Cybersecurity articles tagged #Windows on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/shieldbreak-windows-zero-day-eop-via-microsoft-defenderhttps://runtimerebel.com/blog/shieldbreak-windows-zero-day-eop-via-microsoft-defenderSecurity researcher Nightmare Eclipse released 'ShieldBreak,' a Windows zero-day exploit enabling privilege escalation via Microsoft Defender.Thu, 13 Aug 2026 09:03:52 GMTNightmare EclipseMicrosoft DefenderWindowsPrivilege EscalationZero-Dayhttps://runtimerebel.com/blog/plug-and-pwn-system-access-via-windows-plug-and-play-abusehttps://runtimerebel.com/blog/plug-and-pwn-system-access-via-windows-plug-and-play-abuseNew Plug and Pwn attacks leverage Windows Plug and Play to install vulnerable vendor software, granting attackers SYSTEM privileges via USB emulation or RDP.Wed, 12 Aug 2026 16:47:58 GMTWindowsPlug and PwnPlug and PlaySYSTEM PrivilegesUSB Attackshttps://runtimerebel.com/blog/cve-2026-68820-windows-afd-sys-privilege-escalation-exploitedhttps://runtimerebel.com/blog/cve-2026-68820-windows-afd-sys-privilege-escalation-exploitedMicrosoft addresses 398 vulnerabilities, including an actively exploited privilege escalation flaw in Windows' afd.sys component.Wed, 12 Aug 2026 01:06:41 GMTMicrosoftWindowsPrivilege EscalationZero-DayCVE-2026-68820https://runtimerebel.com/blog/microsoft-august-2026-patch-tuesday-398-flaws-and-zero-dayhttps://runtimerebel.com/blog/microsoft-august-2026-patch-tuesday-398-flaws-and-zero-dayMicrosoft patches 398 flaws in August 2026, including an actively exploited Windows kernel driver zero-day and four critical RCE vulnerabilities.Wed, 12 Aug 2026 01:05:21 GMTWindowsSharePointZero-DayLazarus GroupCVE-2026-68820https://runtimerebel.com/blog/natjack-attacks-exploiting-nat-trust-in-windows-linux-macoshttps://runtimerebel.com/blog/natjack-attacks-exploiting-nat-trust-in-windows-linux-macosSynack's research reveals NatJack attacks, a new class of NAT exploitation affecting Windows, Linux, and macOS, leveraging trust assumptions.Sun, 09 Aug 2026 00:58:42 GMTWindowsLinuxmacOSNatJackNAThttps://runtimerebel.com/blog/khunt-toolkit-leverages-sqli-in-oracle-for-system-accesshttps://runtimerebel.com/blog/khunt-toolkit-leverages-sqli-in-oracle-for-system-accessAttackers exploit SQL injection in a public-facing web app to compile the khunt toolkit within Oracle, achieving SYSTEM-level access on Windows servers.Thu, 06 Aug 2026 10:29:03 GMTSQL InjectionPost ExploitationWindowsOracle DatabaseKhunthttps://runtimerebel.com/blog/pass-ta-key-attacks-hijack-google-synced-passkeys-on-windowshttps://runtimerebel.com/blog/pass-ta-key-attacks-hijack-google-synced-passkeys-on-windowsResearchers uncover Pass-ta-key attack methods that allow malware to hijack passkey-protected accounts on Windows without user interaction.Wed, 05 Aug 2026 17:21:16 GMTMalwareCredential TheftAuthenticationWindowsGooglehttps://runtimerebel.com/blog/ai-assisted-phishing-leverages-webdav-for-infostealer-deploymenthttps://runtimerebel.com/blog/ai-assisted-phishing-leverages-webdav-for-infostealer-deploymentAn exposed server revealed an AI-assisted phishing toolkit used in a WebDAV-based infostealer campaign targeting Windows users in Mexico. Learn detection and mitigation.Mon, 20 Jul 2026 18:05:04 GMTAI Assisted PhishingWebDAVInfostealerMalware ToolkitMexicoWindowsRapid7https://runtimerebel.com/blog/windows-legacyhive-zero-day-exploit-grants-admin-access-patch-statushttps://runtimerebel.com/blog/windows-legacyhive-zero-day-exploit-grants-admin-access-patch-statusThe LegacyHive Zero-Day exploit allows local attackers to gain SYSTEM privileges on patched Windows systems by targeting legacy registry hive permissions.Fri, 17 Jul 2026 13:49:23 GMTLegacyHiveWindowsZero-DayPrivilege EscalationAbdelhamid Nacerihttps://runtimerebel.com/blog/zoom-cve-2026-53412-critical-windows-client-account-takeover-fixhttps://runtimerebel.com/blog/zoom-cve-2026-53412-critical-windows-client-account-takeover-fixZoom