Cybersecurity articles tagged #Microsoft Defender on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/microsoft-defender-blocks-legitimate-google-search-linkshttps://runtimerebel.com/blog/microsoft-defender-blocks-legitimate-google-search-linksMicrosoft Defender for Office 365's Safe Links feature is incorrectly flagging legitimate Google search results as malicious, blocking user access and generating alerts.Wed, 02 Sep 2026 12:25:15 GMTMicrosoft DefenderOffice 365Safe LinksFalse PositiveGoogle Searchhttps://runtimerebel.com/blog/weaponizing-defender-s-btr-sys-to-disable-security-softwarehttps://runtimerebel.com/blog/weaponizing-defender-s-btr-sys-to-disable-security-softwareAttackers can weaponize a legitimate Microsoft Defender driver to delete security software at boot, impacting Windows 7-11.Sat, 22 Aug 2026 08:17:55 GMTMicrosoft DefenderKernel DriverDefense EvasionCheck Point ResearchWindows Securityhttps://runtimerebel.com/blog/shieldbreak-windows-zero-day-eop-via-microsoft-defenderhttps://runtimerebel.com/blog/shieldbreak-windows-zero-day-eop-via-microsoft-defenderSecurity researcher Nightmare Eclipse released 'ShieldBreak,' a Windows zero-day exploit enabling privilege escalation via Microsoft Defender.Thu, 13 Aug 2026 09:03:52 GMTNightmare EclipseMicrosoft DefenderWindowsPrivilege EscalationZero-Dayhttps://runtimerebel.com/blog/cve-2026-50656-microsoft-defender-privilege-escalation-patch-nowhttps://runtimerebel.com/blog/cve-2026-50656-microsoft-defender-privilege-escalation-patch-nowMicrosoft patches 'RoguePlanet' vulnerability, CVE-2026-50656, in Defender's Malware Protection Engine, enabling privilege escalation. Update immediately.Thu, 09 Jul 2026 11:03:10 GMTCVE-2026-50656Microsoft DefenderPrivilege EscalationRoguePlanetMalware Protection EngineEndpoint Securityhttps://runtimerebel.com/blog/microsoft-defender-rogueplanet-zero-day-vulnerability-patching-guidehttps://runtimerebel.com/blog/microsoft-defender-rogueplanet-zero-day-vulnerability-patching-guideMicrosoft addresses the RoguePlanet zero-day in Defender. Learn about the exploitation risks, detection methods, and how to update systems effectively.Thu, 09 Jul 2026 07:41:23 GMTMicrosoft DefenderRoguePlanetZero-DayWindows SecurityEndpoint Protectionhttps://runtimerebel.com/blog/cve-2026-33825-bluehammer-zero-day-in-microsoft-defender-exploited-by-ransomwarehttps://runtimerebel.com/blog/cve-2026-33825-bluehammer-zero-day-in-microsoft-defender-exploited-by-ransomwareAnalysis of the BlueHammer zero-day, CVE-2026-33825, in Microsoft Defender, actively exploited by ransomware groups. Learn detection and mitigation strategies.Wed, 01 Jul 2026 05:40:54 GMTCVE-2026-33825BlueHammerMicrosoft DefenderRansomwareZero-DayVulnerability Exploitationhttps://runtimerebel.com/blog/windows-bluehammer-flaw-exploited-by-ransomware-gangs-patch-nowhttps://runtimerebel.com/blog/windows-bluehammer-flaw-exploited-by-ransomware-gangs-patch-nowCISA warns that ransomware gangs are now exploiting the BlueHammer privilege escalation vulnerability in Microsoft Defender to bypass security controls.Tue, 30 Jun 2026 09:16:59 GMTMicrosoft DefenderBlueHammerCISA KEVRansomwarePrivilege Escalationhttps://runtimerebel.com/blog/microsoft-defender-rogueplanet-zero-day-grants-system-privilegeshttps://runtimerebel.com/blog/microsoft-defender-rogueplanet-zero-day-grants-system-privilegesAnalysis of 'RoguePlanet' zero-day in Microsoft Defender allowing local privilege escalation to SYSTEM, its impact, and critical patch guidance.Wed, 10 Jun 2026 01:03:15 GMTMicrosoft