35 Apache vulnerabilities fixed, including Apache ZooKeeper flaws CVE-2026-115448 and CVE-2026-100252, plus OpenOffice, ActiveMQ and Juneau bugs.

Related Posts:

• Cisco Patches High-Severity Remote Code Execution in UCS Central Alongside ISE and Unified CM Flaws
• Attackers Exploit Critical GPUStack Authentication Bypass in the Wild to Run Reverse Shells
• Control Web Panel Patches Ten Flaws Allowing Unauthenticated Root Code Execution

The post Apache Vulnerabilities in ZooKeeper, OpenOffice, ActiveMQ and Juneau Get Fixes appeared first on Daily CyberSecurity.

Denmark ends Collabora pilot testing across its public sector after formatting errors disrupted case workflows, securing a quiet victory for Microsoft.

Related Posts:

• Microsoft Voluntary Buyout Program Targets 60,000 Staff
• Apple Blocks eMudhra Certificates Over Weak Key Flaw
• Anthropic S-1 IPO Filing Targets Historic $2T Valuation

The post Denmark Ends Collabora Pilot in Blow to Open Source appeared first on Daily CyberSecurity.

OOXML standardization history: The Document Foundation says Microsoft steered ISO approval in 2006-2008. Microsoft disputes such claims.

Related Posts:

• Apple Presto Return Scanner Targets In-Box Fraud
• Come Back to Firefox Campaign Champions Web Privacy
• OpenSSL 4.1.0 Release Introduces Elbrus Support and DTLS 1.3

The post Document Foundation Revisits the OOXML Standard Fight appeared first on Daily CyberSecurity.

Law enforcement agencies in the United States and France have seized two CSAM domains linked to NudeLeaksTeens (NLT), a website that advertised hacked and stolen sexually explicit images and videos of young women and girls for sale. French authorities simultaneously arrested a 25-year-old man in Northern France suspected of being the site's main administrator. The action was announced by the U.S. Attorney's Office for the Eastern District of Virginia (EDVA), the FBI Washington Field Office, and the Cybercrime Division of France's Parquet de Paris. It was carried out under Operation Inevitable, a coordinated effort against the spread of child sexual abuse material (CSAM) and the non-consensual publication of intimate images. The seizure notice now displayed on the sites also references Operation Torch.

What the Seized CSAM Domains Offered

According to the seizure warrant, NLT sold leaked content that had been hacked and stolen from victims. Investigators found that despite warnings on the website against CSAM, the site also offered sexually explicit images and videos of children. [caption id="attachment_114652" align="aligncenter" width="600"] Image Source: FBI[/caption] The site sold content in packages it called "albums" and "collections." Many included victims' personal identifying information alongside explicit material. Some victims have been identified and confirmed to have been minors when the images were created. One package named after the site claimed to contain 6,200 private files of teenagers and adults, mostly American, taken from hacked Snapchat, Instagram, TikTok, and Facebook accounts. Authorities say this collection also contained CSAM.

How the CSAM Domains Were Taken Down

The United States obtained court authorization to seize both domains. Visitors now see a notice stating that the FBI took control of the sites under a seizure warrant issued by the U.S. District Court for the Eastern District of Virginia, citing several federal statutes. The notice carries the insignia of the FBI, the Department of Justice, the Arlington County Police Department, the Parquet de Paris, and the French Gendarmerie's national cyber unit, UNCyber. In France, police arrested a 25-year-old man living in the northern part of the country who is suspected to have been NLT's main administrator. The arrest was carried out at the same time as the seizure of the CSAM domains.

FBI Comments on CSAM Domains Seizure

Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, said, "The seizure of these domains represents a decisive step in dismantling the criminal networks that hide behind anonymous online platforms to exploit victims." Cox said the operation cut off the infrastructure used to distribute images and videos obtained by hacking victims' social media accounts, striking at the core of the illicit marketplace. He added that the FBI will continue to act against those who use the internet to cause harm, wherever they operate and whoever they target. The announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for EDVA; Cox; and Charles "Andy" Penn, Arlington County Chief of Police. The Justice Department's Office of International Affairs provided significant assistance. Assistant U.S. Attorneys April Russo, Lauren Halper, and Meredith Clement are representing the United States.

