Microsoft Defender Displays False 'Enable Virus Protection' Alerts on Windows Despite Active Real-Time Protection
Microsoft has confirmed a bug in Microsoft Defender that causes Windows to display misleading notifications prompting users to "Turn on virus protection" even though the antivirus is already active with real-time protection enabled.
The false alerts began appearing after the latest Microsoft Defender updates. They trigger either when the computer starts or during regular operation. Pressing the notification does nothing to resolve the issue and simply redirects users to the main page of the Windows Security application. While the banner can be dismissed manually, it often reappears with the same message shortly afterward.
The problem impacts Windows 11 versions 23H2, 24H2, and 25H2, as well as Windows 10 and all Windows Server releases that use the current version of Microsoft Defender. The root cause lies in the antivirus update itself rather than any specific operating system build.
The notification system behaves particularly aggressively, bypassing standard Windows notification settings and continuing to appear even when "Do Not Disturb" mode is enabled. Microsoft is actively working on a fix and plans to include it in an upcoming Microsoft Defender update, although no release date has been announced.
Security experts still recommend verifying the actual status of protection before ignoring any such banner, as similar messages can be generated by genuine malware. Users can check the status in Windows Security → Virus & threat protection, ensuring that Real-time protection is turned on. For a more detailed verification, the following PowerShell command can be executed:
Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled
If all three parameters return True, Microsoft Defender is functioning correctly and the notification can be safely disregarded.
Related articles
Positive Technologies Develops Dynamic Crawler for Single-Page Applications in PT BlackBox Scanner
Positive Technologies engineers have detailed the development of a dynamic crawler for their PT BlackBox DAST scanner to handle modern single-page applications built with frameworks such as React and Vue. The crawler must discover attack surface elements that only appear after user interactions because static parsing of initial DOM fails on SPAs where navigation occurs without URL changes. Key challenges include identifying interactive elements whose handlers are attached via JavaScript, detecting state changes after clicks or inputs, and managing combinatorial explosion of states caused by independent UI toggles. The team models the application as a labeled transition system and defines state equivalence using sets of 64-bit fingerprints of interactive elements rather than raw HTML similarity or URL values. This equivalence relation satisfies reflexivity, determinism from external observations, cheap hash-based comparison, slower growth than action count, and preservation of enabled actions across equivalent states. The approach allows the crawler to visit representatives of equivalence classes instead of every reachable state, keeping scans finite and practical within action budgets of several thousand interactions.
Over 8,300 Gitea Servers Remain Exposed to Remote Code Execution via CVE-2026-60004
Thousands of publicly accessible Gitea instances were still unpatched against CVE-2026-60004 as of late August 2026, leaving them open to remote command execution. The critical vulnerability combines abuse of the diffpatch endpoint with the ability to install and trigger attacker-controlled Git hooks, allowing unauthenticated attackers to run commands on the server. Exploitation requires only write access to a repository, which is often trivial due to default open user registration in many deployments. The issue was fixed in Gitea 1.27.1 released on July 27, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a remediation deadline of August 28 for U.S. federal agencies. In observed incidents, attackers used the access to deploy cryptocurrency miners inside Docker containers. A related authentication bypass affecting the official Docker image, CVE-2026-20896, was also noted when reverse-proxy headers such as X-WEBAUTH-USER are enabled.
Weekly Roundup: Next.js Leads Critical Vulnerability Reports as Chrome, Tomcat, and PostgreSQL See Major Patches
Security NEXT has published its list of the ten most-read articles for the week of August 23-29, 2026. The top story covered multiple serious vulnerabilities in Next.js that prompted an accelerated release schedule. Other high-interest items included a critical flaw in Zscaler Client Connector, several issues in Apache Tomcat rated critical, and Google’s Chrome 152 update fixing 327 vulnerabilities. Additional reports highlighted a ransomware incident at a systems development firm, flaws in SKYSEA Client View, 28 vulnerabilities fixed in PostgreSQL, and confirmed exploitation of six known flaws in SQL Server and NetScaler. The list also featured a vulnerability in the Android version of the Digital Agency’s My Number Point app and warnings about active exploitation of a WebLogic module flaw.
Multiple Critical Vulnerabilities in Langflow Enable Remote Code Execution
IBM disclosed three severe vulnerabilities in the open-source Langflow project on August 24, 2026. The flaws affect server instances and allow attackers to execute arbitrary code under specific conditions. CVE-2026-19286 is a code injection issue in the Agent-to-Agent (A2A) public endpoint that bypasses existing restrictions when authentication is disabled. CVE-2026-19295 permits authenticated users to evade custom component restrictions via eval injection in flow templates, leading to OS-level command execution. CVE-2026-18729 stems from insufficient input validation and lets low-privileged authenticated users bypass protected paths to run arbitrary code on the server. Patches addressing all three issues are now available.