Latest news with #PatchTuesday
Daily Record
16-05-2025
- Daily Record
Windows 10 and Windows 11 critical update as users urged 'not to ignore'
Microsoft Windows has released a critical update, with users being urged to check immediately if their PC and laptop are up to date. Those who are operating their PC or laptops on Windows 10 or Windows 11 have been urged to check their settings immediately. It comes as Microsoft launch a major update which people are being cautioned not to ignore. As part of the platforms Patch Tuesday programme, the latest upgrade from the Redmond firm fixes a total of 72 flaws within its popular operating systems. Not worrying enough? Six of these bugs have been deemed 'critical' and given a 'zero-day' rating. To break it down for users further, 'zero-day' essentially means hackers are aware of the gremlins and are actively exploiting them in the wild. This is why Microsoft has rushed so quickly to fix the problems in a bid to keep people safe, as reported by the Express. The bugs include Privilege Vulnerabilities, Bypass Vulnerabilities and Spoofing Vulnerabilities, with it now being vital that you check your PC or laptop is running the very latest version of Windows 10 or Windows 11 without delay. Explaining more, the security team at Action1 said: "Attackers exploiting these vulnerabilities can escalate privileges to system level, granting them full control to run arbitrary code, install malware, modify data or disable security protections. "With low complexity and minimal privileges needed, these flaws pose a serious risk, especially given the confirmed in-the-wild." How do I check my system is updated? To check if your PC or laptop is up to date, you can head to settings, navigate to update and security, then Windows update, and select 'Check for updates'. This new patch offers a glimpse into why Windows 10 users should consider switching to Windows 11. From October, free updates like the one released this week will no longer be available, and that will put Windows 10 users at much higher risk of issues and cyber attacks. "Starting Oct. 14, 2025, Windows 10 will no longer receive security updates," explained Yusuf Mehdi, Executive Vice President, Consumer Chief Marketing Officer. "As security threats evolve and adapt, so must our operating systems and hardware. Because of this, we designed Windows 11 to be the most secure version of Windows ever — by default and design — to help you stay ahead of those risks."
Yahoo
15-05-2025
- Yahoo
Microsoft Rolls Out May 2025 Windows 11 and 10 Updates With New AI Tools, Security Fixes
Microsoft has released the May 2025 Patch Tuesday updates for all supported versions of Windows 11 and Windows 10. The KB5058411 update for Windows 11 version 24H2 is to have new AI-powered options, including Recall and Click to Do, on Copilot+ PCs. The update also adds a new AI-powered search experience, which is now available on both Intel and AMD-powered Copilot+ models. Microsoft says that Recall and Click to Do will reach users gradually through its controlled feature rollout technology, as reported by Thurrott. For those still using Windows 11 version 23H2, the KB5058405 patch brings new options such as Speech recap for Narrator, a Phone Link sidebar in the Start menu, and curated views in File Explorer Home. These updates are also present in the KB5058411 update for version 24H2. The Phone Link sidebar in the Start menu lets users access phone calls, messages, and photos and share content between devices. Developers now have the option to create widgets for the Widgets board and Lock screen using web-based content, and the Lock screen weather widget is adding new customization options for users in the EU. File Explorer is to have curated views in Home, better support for text scaling, and improved performance with ZIP files. For Windows 10 version 22H2, the KB5058379 patch mainly fixes security issues, with miscellaneous improvements to internal Windows functions, and updates the blocklist of drivers with known security vulnerabilities that have been used in Bring Your Own Vulnerable Driver attacks. This update does not bring new user-facing options, as Windows 10 is nearing the end of its support period—but could Linux be a decent alternative?
