Collecting Cyber-News from over 60 sources

Tag: microsoft

Microsoft’s Windows Recall still allows silent data extraction

Apr 17, 2026 12:48 AM

Tags: data, detection, edr, exploit, microsoft, risk, threat, windows

Exploitation risk: The barrier to weaponizing this technique is lower than Microsoft’s security messaging would suggest, Hagenah said.”They only need code running in the user’s context and a way to reuse the authorized Recall session,” he said. “That is a much lower bar than many people would assume from Microsoft’s security messaging.”While Recall’s limitation to…
New PoC Exploit Published for Microsoft Defender 0-Day Flaw

Apr 17, 2026 12:48 AM

Tags: cve, cyber, exploit, flaw, microsoft, vulnerability, zero-day

A security researcher operating under the alias >>Chaotic Eclipse<< has publicly released a proof-of-concept (PoC) exploit for a vulnerability in Microsoft Defender. Published on April 15, 2026, the exploit targets a flaw in CVE-2026-33825, a recently patched vulnerability. The uncoordinated release highlights an escalating conflict between independent security researchers and Microsoft's vulnerability disclosure programs. Public…
April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs

Apr 17, 2026 12:48 AM

Tags: access, ai, attack, business, ciso, cloud, cve, cvss, cyber, data, exploit, firewall, flaw, identity, injection, international, ivanti, LLM, malware, microsoft, network, remote-code-execution, sap, social-engineering, software, sql, threat, tool, unauthorized, update, vulnerability, windows, zero-day

block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that…
Cisco FMC Zero-Day Among 31 High-Impact Vulnerabilities Exploited in March

Apr 17, 2026 12:48 AM

Tags: apple, cisco, citrix, cyber, exploit, firewall, google, group, microsoft, ransomware, threat, vulnerability, zero-day

31 high-impact vulnerabilities were actively exploited in March 2026, with a Cisco firewall zero-day abused by the Interlock ransomware group emerging as one of the most dangerous threats to enterprise networks. Affected vendors span core enterprise and developer ecosystems, including Cisco, Microsoft, Google, ConnectWise, Langflow, Citrix, Aquasecurity, Nginx UI, Qualcomm, F5, Craft CMS, Laravel, Apple,…
April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs

Apr 17, 2026 12:48 AM

Tags: access, ai, attack, business, ciso, cloud, cve, cvss, cyber, data, exploit, firewall, flaw, identity, injection, international, ivanti, LLM, malware, microsoft, network, remote-code-execution, sap, social-engineering, software, sql, threat, tool, unauthorized, update, vulnerability, windows, zero-day

block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that…
Microsoft’s Original Windows Secure Boot Certificate Is Expiring

Apr 17, 2026 12:48 AM

Tags: microsoft, update, windows

The Secure Boot refresh is one of the largest coordinated security maintenance efforts across the Windows ecosystem, Microsoft said. Update those PCs soon. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/microsoftoriginal-windows-secure-boot-certificates-expire
Microsoft ends desktop detour for sensitivity labels in Office web apps

Apr 15, 2026 12:52 AM

Tags: control, microsoft, office, update

Microsoft is rolling out an update to Office for the web that removes a long-standing limitation around document protection, adding new control to browser-based apps. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/15/microsoft-office-sensitivity-labels-permissions/
Microsoft adds Windows protections for malicious Remote Desktop files

Apr 15, 2026 12:52 AM

Tags: attack, malicious, microsoft, phishing, windows

Microsoft has introduced new Windows protections to defend against phishing attacks that abuse Remote Desktop connection (.rdp) files, adding warnings and disabling risky shared resources by default. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-adds-windows-protections-for-malicious-remote-desktop-files/
Privilege Elevation Dominates Massive Microsoft Patch Update

Apr 15, 2026 12:52 AM

Tags: microsoft, update, vulnerability, zero-day

Elevation-of-privilege bugs accounted for more than half of the 165 vulnerabilities patched, with two zero-days in that mix. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/privilege-elevation-dominates-microsoft-patch-update
Microsoft drops its second-largest monthly batch of defects on record

Apr 14, 2026 11:52 PM

Tags: exploit, microsoft, office, vulnerability, zero-day

The vendor disclosed one actively exploited zero-day vulnerability in Microsoft Office SharePoint that allows attackers to view information and make changes to disclosed information. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-patch-tuesday-april-2026/
Microsoft’s massive Patch Tuesday: It’s raining bugs