releases critical security updates for CVE-2026-53412, a high-severity input validation flaw in Windows clients allowing unauthenticated account takeover.Thu, 16 Jul 2026 10:12:19 GMTZoomCVE-2026-53412WindowsAccount TakeoverInput Validationhttps://runtimerebel.com/blog/cve-2024-24691-zoom-windows-client-account-takeover-patch-nowhttps://runtimerebel.com/blog/cve-2024-24691-zoom-windows-client-account-takeover-patch-nowZoom has addressed CVE-2024-24691, a critical 9.6 CVSS vulnerability in Windows clients allowing unauthenticated account takeover. Learn how to patch and defend.Wed, 15 Jul 2026 21:05:22 GMTCVE-2024-24691ZoomAccount TakeoverWindowsRemote Code Executionhttps://runtimerebel.com/blog/labubarat-rust-based-rat-masquerades-as-nvidia-software-on-windowshttps://runtimerebel.com/blog/labubarat-rust-based-rat-masquerades-as-nvidia-software-on-windowsBlackpoint Cyber researchers warn of LabubaRAT, a new Rust-based remote access trojan disguised as NVIDIA software, granting full control over Windows hosts.Tue, 14 Jul 2026 17:20:39 GMTLabubaRATRustNVIDIARATWindowsRemote Access Trojanhttps://runtimerebel.com/blog/ousaban-banking-trojan-phishing-lures-target-iberian-bank-usershttps://runtimerebel.com/blog/ousaban-banking-trojan-phishing-lures-target-iberian-bank-usersOusaban, a Brazilian banking trojan, targets Windows users in Spain and Portugal via fake PDF phishing lures, aiming to steal financial credentials.Wed, 01 Jul 2026 16:53:05 GMTOusabanBanking TrojanPhishingSpainPortugalWindowsFinancial CrimeMalware Analysishttps://runtimerebel.com/blog/hola-browser-for-windows-compromised-cryptominer-delivery-via-supply-chainhttps://runtimerebel.com/blog/hola-browser-for-windows-compromised-cryptominer-delivery-via-supply-chainCritical alert: Hola Browser for Windows compromised in a supply chain attack, delivering an undeclared cryptominer. Learn to detect and mitigate the threat.Fri, 05 Jun 2026 01:00:59 GMTHola BrowserWindowsSupply Chain AttackCryptominerMalwarehttps://runtimerebel.com/blog/php-rce-via-cve-2024-4577-windows-argument-injection-analysishttps://runtimerebel.com/blog/php-rce-via-cve-2024-4577-windows-argument-injection-analysisTechnical analysis of the CVE-2024-4577 vulnerability affecting PHP on Windows. Learn how argument injection leads to RCE and how to secure PHP-CGI environments.Wed, 03 Jun 2026 05:44:55 GMTCVE-2024-4577PHPRCEWindowsArgument Injectionhttps://runtimerebel.com/blog/yellowkey-zero-day-mitigating-bitlocker-encryption-bypasses-in-windowshttps://runtimerebel.com/blog/yellowkey-zero-day-mitigating-bitlocker-encryption-bypasses-in-windowsMicrosoft releases mitigation guidance for the YellowKey zero-day, a Windows BitLocker vulnerability allowing unauthorized access to encrypted data volumes.Wed, 20 May 2026 09:16:25 GMTWindowsBitLockerYellowKeyZero-DayEncryptionMicrosofthttps://runtimerebel.com/blog/miniplasma-0-day-windows-system-privilege-escalation-via-cldflt-syshttps://runtimerebel.com/blog/miniplasma-0-day-windows-system-privilege-escalation-via-cldflt-sysTechnical analysis of the MiniPlasma zero-day vulnerability in cldflt.sys enabling SYSTEM privilege escalation on fully patched Windows systems.Mon, 18 May 2026 09:19:37 GMTMiniPlasmaCldflt SysZero-DayWindowsChaotic Eclipsehttps://runtimerebel.com/blog/windows-miniplasma-zero-day-exploit-how-to-mitigate-lpe-threatshttps://runtimerebel.com/blog/windows-miniplasma-zero-day-exploit-how-to-mitigate-lpe-threatsA new zero-day exploit dubbed MiniPlasma allows local attackers to gain SYSTEM privileges on fully patched Windows systems. Learn detection and mitigation steps.Mon, 18 May 2026 00:55:54 GMTMiniPlasmaWindowsZero-DayLocal Privilege EscalationLPEhttps://runtimerebel.com/blog/dell-supportassist-v4-0-3-causes-windows-bsod-remediation-guidehttps://runtimerebel.com/blog/dell-supportassist-v4-0-3-causes-windows-bsod-remediation-guideDell