Forbes
15-05-2025
- Forbes
Windows Is Under Attack, Microsoft Confirms — Act Now, CISA Warns
Update, May 15, 2025: This story, originally published May 14, has been updated with a new warning from the Cybersecurity and Infrastructure Security Agency along with additional information regarding further confirmed Microsoft Windows vulnerabilities that are not known to be under active exploitation but need to be patched as soon as possible anyway. It's that time of the month again, when Patch Tuesday is quickly followed by Exploit Wednesday. The former is the monthly rollout of Microsoft's responses to newly discovered vulnerabilities in its services and products, and the latter is when hackers, cybercriminals and state-sponsored actors look to act upon these security disclosures before individuals and organizations have had the opportunity to update their systems. Unfortunately, Exploit Wednesday seems to have preceded Patch Tuesday this month, with Microsoft confirming multiple zero-day vulnerabilities that are known to be under attack before any fix was made available. Make no mistake, with security experts rating the risk prioritization of these exploits as critical, Windows users need to act fast. It is not uncommon, sadly, for Windows users to find themselves faced with zero-day vulnerabilities that are being exploited by attackers in the wild. In March, for example, six zero-day attacks were confirmed, while there were three such active Windows exploits reported in January. The latest Microsoft Patch Tuesday security rollout has now dropped, and it doesn't make for very comforting reading at all. So, let's dive straight into the multiple zero-day exploits impacting Windows users, starting with that has got the security professionals very concerned indeed. This memory corruption vulnerability sits within the Windows scripting engine, and a successful exploit can allow an attacker to execute code over the network. Not only does CVE-2025-30397 affect all versions of the Windows operating system, but it is also confirmed by Microsoft as being exploited in the wild. 'Microsoft's severity is rated as important and has CVSS 3.1 of 7.8,' Chris Goettl, vice president of security product management at Ivanti, pointed out, adding that 'risk-based prioritization warrants treating this vulnerability as critical.' While the official CVE severity-rating scores tend to provide a decent baseline for vulnerability appraisal, in the real world, things are not always that clear-cut. CVE-2025-30397 has a base score of 7.5, and Microsoft says that the attack complexity rating is high. So, what's the issue? 'The advisory FAQ for CVE-2025-30397 explains that successful exploitation requires an attacker to first prepare the target so that it uses Edge in Internet Explorer Mode,' Adam Barnett, lead software engineer at Rapid7 explains, 'and then causes the user to click a malicious link; there is no mention of a requirement for the user to actively reload the page in Internet Explorer Mode, so we must assume that exploitation requires only that the 'Allow sites to be reloaded in Internet Explorer' option is enabled.' Barnett warned that as the users most likely to still require this kind of Internet Explorer compatibility are enterprise organizations, and the concept of migration is likely 'buried several layers deep in a dusty backlog,' in Barnett's experience, then the pre-requisite conditions are already conveniently in place on the target asset and 'attack complexity is suddenly nice and low.' The remaining under-attack zero-day vulnerabilities are: CVE-2025-32709: an elevation of privilege vulnerability in the Windows ancillary function driver for WinSock that enables an attacker to gain admin privileges locally and impacts Windows Server 12 and later OS versions. Once again. Goettl warned that 'risk-based prioritization warrants treating this vulnerability as critical.' CVE-2025-32701 and CVE-2025-32706 are a pair of zero-day vulnerabilities in the Windows Common Log File Driver System, and could enable a successful local attacker to gain system privileges. Impacting all versions of Windows, these types of security flaws are being closely monitored for detection by the Microsoft Threat Intelligence Center. 'Since Microsoft is aware of exploitation in the wild,' Barnett said, 'we know that someone else got there first, and there's no reason to suspect that threat actors will stop looking for ways to abuse CLFS any time soon.' And finally, we come to another elevation of privilege zero-day vulnerability already being exploited by attackers, CVE-2025-30400, which impacts the Windows desktop window manager and affects Windows 10, Server 2016, and later OS versions. Barnett pointed out that this is great proof that such elevation of privileges vulnerabilities will never go out of fashion, what with Exploit Wednesday marking the one-year anniversary of CVE-2024-30051, which also hit the desktop windows manager. The U.S. Cybersecurity and Infrastructure Security Agency has now joined the chorus of experts warning that these Windows zero-day vulnerabilities need to be addressed as a matter of urgency. A newly published alert has confirmed that CISA has added all five of the Windows zero-days to Known Exploited Vulnerabilities catalog, and that brings not only more than a little gravitas to the security warnings, but an obligation for certain federal agencies to apply the Microsoft patches to fix them no later than June 3rd, 2025. Of course, that is by the by for most readers, but it doesn't mean the CISA alert is meaningless. Indeed, the self-styled America's Cyber Defence Agency has strongly urged 'all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of catalog vulnerabilities as part of their vulnerability management practice." Although it makes sense to highlight the five zero-day vulnerabilities that Microsoft has confirmed are already being exploited in the wild, leaving unpatched Windows users open to attack, this security rollout also includes fixes for another 65 vulnerabilities that cannot be ignored. Mike Walters, co-founder of Action1, has mentioned two Microsoft Office vulnerabilities, for example. CVE-2025-30386 is a remote code execution flaw, and RCE is something that will make any security-aware reader shiver. The shivering is dulled a little by the fact that it is, somewhat oddly, classified as using a local attack vector. 'This vulnerability is considered remote code execution,' Walters explained, 'as it can be triggered by delivering a malicious document. If the affected user has administrative privileges, an attacker could gain full control of the system.' All users, from the enterprise to consumers are at risk, Walters said, adding that the 'ability to trigger exploitation via the Preview Pane further elevates the risk, as users may not even need to open the attachment explicitly.' The second Microsoft Office vulnerability of note, CVE-2025-30377, is another RCE and similar to the first in that it can be used to execute arbitrary code. 'While the attack scenarios are comparable,' Walters said, 'this vulnerability is considered less likely to be exploited due to additional conditions or complexities in developing a reliable exploit.' As both can result in full system compromise, neither should be underestimated, and patches should be applied as soon as possible. The advice, therefore, is simple. Act now, and ensure that you update your Windows systems with the latest security patches as a matter of some urgency.
