Windows Lacks Official Patch for LegacyHive Zero-Day; 0Patch Delivers Free Micro-Patch
A fresh zero-day vulnerability in Windows has received unofficial patches from ACROS Security, the developer of the 0Patch platform, after Microsoft failed to release an official fix. The flaw, dubbed LegacyHive, affects the user profile service and currently lacks a CVE identifier.
The vulnerability was discovered by researcher Nightmare Eclipse and publicly disclosed on 14 July, the same day Microsoft issued its monthly security updates. LegacyHive permits a standard user to mount another user's registry hive with complete access rights. Once mounted, an attacker can extract stored credentials or alter registry values to achieve automatic code execution the next time an administrator logs in.
Exploit functionality has been independently verified by security researchers Will Dormann and Kevin Beaumont. Kevin Beaumont additionally published detection queries for Microsoft Defender for Endpoint to help organizations identify potential exploitation attempts.
Microsoft has confirmed awareness of the issue and is reviewing the details, yet no official patch has been issued. ACROS Security addressed the gap by releasing a free micro-patch that alters the behavior of the vulnerable component. The exploit still runs, but instead of accessing the real administrator profile it receives only a disposable temporary registry hive, rendering the attack ineffective.
The micro-patch is available for Windows 10 version 2004 and newer, as well as Windows Server 2022 and subsequent releases. Users must register with 0Patch and deploy the agent; once installed, the patch applies automatically without requiring a system reboot, provided enterprise policies permit it.
No evidence of in-the-wild exploitation of LegacyHive has been reported so far.
Related articles
WordPress Patches High-Severity XSS2Shell Flaw Enabling Remote Code Execution (CVE-2026-64638)
WordPress has released a fix for a high-severity vulnerability in its core that can turn a malicious login attempt into remote PHP code execution on the server. The flaw, tracked as CVE-2026-64638 and rated 8.9 on CVSS, is named XSS2Shell and begins as a reflected cross-site scripting issue on the authentication screen. An unauthenticated attacker can submit a specially crafted username that bypasses sanitization mechanisms due to differences in how PHP and WordPress interpret certain characters, allowing controlled HTML elements to be injected into the login page. This leads to JavaScript execution in the site domain, and when an authenticated administrator visits a prepared page, the attacker can abuse the existing session to authorize application credentials and upload arbitrary PHP code. The patch is included in WordPress 7.0.3 released on August 6, with backports available for branches as old as 4.7. No public exploitation has been confirmed yet, but the technical details make immediate updating a priority for site administrators.
Google Releases Chrome 151 Fixing 41 Vulnerabilities Including Six Critical Flaws
Google has issued Chrome 151 to address 41 security vulnerabilities, six of which are rated critical and could lead to memory corruption, browser crashes, and remote code execution. The update covers Windows, macOS, and Linux platforms with versions 151.0.7922.108 and 151.0.7922.109. Two use-after-free flaws in the WebGL component, tracked as CVE-2026-19137 and CVE-2026-19170, allow continued memory access after deallocation. Additional critical issues affect the Aura, Skia, Views, and ANGLE components under CVE-2026-19149, CVE-2026-19154, CVE-2026-19172, and CVE-2026-19157. Google has withheld technical details and proof-of-concept code for several flaws to limit exploitation while the rollout completes. Users are advised to check for updates immediately through the browser's About section.
Dell Fixes 70 Vulnerabilities in VSI for VMware vSphere Including Two Critical Flaws
Dell has released an update addressing 70 vulnerabilities in Dell Virtual Storage Integrator for VMware vSphere Client, two of which are product-specific and rated critical. The advisory published on August 6, 2026, covers both native issues and flaws inherited from third-party components. CVE-2026-67261 allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges via the IAPI component. CVE-2026-54489 enables session hijacking by exposing active session credentials without authentication. The product integrates Dell storage arrays with VMware vSphere environments and is widely used in enterprise virtualization deployments. Administrators are urged to apply the latest version immediately to mitigate the risks of full system compromise and unauthorized administrative access.
Top 10 Security Stories: WordPress XSS Flaw, PHP Vulnerabilities, and VMware ESX Issues Lead Weekly Roundup
Security NEXT has published its weekly ranking of the most viewed articles for the period from August 2 to August 8, 2026. The list highlights critical vulnerabilities affecting widely used platforms including WordPress, PHP, pgAdmin 4, VMware ESX, and Chrome. Several entries focus on newly released security updates and ongoing exploitation warnings issued by US authorities. The ranking also includes real-world incidents such as credit card skimming by employees and data leaks caused by phishing attacks. This weekly overview reflects the topics that drew the highest attention from the Japanese cybersecurity community during the specified week.