confirms SupportAssist v4.0.3 causes frequent Windows BSOD crashes and system reboots. Learn how to identify and mitigate these stability issues now.Thu, 14 May 2026 12:46:18 GMTDellSupportAssistBSODWindowsReliabilityhttps://runtimerebel.com/blog/windows-zero-days-analyzing-yellowkey-and-greenplasma-exploitshttps://runtimerebel.com/blog/windows-zero-days-analyzing-yellowkey-and-greenplasma-exploitsA technical breakdown of the unpatched YellowKey BitLocker bypass and GreenPlasma local privilege escalation vulnerabilities affecting Windows systems.Thu, 14 May 2026 09:05:16 GMTYellowKeyGreenPlasmaWindowsBitLockerPrivilege EscalationLPEhttps://runtimerebel.com/blog/microsoft-s-137-patches-critical-flaws-in-azure-windows-dynamicshttps://runtimerebel.com/blog/microsoft-s-137-patches-critical-flaws-in-azure-windows-dynamicsMicrosoft's latest security updates address 137 vulnerabilities, including critical flaws in Azure, Windows, and Dynamics 365, requiring immediate patching.Tue, 12 May 2026 20:39:17 GMTMicrosoftSecurity UpdateAzureWindowsDynamics 365SSO PluginJiraConfluenceVulnerability Managementhttps://runtimerebel.com/blog/cve-2024-1708-cve-2026-32202-cisa-kev-update-patch-nowhttps://runtimerebel.com/blog/cve-2024-1708-cve-2026-32202-cisa-kev-update-patch-nowCISA adds CVE-2024-1708 and CVE-2026-32202 to the Known Exploited Vulnerabilities Catalog following evidence of active exploitation in the wild.Wed, 29 Apr 2026 08:55:48 GMTCVE-2024-1708CVE-2026-32202ConnectwiseScreenconnectWindowsCISA KEVhttps://runtimerebel.com/blog/unpatched-phantomrpc-windows-privilege-escalation-via-rpc-flawhttps://runtimerebel.com/blog/unpatched-phantomrpc-windows-privilege-escalation-via-rpc-flawRuntime Rebel analyzes the unpatched 'PhantomRPC' flaw in Windows, detailing how an architectural weakness in RPC enables local privilege escalation.Mon, 27 Apr 2026 16:41:23 GMTPhantomRPCWindowsPrivilege EscalationRPCVulnerabilityUnpatchedhttps://runtimerebel.com/blog/apt28-exploits-incomplete-windows-patch-zero-click-attacks-persisthttps://runtimerebel.com/blog/apt28-exploits-incomplete-windows-patch-zero-click-attacks-persistAn incomplete Windows patch leaves systems vulnerable to zero-click attacks. Russia-linked APT28 exploited this against Ukraine and EU. Learn how to defend.Mon, 27 Apr 2026 16:40:47 GMTWindowsZero ClickAPT28Patch BypassVulnerabilityMicrosoftCyber Warfarehttps://runtimerebel.com/blog/kyber-ransomware-targets-windows-esxi-with-post-quantum-encryptionhttps://runtimerebel.com/blog/kyber-ransomware-targets-windows-esxi-with-post-quantum-encryptionKyber ransomware is encrypting Windows and VMware ESXi systems, with one variant leveraging Kyber1024 post-quantum encryption, posing new decryption challenges.Wed, 22 Apr 2026 20:25:36 GMTKyberRansomwareKyber1024Post Quantum CryptographyWindowsVMware ESXihttps://runtimerebel.com/blog/april-2026-patch-tuesday-sharepoint-zero-day-bluehammer-adobe-rcehttps://runtimerebel.com/blog/april-2026-patch-tuesday-sharepoint-zero-day-bluehammer-adobe-rceMicrosoft's April 2026 Patch Tuesday addresses 167 vulnerabilities, including a SharePoint Server zero-day, Windows Defender 'BlueHammer' flaw, and an actively exploited…Wed, 15 Apr 2026 00:45:50 GMTMicrosoftWindowsSharePoint ServerWindows DefenderAdobe ReaderGoogle ChromePatch TuesdayZero-DayRCEBlueHammerVulnerabilityExploitationhttps://runtimerebel.com/blog/cve-2024-43451-how-ntlm-hash-disclosure-impacts-windows-systemshttps://runtimerebel.com/blog/cve-2024-43451-how-ntlm-hash-disclosure-impacts-windows-systemsTechnical analysis of CVE-2024-43451, a Windows NTLM hash disclosure vulnerability triggered by minimal user interaction. Learn detection and mitigation steps.Mon, 13 Apr 2026 05:08:48 GMTCVE-2024-43451WindowsNTLMHash