DefenderRoguePlanetPrivilege EscalationZero-DayWindows Securityhttps://runtimerebel.com/blog/ai-chatbot-poisoning-defending-against-malicious-cryptojacking-linkshttps://runtimerebel.com/blog/ai-chatbot-poisoning-defending-against-malicious-cryptojacking-linksMicrosoft warns of threat actors manipulating AI chatbot recommendations to deliver cryptojacking malware via poisoned web search results.Wed, 27 May 2026 09:16:19 GMTCryptojackingAI SecuritySocial EngineeringMicrosoft DefenderMalware Deliveryhttps://runtimerebel.com/blog/automated-endpoint-isolation-in-microsoft-defender-for-endpointhttps://runtimerebel.com/blog/automated-endpoint-isolation-in-microsoft-defender-for-endpointMicrosoft Defender for Endpoint now features automatic device isolation to block lateral movement and contain high-confidence security breaches effectively.Tue, 26 May 2026 13:11:01 GMTMicrosoft DefenderEndpoint SecurityLateral MovementAutomated ResponseMdehttps://runtimerebel.com/blog/linux-vulnerabilities-and-defender-zero-days-weekly-threat-recaphttps://runtimerebel.com/blog/linux-vulnerabilities-and-defender-zero-days-weekly-threat-recapWeekly intelligence recap covering Linux flaws, Microsoft Defender zero-days, router botnets, and supply chain compromises targeting developer toolchains.Mon, 25 May 2026 16:48:57 GMTLinux SecurityMicrosoft DefenderSupply Chain SecurityBotnetshttps://runtimerebel.com/blog/microsoft-defender-cve-2026-41091-privilege-escalation-exploitedhttps://runtimerebel.com/blog/microsoft-defender-cve-2026-41091-privilege-escalation-exploitedMicrosoft warns of active exploitation of CVE-2026-41091 in Defender, a privilege escalation flaw allowing attackers to gain SYSTEM privileges on Windows.Thu, 21 May 2026 13:16:31 GMTCVE-2026-41091Microsoft DefenderPrivilege EscalationActive Exploitationhttps://runtimerebel.com/blog/cisa-kev-update-new-microsoft-defender-and-legacy-flaws-exploitedhttps://runtimerebel.com/blog/cisa-kev-update-new-microsoft-defender-and-legacy-flaws-exploitedCISA adds seven vulnerabilities, including CVE-2026-41091 and CVE-2026-45498, to the Known Exploited Vulnerabilities catalog. Patch now to prevent compromise.Thu, 21 May 2026 09:16:49 GMTCVE-2026-41091CVE-2026-45498Microsoft DefenderCISA KEVLegacy Systemshttps://runtimerebel.com/blog/cve-2024-21338-microsoft-defender-zero-day-exploited-by-lazarushttps://runtimerebel.com/blog/cve-2024-21338-microsoft-defender-zero-day-exploited-by-lazarusMicrosoft patches two zero-day vulnerabilities in Defender and SmartScreen exploited by Lazarus Group for privilege escalation and malware delivery.Thu, 21 May 2026 09:15:26 GMTCVE-2024-21338CVE-2024-21412Lazarus GroupMicrosoft DefenderZero-Dayhttps://runtimerebel.com/blog/microsoft-defender-digicert-false-positive-trojan-win32-cerdigent-a-dhahttps://runtimerebel.com/blog/microsoft-defender-digicert-false-positive-trojan-win32-cerdigent-a-dhaMicrosoft Defender is incorrectly identifying DigiCert root certificates as the Cerdigent trojan, causing certificate removal and enterprise disruptions.Sun, 03 May 2026 20:17:15 GMTMicrosoft DefenderDigicertFalse PositiveTrojan Win32 Cerdigent a DhaCertificate Securityhttps://runtimerebel.com/blog/cve-2024-38107-microsoft-defender-bluehammer-flaw-exploited-patch-nowhttps://runtimerebel.com/blog/cve-2024-38107-microsoft-defender-bluehammer-flaw-exploited-patch-nowCISA orders federal agencies to patch the BlueHammer zero-day, a critical Microsoft Defender privilege escalation flaw currently under active exploitation.Thu, 23 Apr 2026 12:30:07 GMTCVE-2024-38107BlueHammerMicrosoft