Microsoft is developing the Windows 11 27H2 update, focusing on core system stability, new wallpapers, and 64-bit speed via Intel APX register expansion.
Related Posts:
The post Windows 11 27H2 Update Brings Intel APX Boost appeared first on Daily CyberSecurity.
Microsoft launches Windows 11 Cloud Rebuild, a native recovery tool that downloads fresh system images and drivers directly from the cloud without USB media.
Related Posts:
The post Windows 11 Cloud Rebuild Delivers Fresh System Recovery appeared first on Daily CyberSecurity.
Microsoft revives Windows 11 Android apps integration via Phone Link and taskbar search, streaming mobile software directly from compatible devices.
Related Posts:
The post Windows 11 Android Apps Return via Taskbar Search appeared first on Daily CyberSecurity.
A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter. It moves it into another Windows process through shared-section injection. The campaign uses business-themed email lures. It also delivered Agent Tesla, Remcos and XWorm . The chain starts with order and payment emails. One Greek-language message has a subject starting […]
The post Hackers Abuse LuaJIT and Windows Process Injection to Hide XLoader Credential-Stealing Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Microsoft introduces a native Windows 11 speed test tool developed with AI agents, measuring network latency, download rates, and upload performance.
Related Posts:
The post Windows 11 Speed Test Tool Arrives as Native Utility appeared first on Daily CyberSecurity.
Microsoft expands the Windows 11 26H2 upgrade rollout to eligible Windows 10 PCs, offering optional full feature updates via Windows Update.
Related Posts:
The post Windows 11 26H2 Upgrade Expands to Windows 10 Users appeared first on Daily CyberSecurity.
A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.
Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.
The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.
The vulnerability carries a CVSS score of 7.8 and requires low-level local privileges, with no user interaction. It does not provide a direct route into a computer over the internet. The flaw sits in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface.
According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to have changed, helping them narrow their investigation.
The older code failed to check a memory pointer supplied from a user application. That missing check let a local attacker write to kernel memory, where Windows stores sensitive system data.
Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory rather than protected kernel addresses.
The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no previous experience with this driver.
Their findings show how comparing patched and unpatched software can reveal enough detail to build an attack quickly.
The public GitHub repository describes the code as a demonstration. Its complete privilege escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.
These are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version. To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work.
The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.
IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.
Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, showing why that protection should not replace patching.
Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day. Both involve the same driver, but are separate flaws with different causes and patches.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
The post POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability appeared first on Cyber Security News.
Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled. This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. While this issue is urgent for affected organizations, Microsoft has categorized the release as a preview update rather […]
The post Microsoft Releases Emergency Fix for Windows 11 Remote Desktop Connection Failures appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Microsoft explains why deleting Windows 11 Prefetch files degrades application startup performance while highlighting their crucial digital forensics role.
Related Posts:
The post Windows 11 Prefetch Files: Performance and Forensics appeared first on Daily CyberSecurity.
Microsoft has released an emergency Windows update to remove trust in certificates associated with compromised eMudhra certificate authority keys. The out-of-band update, issued on October 26, 2026, eliminates seven certificates from the Windows trust list. Following this, the same removals were applied to Microsoft Edge on October 27, as stated by the Microsoft Security Response […]
The post Microsoft Releases Emergency Windows Updates to Revoke Trust in Compromised eMudhra Certificates appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed […]
The post Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Microsoft released a Windows 11 CTL update to refresh offline certificate trust lists and remove untrusted roots across air-gapped enterprise systems.
Related Posts:
The post Windows 11 CTL Update Refreshes Offline Certificates appeared first on Daily CyberSecurity.
A persistent Windows 11 Universal Print bug breaks printer queues after OS upgrades, displaying error 0x80004005 and requiring queue reinstallation.
Related Posts:
The post Windows 11 Universal Print Glitch Demands Manual Fix appeared first on Daily CyberSecurity.
Microsoft tests an Intel APX Windows 11 performance toggle in preview builds, doubling general-purpose registers for enhanced processor speed.
Related Posts:
The post Intel APX Windows 11 Toggle Unlocks CPU Efficiency appeared first on Daily CyberSecurity.
Microsoft is testing a native Windows 11 speed test tool in preview builds, replacing web browser redirections with an integrated Ookla utility.
Related Posts:
The post Windows 11 Speed Test Gets Native Tool Integration appeared first on Daily CyberSecurity.
The Arc browser shutdown arrives December 22, 2026. Export your data now and move to Dia before accounts are deleted.
Related Posts:
The post Arc Browser Shutdown Set for December 22, 2026 appeared first on Daily CyberSecurity.
Microsoft has introduced a new command-line tool that gives IT admins a faster way to check and manage OneDrive sync across company devices. Microsoft introduced the OneDrive Sync Client Command Line Interface (CLI) at the OneDrive + Copilot event held today. It is aimed at teams that look after large Microsoft 365 setups.
The tool runs with a simple command called odsync and can be used from PowerShell. In the live demo, Microsoft’s Andrey Esipov showed how admins can pull detailed device health information without clicking through settings screens or digging through log files.
According to the demo, the CLI lists every OneDrive account set up on a device, including machines with more than one account, and it can narrow the results down to a single account. It also shows the version of both the sync client and the CLI, whether OneDrive is running, and how it was installed on the system.
Admins can also see Folder Backup settings, including which folders are being backed up to the cloud. One of the most useful features for security teams is the ability to view the Group Policy settings applied to the sync client. This helps confirm that a device actually follows company rules.
The tool also reports overall status at the client, account, and Folder Backup level. When something goes wrong, admins can switch on verbose output for deeper troubleshooting.
A key detail is that the CLI can return results in JSON format. This makes it easy to plug the output into scripts, Microsoft Intune remediation jobs, or reporting tools. Microsoft says the tool works in both interactive and non-interactive modes. It is designed for admins, developers, scripts, and AI agents such as GitHub Copilot CLI.
For example, an admin could run a script across many devices to spot machines where Folder Backup is turned off or where OneDrive is not running at all. Until now, this kind of check often needed custom scripts, registry checks, or third-party utilities.
OneDrive sync is a common blind spot in many companies. Settings that drift away from policy can leave sensitive files outside approved storage or sync them to places they should never reach.
Cyber Security News has earlier reported how OneDrive auto-sync exposed enterprise secrets in SharePoint Online, showing how small sync mistakes can grow into real data leaks. Threat actors have also abused the sync client itself, as seen when hackers exploited OneDrive.exe through DLL sideloading to run malicious code.
A tool that quickly shows the sync client’s real state on each device gives defenders better visibility. It also helps them catch weak setups before they turn into security incidents.
The OneDrive Sync CLI is not yet generally available. Microsoft says it is coming soon to private preview. The company has not shared a public release date, the supported platforms, or a full list of commands. Based on what has been shown so far, the tool focuses on reading and reporting device state rather than changing settings.
Admins who want to get ready can review Microsoft’s guidance on planning file sync for SharePoint and OneDrive and watch the official OneDrive sync release notes for updates.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
The post Microsoft Unveils New OneDrive Command-Line Tool to Manage Sync Deployments appeared first on Cyber Security News.
Entrar