Apr 14, 2026 11:52 PM

Tags: attack, cve, microsoft, update

One CVE under attack, one already disclosed by angry bug hunter, and 163 more First seen on theregister.com Jump to article: www.theregister.com/2026/04/14/microsofts_massive_patch_tuesday/
Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)

Apr 14, 2026 10:53 PM

Tags: advisory, api, attack, best-practice, cloud, container, cve, cvss, cyber, data, exploit, firewall, firmware, flaw, framework, github, Internet, malicious, microsoft, mitigation, office, powershell, rce, remote-code-execution, service, software, sql, startup, tool, update, vulnerability, windows, zero-day

8Critical 154Important 1Moderate 0Low Microsoft addresses 163 CVEs in the April 2026 Patch Tuesday release, including two zero-day vulnerabilities, one of which was exploited in the wild. Microsoft patched 163 CVEs in its April 2026 Patch Tuesday release, with eight rated critical, 154 rated as important and one rated as moderate. This is the second…
Microsoft Discloses ‘Monstrous’ Number Of Bugs As AI Discoveries Surge: Researcher

Apr 14, 2026 10:53 PM

Tags: ai, cve, LLM, microsoft, tool, vulnerability

The unusually large number of CVEs (Common Vulnerabilities and Exposures) disclosed by Microsoft Tuesday is “likely” to be linked to AI-related developments, including the increasing discoveries of vulnerabilities using LLM-powered tools, according to a TrendAI researcher. First seen on crn.com Jump to article: www.crn.com/news/security/2026/microsoft-discloses-monstrous-number-of-bugs-as-ai-discoveries-surge-researcher
Microsoft Patch Tuesday for April 2026 – Snort Rule and Prominent Vulnerabilities

Apr 14, 2026 10:53 PM

Tags: microsoft, update, vulnerability

Overview of patch tuesday release from Microsoft for April 2026. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/microsoft-patch-tuesday-april-2026/
Microsoft releases Windows 10 KB5082200 extended security update

Apr 14, 2026 8:52 PM

Tags: microsoft, update, vulnerability, windows

Microsoft has released the Windows 10 KB5082200 extended security update to fix the April 2026 Patch Tuesday vulnerabilities, including 2 zero-days. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5082200-extended-security-update/
Windows 11 cumulative updates KB5083769 & KB5082052 released

Apr 14, 2026 8:52 PM

Tags: microsoft, update, vulnerability, windows

Microsoft has released Windows 11 KB5083769 and KB5082052 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-cumulative-updates-kb5083769-and-kb5082052-released/
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

Apr 14, 2026 8:52 PM

Tags: flaw, microsoft, update, zero-day

Today is Microsoft’s April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-april-2026-patch-tuesday-fixes-167-flaws-2-zero-days/
Microsoft rolls out fast-track to reinstate Windows hardware dev accounts

Apr 14, 2026 6:52 PM

Tags: access, Hardware, microsoft, windows

Microsoft has rolled out a fast-track process to help developers regain access to accounts recently suspended from its Windows Hardware Program, following widespread complaints that they were locked out without warning. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-fast-track-to-reinstate-windows-hardware-dev-accounts/
Martin Baron ist neuer Channel-Manager bei Coreview

Apr 14, 2026 3:52 PM

Tags: microsoft

Martin Baron ist neuer Channel Account Manager für DACH und Osteuropa bei Coreview, Spezialist für den Schutz und das Management von Microsoft-365-Tenants. Sein Schwerpunkt liegt dabei auf der Entwicklung und Umsetzung der Partnerstrategie und dem Ausbau des Partner-Ökosystems. Nach Lukas Haas und Nurschan Bisenov als Enterprise Account Executives ist Baron somit die dritte Verstärkung des…
DavMail 6.6.0 patches a regex flaw and advances its Microsoft Graph backend

Apr 14, 2026 3:52 PM

Tags: flaw, mail, microsoft, office, update

Organizations that run DavMail to bridge standard mail clients to Microsoft Exchange or Office 365 received an update this week. Version 6.6.0 addresses a code-scanning alert … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/14/davmail-6-6-0-released/
CISA Alerts on Exploited Microsoft Exchange and Windows CLFS Security Flaws

