ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Windows Server”

1,647 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 2462Vulnerability 2029Ransomware 1294Exploit / PoC 787Threat actor 493Data breach 298Industry 158Phishing & fraud 141Policy & legal 107Advisory 59AI safety & security 45Research 39Tools 34AI tools & infra 34
SeverityAllcritical 3095high 2854medium 1647low 283info 149

Microsoft: September updates cause RDS failures on Windows Server

Microsoft confirms September 2026 Patch Tuesday updates break Remote Desktop Services on Windows Server 2012+; Group Policy mitigations and rollback workarounds available.

Microsoft confirmed that September 2026 Patch Tuesday security updates cause Remote Desktop Services failures on Windows Server 2012 and later, plus Windows 10 and Windows 11. Symptoms include unstable RDS, RDP connection failures after several minutes, sign-in issues, servers hanging at 'Please wait for the Remote Desktop Configuration,' and unresponsive MMC, RDS Licensing Diagnoser, and File Explorer. Microsoft published per-version Group Policy mitigations (covering KBs such as KB5124008, KB5122880, KB5122878, KB5122871, KB5122882, KB5122876, KB5123099, KB5123065, KB5123066) and suggests restarting affected VMs. Rolling back the updates restores RDS functionality but removes this month's security fixes.

BleepingComputerupdated · 1d agofirst · 2d agoAdvisory 3 sources1

Microsoft: Windows Server 2025 changes causing app crashes

Microsoft warns Windows Server 2025 memory-management changes crash AWE apps, including SQL Server with Lock Pages in Memory; disable LPIM as workaround.

Microsoft confirmed a known issue where Windows Server 2025 memory-management changes cause access violations, memory corruption, or unexpected termination in applications using Address Windowing Extensions (AWE). SQL Server running with the Lock Pages in Memory (LPIM) policy is affected, with symptoms including 0xC0000005 access violations, DBCC CHECKDB failures, crash dumps, and services stopping or restarting unexpectedly. Microsoft's temporary workaround is to disable the LPIM policy for the SQL Server service account or disable AWE in other affected apps, with a permanent fix promised in a future Windows update.

BleepingComputer · 8d agoAdvisory1

Remote Desktop Services Failures on Windows Servers Following September Update

September 2026 Patch Tuesday updates cause Windows Server 2019/2022/2025 RDS sessions to freeze, forcing administrators to roll back.

Cumulative updates KB5122876 (Windows Server 2019), KB5122882 (2022), and KB5122871 (2025) trigger Remote Desktop Services freezes hours after boot, with RDP connections hanging at 'Connecting…' and Event ID 20498 logged. Administrators trace the fault to an apparent deadlock in RDPSERVERBASE!WDLIB_Close during session teardown; only hard resets restore service and the issue recurs. The same September release patched roughly 973 vulnerabilities, including two actively exploited zero-days (CVE-2026-81963, CVE-2026-85880, both in CISA's KEV) and a critical RDS RCE, CVE-2026-69525 (CVSS 9.8). Workarounds include DISM-based removal of the update or an unofficial FeatureManagement registry key disabling the suspected audio-redirection code path; Microsoft has not yet confirmed the bug.

Cyber Security News · 5d agoVulnerability in the wild 2 sourcesCVE-2026-81963CVE-2026-85880CVE-2026-69525+1 CVEs1

Microsoft releases emergency Windows updates to fix RDS failures

Microsoft released emergency out-of-band Windows updates fixing Remote Desktop Services failures and Hyper-V issues caused by September 2026 security patches.

Microsoft issued out-of-band updates on September 14, 2026 to fix Remote Desktop Services instability introduced by the September security updates, which caused RDP connection and sign-in failures and unresponsive servers. Updates include KB5129194 (Windows 11 26H1), KB5129195 (Windows 11 24H2/25H2), KB5129236 (Windows 10), KB5129235 (Windows Server 2025), and KB5129237 (Windows Server 2022). The Windows 11 updates also fix a Hyper-V Plan9 shared folder issue and some USB Audio Class 1.0 multichannel problems, though remaining USB audio issues await a fix. Admins had previously used Group Policy mitigations or uninstalled the security updates, which removed security protections.

BleepingComputerupdated · 1d agofirst · 2d agoAdvisory 3 sources1

September Windows Server updates break Remote Desktop Services

September 2026 Windows Server cumulative updates cause Remote Desktop Services failures on Server 2019, 2022 and 2025, forcing some admins to roll back.

Admins report Remote Desktop Services failures after installing September 2026 Patch Tuesday updates KB5122876 (Server 2019), KB5122882 (Server 2022), and KB5122871 (Server 2025), with connections hanging, sessions failing after logout, and some systems requiring hard resets. One administrator debugging Server 2022 observed an apparent deadlock between RDP and the Local Session Manager, though Microsoft has not confirmed a root cause. Rolling back the updates restores RDS functionality but removes this month's security fixes. Microsoft had not responded to inquiries at publication time.

BleepingComputerupdated · 5d agofirst · 6d agoVulnerability 2 sources1

Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.

Microsoft disclosed CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker rated Important, which could allow an authorized attacker to execute arbitrary code locally, with possible in-network exploitation via arbitrary endpoint calls. Microsoft rates exploitation as Less Likely and there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core. Fixes shipped in the September 2026 Patch Tuesday cumulative updates via platform-specific KBs such as KB5124012 and KB5122871.

Cyber Security News · 7d agoVulnerabilityCVE-2026-694491

Tick Group Weaponized Secure USB Drives to Target Air

Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.

Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security News · 9h agoMalware in the wild 3 sources

VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems

New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.

VectraRAT is a previously undocumented MaaS platform with a Go-based VectraHub Linux C2 server embedding a Vue3 operator panel and a C++ Windows implant, rented from $250/month and linked to the aliases Vectra and Nyxel. It communicates over TCP port 3308 via a proprietary MessagePack protocol, steals browser and file-based credentials, and abuses UACME method 41 with debug-object handle hijacking via winver.exe and computerdefaults.exe. SOCRadar identified 38 live victim sessions in one week, 48% on corporate Windows editions, with delivery via the Amadey loader and ClickFix pages impersonating TurboTax.

GBHackersupdated · 9h agofirst · 10h agoMalware in the wild 3 sources

Microsoft Confirms Remote Desktop Services Might Stop Working Following Sept. 2026 Security Update

Microsoft's September 2026 Patch Tuesday updates (KB5124008) can break Remote Desktop Services, causing RDP failures and freezes across Windows clients and servers.

Microsoft confirmed its September 2026 security updates, including KB5124008 for Windows 11 24H2/25H2, introduced a reliability regression where RDP connections fail after several minutes and servers hang at the 'Please wait for the Remote Desktop Configuration' screen. MMC, RDS Licensing Diagnoser, File Explorer, and the Windows Update settings page may also stop responding. The issue affects Windows 10/11 clients and Windows Server 2012 through 2025; Microsoft marked it Mitigated on September 11 and is developing a permanent fix, with VM restart offered as a temporary workaround.

Cyber Security News · 2d agoAdvisory