Search: “MSRC”

15 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 49 Exploit / PoC 30 Malware 12 Data breach 7 Ransomware 7 Threat actor 5 Industry 3 Phishing & fraud 2 Advisory 2 AI safety & security 1 Tools 1

SeverityAll critical 79 high 20 medium 15 low 2 info 3

Four Unit 42 Vulnerability Researchers Make MSRC Top 100 for 2018

Palo Alto Unit 42Jun 10, 16:34 UTC · Jun 10, 2019Vulnerability

Researchers share of FabriXss bug impacting Azure Fabric Explorer

Security AffairsOct 19, 15:14 UTC · Oct 19, 2022Vulnerability CVE-2022-35829

Unit 42 Researchers Recognized in MSRC Top 100 List

Palo Alto Unit 42Sep 6, 08:11 UTC · Sep 6, 2018Vulnerability

Microsoft: Russian hackers accessed internal systems, code repositories

Help Net SecurityMar 11, 00:00 UTC · Mar 11, 2024Malware

Researchers Uncover 'Process Ghosting' — A New Malware Evasion Technique

The Hacker NewsJun 17, 08:05 UTC · Jun 17, 2021Malware

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker NewsAug 21, 15:52 UTC · 26d agoTools CVE-2021-240921

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security AffairsAug 12, 08:08 UTC · Aug 12, 2026Exploit / PoC CVE-2026-50656