Topic
Microsoft
LG Monitors Automatically Install McAfee App via Windows Update Without User Consent
Privacy & Surveillance
CISA Adds Three Exploited Vulnerabilities in FortiSandbox and SharePoint to KEV Catalog
Vulnerabilities & Exploits
CISA Urges Immediate Patching as Multiple SharePoint Server Vulnerabilities Confirmed Exploited
Vulnerabilities & ExploitsEleven Old Microsoft-Signed UEFI Shims Enable Bypass of Secure Boot on Linux Systems Still Trusting Microsoft Corporation UEFI CA 2011
Eleven legacy UEFI shim bootloaders signed by Microsoft, all version 0.9 or earlier, can be abused to bypass UEFI Secure Boot on systems whose firmware still trusts the Microsoft Corporation UEFI CA 2011 certificate. Attackers who manage to place one of these vulnerable shims in the boot path can execute arbitrary code before the operating system loads, enabling bootkits, persistence, and kernel-level compromise with minimal visibility to traditional EDR tools. The issue stems not from a new kernel bug but from the continued validity of old, correctly signed binaries that have not yet been revoked in the DBX database. Microsoft has already issued DBX revocation updates, yet administrators must first upgrade shim, GRUB, and other boot components to modern versions that support SBAT before applying the revocations to avoid bricking systems. Affected implementations include Red Hat Enterprise Linux 7.2, CentOS 7.2, Oracle Linux 7.2, openSUSE, baramundi Management Suite up to 2024R1, WipeDrive 8.0.0–8.1.3, PC Doctor Service Center, and Abitti 1. The problem is tracked under CVE-2026-8863 and CVE-2026-10797, with public references available from The Hacker News, CERT/CC VU#616257, NIST NVD, and Help Net Security.
Microsoft Pauses Windows Security Update KB5101650 After It Triggers Shutdowns and Overheating on Dell Laptops with Intel Processors
A mandatory July security update intended to patch 570 vulnerabilities in Windows instead caused spontaneous shutdowns, performance drops, overheating, and rapid battery drain on certain Dell laptops equipped with Intel processors. The root cause was traced to incompatibility between the new Windows USB-C Connection Manager interface and Intel’s Innovation Platform Framework Processor Participant driver, which manages CPU power consumption and thermal control. Microsoft had already observed early signs of the conflict in June with the optional update KB5095093, but the problematic driver changes were carried forward into the mandatory Patch Tuesday release. Because the exact list of affected Dell models was not disclosed, the full scope of the issue remains difficult to assess, though the company acted quickly to block rollout on incompatible hardware. No widespread hardware damage has been reported, and Microsoft is working with Intel and Dell to deliver a fix in the coming days while continuing to recommend the update for unaffected systems.
Microsoft Permanently Locks Hacked Account After Security Changes, Erasing 25 Years of OneDrive Data and Purchases
A streamer named Joshua Kane lost access to his Microsoft account containing 25 years of digital files, family photos, and purchased content after it was compromised by an attacker who altered security settings. Microsoft confirmed the account belonged to him and had been breached but refused to restore access, citing internal policies that prevent manual recovery once security information is changed by an unauthorized party. The company stated that OneDrive content cannot be extracted due to its encryption architecture and privacy protections, leaving the data permanently inaccessible even to Microsoft engineers. Kane was advised to create a new account and repurchase games and services, while the incident quickly gained over two million views on social media and prompted other users to share similar experiences. The case underscores the risks of insufficient account protection and the permanent consequences of account takeovers when two-factor authentication and backup strategies are not properly implemented.
