Topic
Windows
Windscribe Releases Open-Source PowerShell Script to Remove Microsoft's Persistent Global Device Identifier from Windows
Privacy & Surveillance
Zero-Day Vulnerability CVE-2026-15682 in AnyDesk Enables Denial-of-Service Attacks on Affected Systems
Vulnerabilities & Exploits
69% of Browsers Worldwide Vulnerable: How Chrome Sync Enables Stealth Surveillance Without Malware
Privacy & SurveillanceSecure Boot Bypassed for Over a Decade Through Unrevoked Vulnerable Shim Bootloaders, ESET Finds
ESET researchers have disclosed that Secure Boot, the UEFI mechanism designed to block malicious code before Windows or Linux starts, could be bypassed for more than ten years using old but still-trusted shim bootloader images signed by Microsoft. The 11 vulnerable shims, some dating back to 2013, were never added to revocation lists despite known vulnerabilities, allowing attackers to load unsigned or malicious code early in the boot process. The flaw affected both Linux distributions and Windows systems because UEFI firmware does not tie a Microsoft-signed shim to a specific operating system. After Microsoft finally revoked the images in its June updates following ESET’s disclosure, users were advised to check firmware policies and Linux Vendor Firmware Service for proper propagation of the new revocation data. The incident highlights systemic weaknesses in managing thousands of signed boot components and the central trust role played by Microsoft in the UEFI ecosystem.
Microsoft Patches Record 570 Windows Vulnerabilities in July Update, Including Three Actively Exploited Zero-Days
Microsoft released its largest Patch Tuesday update to date, addressing 570 vulnerabilities across Windows and related products. Among them are three zero-day flaws, two of which have already been exploited in real-world attacks. Fifty-nine issues were rated critical, with 48 enabling remote code execution. The company credited its use of AI for discovering more vulnerabilities in the Windows codebase. The update covers a wide range of components including .NET, Active Directory services, Microsoft Office, Azure services, and Microsoft Defender. Administrators are urged to apply the patches promptly to mitigate risks from privilege escalation, remote code execution, and information disclosure flaws.
WinFsp Vulnerability CVE-2026-3006 Allows Local Attackers to Escalate Privileges to SYSTEM via Race Condition in Kernel Driver
A critical vulnerability has been discovered in WinFsp, the open-source platform used to implement virtual disks, network file shares, and custom file systems on Windows. The flaw, tracked as CVE-2026-3006 with a CVSS 3.1 score of 7.0, affects version 2.1.25156 and all earlier releases, enabling a local attacker to trigger a race condition that leads to a memory overflow inside the kernel-mode driver. Successful exploitation grants full SYSTEM-level privileges, allowing modification of protected files, installation of services and drivers, disabling of security mechanisms, and creation of new accounts. The issue cannot be exploited remotely and requires the attacker to already have the ability to execute code on the target system, either through a compromised account or by running malicious software. WinFsp components are frequently bundled inside third-party virtualization and storage applications, significantly expanding the potential attack surface. Developers have released a fix in WinFsp 2.2B1, while Singapore’s Cyber Security Agency recommends immediate updates, restriction of local administrative rights, and monitoring for unexpected driver or service changes.
Windows Tracks Users Through Persistent GDID Identifier: How to Minimize Your Digital Footprint
A recent case involving a 19-year-old hacker identified through his Windows installation has highlighted how Microsoft’s GDID creates a permanent device fingerprint that survives VPNs and IP changes. GDID serves as a constant identifier across licensing, Microsoft Store, telemetry, and other services, making it difficult for users to stay anonymous even when changing networks. While there is no single button to disable this functionality completely, several practical steps can significantly reduce the amount of data Windows sends to Microsoft. These include switching to a local account instead of a Microsoft Account, disabling activity history, limiting optional diagnostic data, and turning off unused background services such as Phone Link and cloud synchronization. Experts note that simply reinstalling Windows does not erase the link if the same Microsoft Account is used afterward. The story underscores the ongoing trade-off between privacy and convenience in the Windows ecosystem.