DefenderCISA KEVZero-Dayhttps://runtimerebel.com/blog/cve-2024-21412-microsoft-defender-zero-day-exploitation-and-analysishttps://runtimerebel.com/blog/cve-2024-21412-microsoft-defender-zero-day-exploitation-and-analysisAnalysis of a Microsoft Defender zero-day vulnerability used to extract NTLM hashes from the SAM database and achieve system-level privileges.Thu, 23 Apr 2026 08:43:18 GMTCVE-2024-21412Microsoft DefenderZero-DayPrivilege EscalationNTLM Stealinghttps://runtimerebel.com/blog/cve-2026-33825-microsoft-defender-access-control-exploit-analysishttps://runtimerebel.com/blog/cve-2026-33825-microsoft-defender-access-control-exploit-analysisCISA adds CVE-2026-33825 to the KEV catalog following active exploitation of Microsoft Defender's access control mechanisms. Learn how to secure your systems.Thu, 23 Apr 2026 05:05:39 GMTCVE-2026-33825Microsoft DefenderCISA KEVAccess ControlWindows Securityhttps://runtimerebel.com/blog/microsoft-defender-binaries-exploited-as-attack-toolshttps://runtimerebel.com/blog/microsoft-defender-binaries-exploited-as-attack-toolsSecurity researchers have identified methods to subvert Microsoft Defender binaries for malicious code execution and EDR bypass. Learn how to defend.Wed, 22 Apr 2026 08:44:37 GMTMicrosoft DefenderLiving-off-the-LandMpCmdRun ExeLockBitEDR Bypasshttps://runtimerebel.com/blog/microsoft-defender-zero-days-bluehammer-and-redsun-actively-exploitedhttps://runtimerebel.com/blog/microsoft-defender-zero-days-bluehammer-and-redsun-actively-exploitedHuntress warns of active exploitation of three Microsoft Defender vulnerabilities, including BlueHammer and RedSun, allowing for privilege escalation.Fri, 17 Apr 2026 16:25:02 GMTMicrosoft DefenderBlueHammerRedsunUndefendPrivilege EscalationZero-Dayhttps://runtimerebel.com/blog/microsoft-defender-zero-day-and-17-year-old-excel-rce-exploitationhttps://runtimerebel.com/blog/microsoft-defender-zero-day-and-17-year-old-excel-rce-exploitationAnalysis of recent threats including a Microsoft Defender zero-day, SonicWall brute-force campaigns, and critical RCE in legacy Microsoft Excel components.Thu, 16 Apr 2026 16:38:11 GMTMicrosoft DefenderSonicWallExcelZero-DayRCEhttps://runtimerebel.com/blog/engagelab-sdk-vulnerability-protecting-crypto-wallets-from-sandbox-bypasshttps://runtimerebel.com/blog/engagelab-sdk-vulnerability-protecting-crypto-wallets-from-sandbox-bypassA flaw in EngageLab SDK exposed 50 million Android users to data theft. Learn how attackers bypass the Android sandbox to access private cryptocurrency keys.Fri, 10 Apr 2026 00:40:05 GMTEngageLab SDKAndroid SecurityCrypto Wallet VulnerabilityMicrosoft DefenderMobile Securityhttps://runtimerebel.com/blog/cookie-controlled-php-web-shells-evade-detection-on-linux-servershttps://runtimerebel.com/blog/cookie-controlled-php-web-shells-evade-detection-on-linux-serversMicrosoft researchers warn of stealthy PHP web shells on Linux using HTTP cookies for command execution and cron jobs for long-term persistence.Sat, 04 Apr 2026 00:36:49 GMTPhp Web ShellLinux SecurityMicrosoft DefenderPersistence MechanismsCron Job Exploitationhttps://runtimerebel.com/blog/fake-next-js-job-interview-tests-backdoor-developershttps://runtimerebel.com/blog/fake-next-js-job-interview-tests-backdoor-developersMicrosoft Defender discovered a campaign where malicious Next.js job interview tests backdoor developers' devices, posing a supply chain risk.Thu, 26 Feb 2026 00:33:15 GMTNext JsSoftware DevelopersSupply Chain AttackMalwareBackdoorSocial EngineeringJob ScamsMicrosoft Defender