Do Son 0patch found an unpatched flaw in Windows RasMan that allows any user to crash the service on demand. This unprivileged crash is the necessary step to exploit the CVE-2025-59230 LPE flaw. Micropatch is available.
windows
A High-severity Vim for Windows flaw (CVE-2025-66476) allows arbitrary code execution. The editor executes malicious binaries in the current working directory instead of safe system paths when running commands like :grep.
ASUS urges users to patch a high-severity LPE flaw (CVE-2025-59373) in its System Control Interface Service, which allows low-privileged users to escalate to full SYSTEM control.
Microsoft Store now supports multi-app batch installation, allowing users to select and install multiple recommended apps from a curated list in a single click.
Edge v142.0 introduces cross-platform passkey sync, letting users reuse passkeys securely across devices with a PIN, enhancing passwordless authentication.
A serious Windows LPE flaw in DirectComposition allows local attackers to gain SYSTEM privileges by exploiting a type confusion bug leading to a controlled out-of-bounds write in kernel memory.
A flaw (CVE-2025-58726) allows SYSTEM privilege escalation via Kerberos authentication reflection using "Ghost SPNs" and disabled SMB signing. Patch immediately.
Samsung launched the Samsung Internet browser beta for Windows 10/11, featuring cross-device sync and Galaxy AI capabilities to advance its ambient AI ecosystem vision.
Microsoft’s latest Bing Wallpaper update covertly launches Bing Search when users click the desktop, appearing to artificially inflate the search engine’s traffic.
Meta is discontinuing the Messenger desktop app for macOS/Windows on Dec 15, pushing users to the web/Facebook app. Users must enable Secure Storage to save their chat history.
NVIDIA released an urgent update for its GPU Display Driver, fixing multiple high-severity flaws including RCE via an uncontrolled DLL loading path (CVE-2025-23309). Update now.
Microsoft Word's Windows preview build will now default to OneDrive and AutoSave for new documents, mirroring Microsoft's broader strategy to drive cloud storage and synchronization.
CrowdStrike patched two flaws in Falcon Sensor for Windows (CVE-2025-42701). Attackers with local code execution can delete arbitrary files, risking system stability.
Deno patched a High-severity flaw (CVE-2025-61787) allowing Command Injection on Windows when spawning batch files. Attackers can execute arbitrary commands via malicious arguments.
XWorm V6.0 has resurfaced with 35+ plugins, including ransomware functionality. The modular RAT uses stealth injection and obfuscated PowerShell to bypass AMSI.
LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.
AhnLab has uncovered Kawa4096, a Go-based ransomware targeting Windows, Linux, and VMware ESXi. The malware uses advanced crypto and covert backup deletion.
A new technique, "EDR-Freeze," uses a built-in Windows feature to suspend antivirus and EDR processes, giving attackers a critical window to operate undetected.
AhnLab has uncovered BlackLock, a Go-based ransomware targeting Windows, Linux, and VMware ESXi. The malware uses advanced crypto and covert backup deletion.
A new supply chain attack on PyPI is delivering SilentSync, a Python RAT. The malware steals credentials and files from developers' systems.
Wine 10.15 is here with a new NTSYNC driver that promises to boost Windows game performance on Linux, paving the way for Proton 11.
Microsoft is testing a full-screen "SCOOBE" interface in Windows 11 to remind users about Microsoft 365 subscriptions, and it may block access to the desktop.