A Joint Effort Against Online Exploitation

Officials credited cooperation among national, international, and private sector partners for the operation. The case shows how hacked social media accounts can become a source of material sold on illicit sites, affecting both adults and minors.

PoC released for LibreOffice Calc vulnerability CVE-2026-63277, which runs code when a file opens. Five more flaws fixed. Upgrade to 26.2.5.

Related Posts:

• Murrelektronik Will Not Fix Critical AAS Edge Client Flaw CVE-2026-94293, Urges Removal
• Researchers Publish Full Details and PoC Exploit for a WordPress libheif RCE Chain
• Critical Atlassian Flaw CVE-2026-21589 Exposes Files in Jira, Confluence, Bitbucket and Five More Products

The post PoC Exploit and Technical Details Released for LibreOffice Calc Code Execution Flaw CVE-2026-63277 appeared first on Daily CyberSecurity.

Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators. The focus is not only on stopping attacks after they are detected, but on finding signs that an attacker has gained access and is quietly moving through a system without triggering an alert. The government will develop ways to detect these threats and share the methods with private-sector operators, while the Defense Ministry will be able to provide personnel to assist companies when requested.

Japan Threat Hunting to Target Hidden Cyber Threats

The initiative forms part of Japan’s broader active cyber defense efforts. Threat hunting involves actively searching systems for signs of malicious activity rather than waiting for an alert or confirmed attack. Japan’s National Cybersecurity Office plans to use information about potential threats to recreate attack scenarios in a virtual environment. The office will then develop and test detection methods that can be used by private-sector companies. The aim is to help critical infrastructure operators identify attackers that may have already entered their systems and remained undetected. Detecting such activity could also help reduce the risk of a cyberattack disrupting essential services during an emergency. Legislation related to active cyber defense took effect on Thursday, giving the government a framework for expanding these cybersecurity measures.

Defense Ministry to Assist Critical Infrastructure Operators

Japan’s Defense Ministry is also preparing to provide direct support to operators of critical infrastructure. Companies will be able to request assistance, after which the ministry could dispatch personnel with threat-hunting experience developed through the information systems of Japan’s Self-Defense Forces. The National Cybersecurity Office and Defense Ministry have included the related costs in their fiscal 2027 budget requests. Threat hunting can require considerable resources because security teams need to collect and examine large amounts of system event logs. The purpose is to identify unusual activity that may otherwise go unnoticed. NTT Data Japan has been carrying out proactive threat hunting on its own systems since 2024. The company checks system logs for suspicious activity even when there has been no security alert. A representative of the National Cybersecurity Office also said threat-hunting methods could help address ransomware. Such attacks can involve attackers exploring a victim’s systems after gaining initial access, meaning suspicious activity may exist before the ransomware itself is deployed.

Recent Cyberattacks Add to Japan’s Concerns

Japan’s planned expansion of threat hunting comes as cyber incidents have affected government networks and companies across different sectors. In September 2026, the government disclosed that its common infrastructure network had been targeted in a cyberattack that began in May. Digital Minister Hisashi Matsumoto said about 246,000 personal records could have been leaked. The affected Government Solution Service, or GSS, is used by government agencies and independent administrative agencies. The potentially exposed information included about 189,000 employee records and around 57,000 records belonging to businesses and individuals involved in agency operations. An analysis found that a third party had compromised the system by exploiting a bypass involving a virtual private network, or VPN. Other recent incidents have affected private-sector operations. The Nichirei cyberattack in July disrupted food deliveries after the frozen food and logistics company confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan. Nihon Kotsu also recently reported a malware-related incident that disrupted taxi dispatch services after parts of its IT infrastructure were taken offline. Earlier incidents involving Aflac Japan, KDDI, Sapporo Holdings and Nidec showed that attackers could gain access through subsidiaries, overseas operations or third-party infrastructure. Japan’s fiscal 2027 plans therefore put greater emphasis on looking for attackers that may already be inside a network, rather than relying only on alerts after suspicious activity has become visible.

Unpatched Apache OpenOffice vulnerability CVE-2026-59265 runs code via crafted files. Apache Directory LDAP API and Traffic Server fixes out.