Secure Boot Bypassed for Over a Decade Through Unrevoked Vulnerable Shim Bootloaders, ESET Finds
ESET researchers have disclosed that Secure Boot, the UEFI mechanism designed to block malicious code before Windows or Linux starts, could be bypassed for more than ten years using old but still-trusted shim bootloader images signed by Microsoft. The 11 vulnerable shims, some dating back to 2013, were never added to revocation lists despite known vulnerabilities, allowing attackers to load unsigned or malicious code early in the boot process. The flaw affected both Linux distributions and Windows systems because UEFI firmware does not tie a Microsoft-signed shim to a specific operating system. After Microsoft finally revoked the images in its June updates following ESET’s disclosure, users were advised to check firmware policies and Linux Vendor Firmware Service for proper propagation of the new revocation data. The incident highlights systemic weaknesses in managing thousands of signed boot components and the central trust role played by Microsoft in the UEFI ecosystem.
Microsoft Patches Record 570 Windows Vulnerabilities in July Update, Including Three Actively Exploited Zero-Days
Microsoft released its largest Patch Tuesday update to date, addressing 570 vulnerabilities across Windows and related products. Among them are three zero-day flaws, two of which have already been exploited in real-world attacks. Fifty-nine issues were rated critical, with 48 enabling remote code execution. The company credited its use of AI for discovering more vulnerabilities in the Windows codebase. The update covers a wide range of components including .NET, Active Directory services, Microsoft Office, Azure services, and Microsoft Defender. Administrators are urged to apply the patches promptly to mitigate risks from privilege escalation, remote code execution, and information disclosure flaws.
Hidden Spy for 1.6 Million Users: Popular Browser Extension ModHeader Secretly Collected Browsing History
Google and Microsoft have removed the popular ModHeader browser extension from the Chrome Web Store and Microsoft Edge Add-ons after security researchers discovered a hidden mechanism designed to secretly collect users' browsing history. The extension, which had approximately 1.6 million installations, allowed developers to modify HTTP headers for testing and debugging purposes but contained a dormant data-collection module in its legitimate codebase. British firm Stripe OLT confirmed that the suspicious code was part of the genuine signed build rather than a fake version. Although the history-stealing functionality remained inactive due to an empty internal browser list, the extension still transmitted telemetry data and could have been activated remotely via a simple update. Experts recommend immediate removal of the extension, replacement of any credentials entered through it, and blocking of the domains stanfordstudies[.]com and extensions-hub[.]com.
Windows Defender Patch for RoguePlanet Zero-Day Vulnerability May Exhaust Disk Space on Windows Systems
Microsoft released a security update addressing the RoguePlanet zero-day vulnerability (CVE-2026-50656) in the Microsoft Malware Protection Engine used by Windows Defender. The flaw, disclosed earlier by researcher NightmareEclipse, allowed remote attackers to gain administrative control over Windows 10 and Windows 11 even when real-time protection was disabled. While the patch was intended to resolve the issue and deploy automatically, the researcher now claims it introduces a new problem involving excessive disk writes. Specifically, the update may cause Defender to cache extremely large Zone.Identifier alternate data streams without size limits, potentially filling the entire drive. The attack vector involves a malicious SMB server that serves oversized metadata streams while maintaining the connection. Microsoft has not yet confirmed the reported behavior, and tensions between the company and the researcher continue over disclosure practices and bug bounty rewards.
Windows Tracks Users Through Persistent GDID Identifier: How to Minimize Your Digital Footprint
A recent case involving a 19-year-old hacker identified through his Windows installation has highlighted how Microsoft’s GDID creates a permanent device fingerprint that survives VPNs and IP changes. GDID serves as a constant identifier across licensing, Microsoft Store, telemetry, and other services, making it difficult for users to stay anonymous even when changing networks. While there is no single button to disable this functionality completely, several practical steps can significantly reduce the amount of data Windows sends to Microsoft. These include switching to a local account instead of a Microsoft Account, disabling activity history, limiting optional diagnostic data, and turning off unused background services such as Phone Link and cloud synchronization. Experts note that simply reinstalling Windows does not erase the link if the same Microsoft Account is used afterward. The story underscores the ongoing trade-off between privacy and convenience in the Windows ecosystem.