DisclosureMicrosofthttps://runtimerebel.com/blog/bluehammer-zero-day-windows-local-privilege-escalation-exploit-riskshttps://runtimerebel.com/blog/bluehammer-zero-day-windows-local-privilege-escalation-exploit-risksResearcher Chaotic Eclipse released the BlueHammer zero-day exploit for Windows, enabling local privilege escalation. Learn how to detect and mitigate it.Fri, 10 Apr 2026 08:40:43 GMTBlueHammerWindowsPrivilege EscalationZero-DayChaotic EclipseMicrosofthttps://runtimerebel.com/blog/whatsapp-vbs-malware-bypasses-uac-to-hijack-windows-systemshttps://runtimerebel.com/blog/whatsapp-vbs-malware-bypasses-uac-to-hijack-windows-systemsMicrosoft warns of a new campaign distributing VBS malware via WhatsApp, exploiting UAC bypass to establish persistence and remote access on Windows systems, starting…Wed, 01 Apr 2026 16:25:50 GMTWhatsAppVBScriptUAC BypassWindowsMalwarePersistenceRemote Accesshttps://runtimerebel.com/blog/axios-npm-package-hijacked-cross-platform-malware-distributionhttps://runtimerebel.com/blog/axios-npm-package-hijacked-cross-platform-malware-distributionAnalysis of the Axios npm package hijack distributing remote access trojans to Linux, Windows, and macOS systems. Learn to protect your software supply chain.Tue, 31 Mar 2026 16:29:10 GMTAxiosNPMSupply Chain AttackRemote Access TrojanMalwareJavaScriptLinuxWindowsmacOShttps://runtimerebel.com/blog/microsoft-patch-tuesday-analysis-addressing-critical-rce-and-quishinghttps://runtimerebel.com/blog/microsoft-patch-tuesday-analysis-addressing-critical-rce-and-quishingTechnical analysis of the March 2026 Patch Tuesday cycle, focusing on Windows RCE, kernel-level privilege escalation, and emerging QR code phishing trends.Fri, 13 Mar 2026 04:38:08 GMTCVE-2024-26252CVE-2024-29988CVE-2024-21323MicrosoftWindowsPatch Tuesdayhttps://runtimerebel.com/blog/zoom-and-splunk-patch-critical-rce-and-pe-vulnerabilitieshttps://runtimerebel.com/blog/zoom-and-splunk-patch-critical-rce-and-pe-vulnerabilitiesSecurity updates for Splunk Enterprise and Zoom Desktop Client address critical vulnerabilities, including a 9.6-rated RCE and high-severity privilege escalation.Thu, 12 Mar 2026 12:20:43 GMTCVE-2024-24691CVE-2024-36985SplunkZoomRCEWindowshttps://runtimerebel.com/blog/microsoft-windows-hotpatching-to-be-enabled-by-default-in-may-2026https://runtimerebel.com/blog/microsoft-windows-hotpatching-to-be-enabled-by-default-in-may-2026Microsoft will enable hotpatching by default for Intune-managed Windows devices in May 2026, allowing security updates without reboots to reduce downtime.Tue, 10 Mar 2026 12:19:01 GMTWindowsMicrosoft IntuneHotpatchingPatch Managementhttps://runtimerebel.com/blog/chinese-cyber-threat-persistent-espionage-in-critical-asian-sectorshttps://runtimerebel.com/blog/chinese-cyber-threat-persistent-espionage-in-critical-asian-sectorsAn undefined Chinese-speaking actor conducts long-term cyber espionage against critical Asian sectors using custom malware and living-off-the-land binaries.Mon, 09 Mar 2026 16:35:16 GMTChinese APTEspionageWindowsLinuxLOTLCustom MalwareCritical InfrastructureThreat Actorhttps://runtimerebel.com/blog/windows-administrator-protection-bypassed-via-ui-access-abusehttps://runtimerebel.com/blog/windows-administrator-protection-bypassed-via-ui-access-abuseAnalysis of UI Access abuse techniques that bypassed Windows Administrator Protection, a new UAC feature, detailing historical context and fixes.Wed, 25 Feb 2026 04:47:06 GMTWindowsUACAdministrator ProtectionUI AccessPrivilege EscalationShatter AttackProject Zerohttps://runtimerebel.com/blog/microsoft-february-2026-security-update-analysis-of-six-actively-exploited-zero-dayshttps://runtimerebel.com/blog/microsoft-february-2026-security-update-analysis-of-six-actively-exploited-zero-daysMicrosoft's latest security release addresses 50+ vulnerabilities, including six zero-day exploits targeting Windows kernel components and browser engines.Mon, 23 Feb 2026 08:22:09 GMTPatch TuesdayMicrosoftZero-DayWindowsRCELPE