Related Posts:

• Citrix NetScaler CVE-2026-88779 Exploited in the Wild to Knock SAML Gateways Offline
• Microsoft Reissues September 2026 Exchange Server Security Updates to Add CVE-2026-96940
• AWS Fixes Loom for AWS Admin Takeover and SageMaker Unified Studio Code Execution Flaws

The post Unpatched Apache OpenOffice Vulnerability Leads New Apache Advisories for LDAP API and Traffic Server appeared first on Daily CyberSecurity.

Hana Financial’s new headquarters runs private 5G across 16 floors, giving roughly 3,000 employees secure wireless access to internal systems.

The post Private 5G Moves Into Banking at Hana Financial’s 16-Floor Headquarters appeared first on TechRepublic.

Discover how the flawed KB5002907 update deletes Office licenses and uninstalls the suite. Learn the temporary fix for Microsoft 365, 2016, and 2019 users.

Related Posts:

• OpenAI to Unveil Project 'O' at DevDay
• GitHub Blocks New Outlook and Hotmail Sign-Ups
• Microsoft Unveils the Next Generation of Copilot

The post KB5002907 Update Causes Unexpected Office Deletions appeared first on Daily CyberSecurity.

The Hisense U7 is a solid Mini LED TV for streaming, gaming, and more – especially at this price.

The UK Home Office has once again demanded Apple allows it access to encrypted iCloud data.

The Guardian reports that the Home Office issued a Technical Capability Notice to Apple, this time targeting only British users. A Technical Capability Notice is a formal government order that compels tech and telecommunications companies to build or maintain specific technical functions—such as intercepting data or removing encryption protections—so law enforcement can access communications.

In the last round of this ongoing battle, the UK secretly ordered Apple to provide blanket access to protected iCloud backups around the world. Advanced Data Protection (ADP) is Apple’s opt‑in end‑to‑end encryption for iCloud backups, which even Apple itself cannot read. Apple argued that weakening or removing ADP would expose users to data breaches and other threats, and instead chose in January 2025 to withdraw ADP for UK customers rather than build a backdoor, while leaving it available elsewhere.

So, instead of working to keep citizens safe and secure, the Home Office just ended up removing an option for them.

Apple has responded by lodging a complaint with the Investigatory Powers Tribunal (IPT), seeking to challenge the scope and lawfulness of the government’s powers to issue such notices under the Investigatory Powers Act. The Tribunal is an independent court that has the power to investigate claims that the UK intelligence services have acted unlawfully.

Privacy International and Liberty have parallel complaints at the IPT challenging Technical Capability Notices more broadly, including their secrecy and necessity, and have asked for Apple’s claim to be heard in public given its wide public-interest implications.

I feel the fear of leaving an intentional backdoor is justified. If it exists, there is a chance that (AI-assisted) criminals will find and exploit it.

Weighing the importance of the right to privacy and the ability to investigate cases including terrorism and child sexual abuse is not easy. Apple’s ADP is used by many and as soon as criminals would know it’s no longer safe for them to use, they’d move to other platforms. Platforms where no legislative power will be able to gain access.

Reddit r/privacy users have been discussing alternatives for a year.

But, given the danger of a backdoor becoming available for criminals, we think in this case privacy should prevail. Let us know how you feel in the comments.

---

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Shop early Amazon Prime Day tech deals on earbuds, mice, routers, doorbells, headphones, smartwatches, Android phones, and fitness watches.

The post Best Prime Day Tech Deals: Apple, Bose, Garmin, and More appeared first on TechRepublic.

Small business owners should be sure to fix these three non-technical risks that require little cybersecurity expertise.

The post 3 easy-to-miss cybersecurity risks for small businesses appeared first on Security Boulevard.

Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.

Microsoft said in a blog post today it identified more than 200 organizations and 5,000 consumer devices that were caught up in a stealthy but remarkably simple spying network built by a Russia-backed threat actor known as “Forest Blizzard.”

Also known as APT28 and Fancy Bear, Forest Blizzard is attributed to the military intelligence units within Russia’s General Staff Main Intelligence Directorate (GRU). APT 28 famously compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.

