Windows Lacks Official Patch for LegacyHive Zero-Day; 0Patch Delivers Free Micro-Patch
A fresh zero-day vulnerability in Windows has received unofficial patches from ACROS Security, the developer of the 0Patch platform, after Microsoft failed to release an official fix. The flaw, dubbed LegacyHive, affects the user profile service and currently lacks a CVE identifier.
The vulnerability was discovered by researcher Nightmare Eclipse and publicly disclosed on 14 July, the same day Microsoft issued its monthly security updates. LegacyHive permits a standard user to mount another user's registry hive with complete access rights. Once mounted, an attacker can extract stored credentials or alter registry values to achieve automatic code execution the next time an administrator logs in.
Exploit functionality has been independently verified by security researchers Will Dormann and Kevin Beaumont. Kevin Beaumont additionally published detection queries for Microsoft Defender for Endpoint to help organizations identify potential exploitation attempts.
Microsoft has confirmed awareness of the issue and is reviewing the details, yet no official patch has been issued. ACROS Security addressed the gap by releasing a free micro-patch that alters the behavior of the vulnerable component. The exploit still runs, but instead of accessing the real administrator profile it receives only a disposable temporary registry hive, rendering the attack ineffective.
The micro-patch is available for Windows 10 version 2004 and newer, as well as Windows Server 2022 and subsequent releases. Users must register with 0Patch and deploy the agent; once installed, the patch applies automatically without requiring a system reboot, provided enterprise policies permit it.
No evidence of in-the-wild exploitation of LegacyHive has been reported so far.
Related articles
Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability in Gitea, tracked as CVE-2026-20896 with a CVSS score of 9.8, allows attackers to gain administrative access and read private repositories by sending a single HTTP header. The root cause lies in the official Docker image defaulting the REVERSE_PROXY_TRUSTED_PROXIES setting to a wildcard, trusting the X-WEBAUTH-USER header from any source when reverse-proxy authentication is enabled. The researcher reproduced the full attack on a live vulnerable instance, demonstrating how an unauthenticated request could retrieve secret files such as .env containing database passwords and cloud keys. Multiple related access-control flaws were also disclosed in the same year, including CVE-2026-27771 affecting the container registry, CVE-2026-22874 in webhooks, and CVE-2026-28740 in LFS handling. The recommended fix involves explicitly setting trusted proxy IPs or disabling reverse-proxy authentication entirely and upgrading to version 1.26.4 or later. The issue highlights recurring problems with overly permissive defaults in self-hosted DevOps tools.
WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has issued version 7.0.2 along with other security releases on July 17, 2026, addressing two critical vulnerabilities identified as CVE-2026-63030 and CVE-2026-60137. When combined, these flaws enable remote attackers to execute arbitrary code on affected installations. CVE-2026-60137 stems from insufficient input validation in certain functions, potentially allowing SQL injection when processing untrusted data from plugins or themes. CVE-2026-63030 involves route interpretation confusion in the REST API batch endpoint, which can be leveraged alongside the SQL injection issue to achieve code execution. The vulnerabilities impact WordPress 6.8 and later branches, although chained attacks are not possible on the 6.8 series. Administrators are urged to apply the updates immediately to mitigate the risks.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has released a new security update for its Chrome browser addressing seven vulnerabilities just two days after the previous patch. The update covers Windows, macOS, and Linux platforms with versions Chrome 150.0.7871.129 and 150.0.7871.128. Three of the issues, tracked as CVE-2026-15899, CVE-2026-15900, and CVE-2026-15901, received the highest severity rating of Critical and involve Use After Free flaws in CameraCapture, GPU, and Network components. Four additional High-severity vulnerabilities were also fixed, including an out-of-bounds access issue in the V8 JavaScript engine and Use After Free problems in Cast, Ozone, and Aura. The company plans to roll out the patches gradually over the coming days and weeks to all users.