external entity reference.

The identification of this vulnerability is CVE-2022-40304. The attack can only be executed locally. There is no exploit available.

It is recommended to apply a patch to fix this issue.


CVE-2022-40307 | Linux Kernel up to 5.19.8 capsule-loader.c use after free (EUVD-2022-43604 / Nessus ID 236648)
Sat, 25 Jul 2026 03:55:32 +0200
A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.19.8. This issue affects some unknown processing of the file drivers/firmware/efi/capsule-loader.c. Executing a manipulation can lead to use after free.

This vulnerability appears as CVE-2022-40307. The attacker needs to be present on the local network. There is no available exploit.

Applying a patch is advised to resolve this issue.


CVE-2026-43014 | Linux Kernel up to 6.19.11 net clk_register_fixed_rate allocation of resources (Nessus ID 329305)
Sat, 25 Jul 2026 03:55:29 +0200
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.19.11. The affected element is the function clk_register_fixed_rate of the component net. The manipulation leads to allocation of resources.

This vulnerability is documented as CVE-2026-43014. The attack requires being on the local network. There is not any exploit available.

It is advisable to upgrade the affected component.


CVE-2026-43016 | Linux Kernel up to 6.6.133/6.12.80/6.18.21/6.19.11 bpf use after free (Nessus ID 329305)
Sat, 25 Jul 2026 03:55:28 +0200
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.6.133/6.12.80/6.18.21/6.19.11. The impacted element is an unknown function of the component bpf. Such manipulation leads to use after free.

This vulnerability is referenced as CVE-2026-43016. The attack needs to be initiated within the local network. No exploit is available.

It is advisable to upgrade the affected component.


CVE-2026-43034 | Linux Kernel up to 6.18.21/6.19.11 bnxt_en bnxt_hwrm_func_backing_store_qcaps_v2 array index (Nessus ID 329305)
Sat, 25 Jul 2026 03:55:27 +0200
A vulnerability was found in Linux Kernel up to 6.18.21/6.19.11 and classified as critical. Affected is the function bnxt_hwrm_func_backing_store_qcaps_v2 of the component bnxt_en. Executing a manipulation can lead to improper validation of array index.

This vulnerability is registered as CVE-2026-43034. The attack requires access to the local network. No exploit is available.

It is suggested to upgrade the affected component.


CVE-2026-43015 | Linux Kernel up to 6.19.11 platform_device_unregister use after free (Nessus ID 329305)
Sat, 25 Jul 2026 03:55:25 +0200
A vulnerability classified as critical has been found in Linux Kernel up to 6.19.11. This affects the function platform_device_unregister. This manipulation causes use after free.

The identification of this vulnerability is CVE-2026-43015. The attack can only be executed locally. There is no exploit available.

It is recommended to upgrade the affected component.

Tactic	ID	Technique	Procedure
Resource Development	T1584.005	Compromise Infrastructure: Botnet	Botnets are used as core components of covert networks
Resource Development	T1584.008	Compromise Infrastructure: Network Devices	Devices are compromised and added to botnets
Resource Development	T1583.003	Acquire Infrastructure: Virtual Private Server	Virtual private servers (VPS) are used in covert networks, typically as on-ramps
Command and Control	T1090.003	Proxy: Multi-hop Proxy	Used by China-nexus cyber actors to route traffic