Researchers at Black Lotus Labs, a security division of the Internet backbone provider Lumen, found that at the peak of its activity in December 2025, Forest Blizzard’s surveillance dragnet ensnared more than 18,000 Internet routers that were mostly unsupported, end-of-life routers, or else far behind on security updates. A new report from Lumen says the hackers primarily targeted government agencies—including ministries of foreign affairs, law enforcement, and third-party email providers.

Black Lotus Security Engineer Ryan English said the GRU hackers did not need to install malware on the targeted routers, which were mainly older Mikrotik and TP-Link devices marketed to the Small Office/Home Office (SOHO) market. Instead, they used known vulnerabilities to modify the Domain Name System (DNS) settings of the routers to include DNS servers controlled by the hackers.

As the U.K.’s National Cyber Security Centre (NCSC) notes in a new advisory detailing how Russian cyber actors have been compromising routers, DNS is what allows individuals to reach websites by typing familiar addresses, instead of associated IP addresses. In a DNS hijacking attack, bad actors interfere with this process to covertly send users to malicious websites designed to steal login details or other sensitive information.

English said the routers attacked by Forest Blizzard were reconfigured to use DNS servers that pointed to a handful of virtual private servers controlled by the attackers. Importantly, the attackers could then propagate their malicious DNS settings to all users on the local network, and from that point forward intercept any OAuth authentication tokens transmitted by those users.

Because those tokens are typically transmitted only after the user has successfully logged in and gone through multi-factor authentication, the attackers could gain direct access to victim accounts without ever having to phish each user’s credentials and/or one-time codes.

“Everyone is looking for some sophisticated malware to drop something on your mobile devices or something,” English said. “These guys didn’t use malware. They did this in an old-school, graybeard way that isn’t really sexy but it gets the job done.”

Microsoft refers to the Forest Blizzard activity as using DNS hijacking “to support post-compromise adversary-in-the-middle (AiTM) attacks on Transport Layer Security (TLS) connections against Microsoft Outlook on the web domains.” The software giant said while targeting SOHO devices isn’t a new tactic, this is the first time Microsoft has seen Forest Blizzard using “DNS hijacking at scale to support AiTM of TLS connections after exploiting edge devices.”

Black Lotus Labs engineer Danny Adamitis said it will be interesting to see how Forest Blizzard reacts to today’s flurry of attention to their espionage operation, noting that the group immediately switched up its tactics in response to a similar NCSC report (PDF) in August 2025. At the time, Forest Blizzard was using malware to control a far more targeted and smaller group of compromised routers. But Adamitis said the day after the NCSC report, the group quickly ditched the malware approach in favor of mass-altering the DNS settings on thousands of vulnerable routers.

“Before the last NCSC report came out they used this capability in very limited instances,” Adamitis told KrebsOnSecurity. “After the report was released they implemented the capability in a more systemic fashion and used it to target everything that was vulnerable.”

TP-Link was among the router makers facing a complete ban in the United States. But on March 23, the U.S. Federal Communications Commission (FCC) took a much broader approach, announcing it would no longer certify consumer-grade Internet routers that are produced outside of the United States.

The FCC warned that foreign-made routers had become an untenable national security threat, and that poorly-secured routers present “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”

Experts have countered that few new consumer-grade routers would be available for purchase under this new FCC policy (besides maybe Musk’s Starlink satellite Internet routers, which are produced in Texas). The FCC says router makers can apply for a special “conditional approval” from the Department of War or Department of Homeland Security, and that the new policy does not affect any previously-purchased consumer-grade routers.

Overview On March 11, NSFOCUS CERT detected that Microsoft released the March Security Update patch, which fixed 83 security issues involving widely used products such as Windows, Microsoft Office, Microsoft SQL Server, Azure, etc., including high-risk vulnerability types such as privilege escalation and remote code execution. Among the vulnerabilities fixed by Microsoft’s monthly update this […]

The post Microsoft’s March Security Update of High-Risk Vulnerability Notice for Multiple Products appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post Microsoft’s March Security Update of High-Risk Vulnerability Notice for Multiple Products appeared first on Security Boulevard.

Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday.