Apr 14, 2026 1:51 PM

Tags: cisa, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windows

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding two actively exploited security vulnerabilities in Microsoft products. Added to the Known Exploited Vulnerabilities (KEV) catalog on April 13, 2026, these flaws impact the Microsoft Windows Common Log File System (CLFS) and Microsoft Exchange Server. Federal agencies and private organizations are strongly…
U.S. CISA adds Adobe, Fortinet, Microsoft Exchange Server, and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog

Apr 14, 2026 10:52 AM

Tags: adobe, apple, cisa, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, microsoft, vulnerability, windows

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe, Fortinet, Microsoft Exchange Server, and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: Last week,…
Windows 11: Microsoft testet freie Datumswahl für Updates

Apr 14, 2026 9:52 AM

Tags: microsoft, update, windows

Microsoft testet unter Windows 11 eine Kalender-Auswahl für Update-Pausen. Ab Mai 2026 soll zudem Hotpatching störende Neustarts minimieren. First seen on golem.de Jump to article: www.golem.de/news/windows-11-microsoft-testet-freie-datumswahl-fuer-updates-2604-207525.html
CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

Apr 14, 2026 8:52 AM

Tags: adobe, cisa, cve, cybersecurity, exploit, flaw, fortinet, infrastructure, injection, microsoft, software, sql, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The list of vulnerabilities is as follows -CVE-2026-21643 (CVSS score: 9.1) – An SQL injection vulnerability in Fortinet FortiClient EMS that could allow an unauthenticated attacker to First seen on thehackernews.com…
Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum

Apr 14, 2026 12:52 AM

Tags: microsoft, ransomware

One was patched almost 14 years ago First seen on theregister.com Jump to article: www.theregister.com/2026/04/13/ransomware_gang_other_crims_attacking/
Claude Mythos Could Flood Vendors With Fixes They Deferred

Apr 14, 2026 12:52 AM

Tags: cio, exploit, flaw, microsoft, software, update

Ex-Microsoft CIO: Mythos Could Surface Known Flaws Faster Than Vendors Can Fix Them. Former Microsoft CIO Jim DuBois and IDC’s Frank Dickson say Claude Mythos Preview could rapidly surface long-known but unfixed software flaws at scale, forcing vendors and enterprises to strengthen patch validation, orchestration and deployment before attackers exploit the backlog. First seen on…
Mailbox Rule Abuse Emerges as Stealthy Post-Compromise Threat

Apr 13, 2026 5:52 PM

Tags: access, data, microsoft, threat

Attackers are abusing Microsoft 365 mailbox rules to hide activity, exfiltrate data and retain access after account compromise, researchers warn First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mailbox-rule-abuse-stealthy-post/
Kein Fix erwartet: Uhr auf Windows-Sperrbildschirm geht absichtlich nach

Apr 13, 2026 1:52 PM

Tags: microsoft, windows

Die Uhrzeit auf dem Lockscreen von Windows aktualisiert sich teilweise verzögert. Microsoft will daran nichts ändern. Das Verhalten sei beabsichtigt. First seen on golem.de Jump to article: www.golem.de/news/kein-fix-erwartet-uhr-auf-windows-sperrbildschirm-geht-absichtlich-nach-2604-207497.html
NHS pays £46K to prep next Microsoft licensing round

Apr 13, 2026 11:52 AM

Tags: microsoft, software

Benchmarking contract lays groundwork for renegotiating £774M software agreement First seen on theregister.com Jump to article: www.theregister.com/2026/04/13/nhs_benchmarking_microsoft/
7 Privilege Management Mistakes That Put Business Data at Risk

Apr 13, 2026 6:52 AM

Tags: access, api, attack, authentication, breach, business, control, credentials, cyber, cybersecurity, dark-web, data, data-breach, detection, email, exploit, extortion, finance, github, governance, government, hacker, ibm, identity, infrastructure, insurance, ISO-27001, jobs, least-privilege, login, mfa, microsoft, monitoring, network, okta, password, privacy, radius, ransomware, regulation, risk, russia, scam, service, software, supply-chain, theft, threat, tool, unauthorized, usa, vpn, vulnerability, zero-trust

Every growing business has at least one lingering privilege management issue. It’s not because your team is lazy. It’s because organizations grow, restructure and hire far faster than manual access processes can keep up. When roles evolve or contractors come and go, permissions accumulate behind the scenes”, creating invisible attack paths. In this post, we…