30
45
30
35
30
30
35
30
45
30
35
30
30
30
35
45
Love Electric Breach: 877,000 Driver Records Offered for $600
A forum seller is offering 877,000 driver records from UK EV salary-sacrifice broker Love Electric for $600; researchers found the sample looks authentic.
A seller named seraphims advertised 877,000 records from Love Electric Financial Services, an Edinburgh-based FCA-regulated EV salary sacrifice broker, for $600 in cryptocurrency. Ransomnews analysts verified a 999-row SQL Server export containing names, addresses, National Insurance numbers, and driving licence numbers, with internal relationships and licence-format checks consistent with genuine production data. The full record count remains unverified, and the company had not commented at publication; the breach highlights risks from third-party payroll-adjacent providers.
48
30
30
30
30
35
30
Microsoft: Windows Server 2025 changes causing app crashes
Microsoft warns Windows Server 2025 memory-management changes crash AWE apps, including SQL Server with Lock Pages in Memory; disable LPIM as workaround.
Microsoft confirmed a known issue where Windows Server 2025 memory-management changes cause access violations, memory corruption, or unexpected termination in applications using Address Windowing Extensions (AWE). SQL Server running with the Lock Pages in Memory (LPIM) policy is affected, with symptoms including 0xC0000005 access violations, DBCC CHECKDB failures, crash dumps, and services stopping or restarting unexpectedly. Microsoft's temporary workaround is to disable the LPIM policy for the SQL Server service account or disable AWE in other affected apps, with a permanent fix promised in a future Windows update.
32
35
August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?
August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.
July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.
40
30
30
30
30
30
30
30
30
Exploring the Latest Mispadu Stealer Variant
Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.
Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.
45
30
45
Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware
Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.
Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.
52
50
30