Two of the bugs Microsoft patched today were publicly disclosed previously. CVE-2026-21262 is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions.

“This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.”

The other publicly disclosed flaw is CVE-2026-26127, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot.

It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. CVE-2026-26113 and CVE-2026-26110 are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane.

Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include:

–CVE-2026-24291: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8)
–CVE-2026-24294: Improper authentication in the core SMB component (CVSS 7.8)
–CVE-2026-24289: High-severity memory corruption and race condition flaw (CVSS 7.8)
–CVE-2026-25187: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8).

Ben McCarthy, lead cyber security engineer at Immersive, called attention to CVE-2026-21536, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent.

XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code.

“Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.”

Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) update on March 2 for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.

Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in a variety of products, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs.

For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s Patch Tuesday post. Windows enterprise admins who wish to stay abreast of any news about problematic updates, AskWoody.com is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.

Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.

January’s Microsoft zero-day flaw — CVE-2026-20805 — is brought to us by a flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Kev Breen, senior director of cyber threat research at Immersive, said despite awarding CVE-2026-20805 a middling CVSS score of 5.5, Microsoft has confirmed its active exploitation in the wild, indicating that threat actors are already leveraging this flaw against organizations.

Breen said vulnerabilities of this kind are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits.

“By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack,” Breen said. “Microsoft has not disclosed which additional components may be involved in such an exploit chain, significantly limiting defenders’ ability to proactively threat hunt for related activity. As a result, rapid patching currently remains the only effective mitigation.”

Chris Goettl, vice president of product management at Ivanti, observed that CVE-2026-20805 affects all currently supported and extended security update supported versions of the Windows OS. Goettl said it would be a mistake to dismiss the severity of this flaw based on its “Important” rating and relatively low CVSS score.

“A risk-based prioritization methodology warrants treating this vulnerability as a higher severity than the vendor rating or CVSS score assigned,” he said.

Among the critical flaws patched this month are two Microsoft Office remote code execution bugs (CVE-2026-20952 and CVE-2026-20953) that can be triggered just by viewing a booby-trapped message in the Preview Pane.

Our October 2025 Patch Tuesday “End of 10” roundup noted that Microsoft had removed a modem driver from all versions after it was discovered that hackers were abusing a vulnerability in it to hack into systems. Adam Barnett at Rapid7 said Microsoft today removed another couple of modem drivers from Windows for a broadly similar reason: Microsoft is aware of functional exploit code for an elevation of privilege vulnerability in a very similar modem driver, tracked as CVE-2023-31096.

“That’s not a typo; this vulnerability was originally published via MITRE over two years ago, along with a credible public writeup by the original researcher,” Barnett said. “Today’s Windows patches remove agrsm64.sys and agrsm.sys. All three modem drivers were originally developed by the same now-defunct third party, and have been included in Windows for decades. These driver removals will pass unnoticed for most people, but you might find active modems still in a few contexts, including some industrial control systems.”

According to Barnett, two questions remain: How many more legacy modem drivers are still present on a fully-patched Windows asset; and how many more elevation-to-SYSTEM vulnerabilities will emerge from them before Microsoft cuts off attackers who have been enjoying “living off the land[line] by exploiting an entire class of dusty old device drivers?”

“Although Microsoft doesn’t claim evidence of exploitation for CVE-2023-31096, the relevant 2023 write-up and the 2025 removal of the other Agere modem driver have provided two strong signals for anyone looking for Windows exploits in the meantime,” Barnett said. “In case you were wondering, there is no need to have a modem connected; the mere presence of the driver is enough to render an asset vulnerable.”

Immersive, Ivanti and Rapid7 all called attention to CVE-2026-21265, which is a critical Security Feature Bypass vulnerability affecting Windows Secure Boot. This security feature is designed to protect against threats like rootkits and bootkits, and it relies on a set of certificates that are set to expire in June 2026 and October 2026. Once these 2011 certificates expire, Windows devices that do not have the new 2023 certificates can no longer receive Secure Boot security fixes.

Barnett cautioned that when updating the bootloader and BIOS, it is essential to prepare fully ahead of time for the specific OS and BIOS combination you’re working with, since incorrect remediation steps can lead to an unbootable system.

