Microsoft Releases Fix for Windows Defender Crashes During Quick and Full Scans
Microsoft has released a fix for a problem in Windows Defender that caused the built-in antivirus to crash during quick or full scans. The issue affected a portion of computers running Windows 10 and Windows 11 following a recent batch of patches.
Users encountered the message "Threat service has stopped. Restart it" along with access violation error 0xc0000005. In some cases, Defender failed so consistently that the service had to be restarted manually. A number of users even reinstalled Windows, believing the system was infected or irreparably damaged.
Administrators identified the problem when they could reliably reproduce the crash on multiple devices simply by launching a quick scan. This demonstrated that the fault originated in the defender software itself, which was effectively protecting Windows from its own scanning operations.
Microsoft confirmed the bug and resolved it in security intelligence update version 1.457.236.0. The correction is also present in all newer releases. Users are advised to run Windows Update and verify that the latest Defender definitions are installed, as they normally download automatically.
Manual updates can be checked in Windows Security under Virus & threat protection → Protection updates. The latest version and manual installation packages are also available on the official Microsoft page. Reinstalling the operating system is not required; updating Defender is sufficient.
Related articles
Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway products. CVE-2026-19490 permits authentication bypass via an alternate path when the appliances operate as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, or when configured as authentication, authorization, and auditing virtual servers. CVE-2026-19489 is a buffer overflow in LSN groups with SIP ALG enabled that can lead to unexpected behavior or denial of service. Both issues received CVSS v4.0 base scores of 9.3 and 8.8 respectively. Fixed builds 14.1-73.32 and 13.1-63.21 are now available along with corresponding FIPS and NDcPP updates.
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.
CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency has added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws affect Apple macOS, Microsoft SharePoint, and VMware vCenter among other products. One of the vulnerabilities, tracked as CVE-2026-65400, allows network-based authentication bypass in macOS Screen Sharing without valid credentials. The issue received a CVSS v3.1 base score of 9.8 and is rated Critical. Apple addressed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 released on August 6. Federal agencies have been instructed to apply mitigations within three days.
Apple Releases macOS Tahoe 26.6.2 Fixing 28 Vulnerabilities Including Kernel Flaws
Apple has issued macOS Tahoe 26.6.2, addressing a total of 28 security vulnerabilities tracked under CVE identifiers. The update resolves three kernel-level issues, among them a Use After Free flaw tracked as CVE-2026-65343, an out-of-bounds memory read in CVE-2026-65349, and a memory corruption problem in CVE-2026-65330. Twenty-one of the fixed vulnerabilities affect the WebKit engine, with additional patches applied to Audio, ImageIO, and IOGPUFamily components. The release incorporates fixes that were previously tested in the macOS Golden Gate 27 beta. On the following day, Apple also shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia, eliminating the same set of 21 WebKit vulnerabilities.