“Fifteen years is a very long time indeed in information security, but the clock is running out on the Microsoft root certificates which have been signing essentially everything in the Secure Boot ecosystem since the days of Stuxnet,” Barnett said. “Microsoft issued replacement certificates back in 2023, alongside CVE-2023-24932 which covered relevant Windows patches as well as subsequent steps to remediate the Secure Boot bypass exploited by the BlackLotus bootkit.”

Goettl noted that Mozilla has released updates for Firefox and Firefox ESR resolving a total of 34 vulnerabilities, two of which are suspected to be exploited (CVE-2026-0891 and CVE-2026-0892). Both are resolved in Firefox 147 (MFSA2026-01) and CVE-2026-0891 is resolved in Firefox ESR 140.7 (MFSA2026-03).

“Expect Google Chrome and Microsoft Edge updates this week in addition to a high severity vulnerability in Chrome WebView that was resolved in the January 6 Chrome update (CVE-2026-0628),” Goettl said.

As ever, the SANS Internet Storm Center has a per-patch breakdown by severity and urgency. Windows admins should keep an eye on askwoody.com for any news about patches that don’t quite play nice with everything. If you experience any issues related installing January’s patches, please drop a line in the comments below.

Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.

Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024. According to Satnam Narang at Tenable, this year marks the second consecutive year that Microsoft patched over one thousand vulnerabilities, and the third time it has done so since its inception.

The zero-day flaw patched today is CVE-2025-62221, a privilege escalation vulnerability affecting Windows 10 and later editions. The weakness resides in a component called the “Windows Cloud Files Mini Filter Driver” — a system driver that enables cloud applications to access file system functionalities.

“This is particularly concerning, as the mini filter is integral to services like OneDrive, Google Drive, and iCloud, and remains a core Windows component, even if none of those apps were installed,” said Adam Barnett, lead software engineer at Rapid7.

Only three of the flaws patched today earned Microsoft’s most-dire “critical” rating: Both CVE-2025-62554 and CVE-2025-62557 involve Microsoft Office, and both can exploited merely by viewing a booby-trapped email message in the Preview Pane. Another critical bug — CVE-2025-62562 — involves Microsoft Outlook, although Redmond says the Preview Pane is not an attack vector with this one.

But according to Microsoft, the vulnerabilities most likely to be exploited from this month’s patch batch are other (non-critical) privilege escalation bugs, including:

–CVE-2025-62458 — Win32k
–CVE-2025-62470 — Windows Common Log File System Driver
–CVE-2025-62472 — Windows Remote Access Connection Manager
–CVE-2025-59516 — Windows Storage VSP Driver
–CVE-2025-59517 — Windows Storage VSP Driver

Kev Breen, senior director of threat research at Immersive, said privilege escalation flaws are observed in almost every incident involving host compromises.

“We don’t know why Microsoft has marked these specifically as more likely, but the majority of these components have historically been exploited in the wild or have enough technical detail on previous CVEs that it would be easier for threat actors to weaponize these,” Breen said. “Either way, while not actively being exploited, these should be patched sooner rather than later.”

One of the more interesting vulnerabilities patched this month is CVE-2025-64671, a remote code execution flaw in the Github Copilot Plugin for Jetbrains AI-based coding assistant that is used by Microsoft and GitHub. Breen said this flaw would allow attackers to execute arbitrary code by tricking the large language model (LLM) into running commands that bypass the user’s “auto-approve” settings.

CVE-2025-64671 is part of a broader, more systemic security crisis that security researcher Ari Marzuk has branded IDEsaster (IDE  stands for “integrated development environment”), which encompasses more than 30 separate vulnerabilities reported in nearly a dozen market-leading AI coding platforms, including Cursor, Windsurf, Gemini CLI, and Claude Code.

The other publicly-disclosed vulnerability patched today is CVE-2025-54100, a remote code execution bug in Windows Powershell on Windows Server 2008 and later that allows an unauthenticated attacker to run code in the security context of the user.

For anyone seeking a more granular breakdown of the security updates Microsoft pushed today, check out the roundup at the SANS Internet Storm Center. As always, please leave a note in the comments if you experience problems applying any of this month’s Windows patches.