Forbes
14-05-2025
- Forbes
Microsoft Confirms Windows Is Under Attack — You Must Act Now
Multiple zero-day vulnerabilities are being exploited by attackaers, Microsoft warns. It's that time of the month again, when Patch Tuesday is quickly followed by Exploit Wednesday. The former is the monthly rollout of Microsoft's responses to newly discovered vulnerabilities in its services and products, and the latter is when hackers, cybercriminals and state-sponsored actors look to act upon these security disclosures before individuals and organizations have had the opportunity to update their systems. Unfortunately, Exploit Wednesday seems to have preceded Patch Tuesday this month, with Microsoft confirming multiple zero-day vulnerabilities that are known to be under attack before any fix was made available. Make no mistake, with security experts rating the risk prioritization of these exploits as critical, Windows users need to act fast. It is not uncommon, sadly, for Windows users to find themselves faced with zero-day vulnerabilities that are being exploited by attackers in the wild. In March, for example, six zero-day attacks were confirmed, while there were three such active Windows exploits reported in January. The latest Microsoft Patch Tuesday security rollout has now dropped, and it doesn't make for very comforting reading at all. So, let's dive straight into the multiple zero-day exploits impacting Windows users, starting with that has got the security professionals very concerned indeed. This memory corruption vulnerability sits within the Windows scripting engine, and a successful exploit can allow an attacker to execute code over the network. Not only does CVE-2025-30397 affect all versions of the Windows operating system, but it is also confirmed by Microsoft as being exploited in the wild. 'Microsoft's severity is rated as important and has CVSS 3.1 of 7.8,' Chris Goettl, vice president of security product management at Ivanti, pointed out, adding that 'risk-based prioritization warrants treating this vulnerability as critical.' While the official CVE severity-rating scores tend to provide a decent baseline for vulnerability appraisal, in the real world, things are not always that clear-cut. CVE-2025-30397 has a base score of 7.5, and Microsoft says that the attack complexity rating is high. So, what's the issue? 'The advisory FAQ for CVE-2025-30397 explains that successful exploitation requires an attacker to first prepare the target so that it uses Edge in Internet Explorer Mode,' Adam Barnett, lead software engineer at Rapid7 explains, 'and then causes the user to click a malicious link; there is no mention of a requirement for the user to actively reload the page in Internet Explorer Mode, so we must assume that exploitation requires only that the 'Allow sites to be reloaded in Internet Explorer' option is enabled.' Barnett warned that as the users most likely to still require this kind of Internet Explorer compatibility are enterprise organizations, and the concept of migration is likely 'buried several layers deep in a dusty backlog,' in Barnett's experience, then the pre-requisite conditions are already conveniently in place on the target asset and 'attack complexity is suddenly nice and low.' The remaining under-attack zero-day vulnerabilities are: CVE-2025-32709: an elevation of privilege vulnerability in the Windows ancillary function driver for WinSock that enables an attacker to gain admin privileges locally and impacts Windows Server 12 and later OS versions. Once again. Goettl warned that 'risk-based prioritization warrants treating this vulnerability as critical.' CVE-2025-32701 and CVE-2025-32706 are a pair of zero-day vulnerabilities in the Windows Common Log File Driver System, and could enable a successful local attacker to gain system privileges. Impacting all versions of Windows, these types of security flaws are being closely monitored for detection by the Microsoft Threat Intelligence Center. 'Since Microsoft is aware of exploitation in the wild,' Barnett said, 'we know that someone else got there first, and there's no reason to suspect that threat actors will stop looking for ways to abuse CLFS any time soon.' And finally, we come to another elevation of privilege zero-day vulnerability already being exploited by attackers, CVE-2025-30400, which impacts the Windows desktop window manager and affects Windows 10, Server 2016, and later OS versions. Barnett pointed out that this is great proof that such elevation of privileges vulnerabilities will never go out of fashion, what with Exploit Wednesday marking the one-year anniversary of CVE-2024-30051, which also hit the desktop windows manager. The advice, therefore, is simple. Act now, and ensure that you update your Windows systems with the latest security patches as a matter of some urgency.
Forbes
27-04-2025
- Forbes
New Security Warning After 1 Billion Windows Users Told Do Not Delete
That mystery Windows security update could block new security updates. As if users of the world's most popular, although I use that term with some caution, operating system don't have enough security issues to worry about, Microsoft appears to have introduced one of its own making. With dangerous infostealer malware on the hunt for Windows passwords and 2FA code bypassing cookies and a record number of vulnerabilities reported, the last thing a billion Windows users want to hear is that an update meant to solve security issues could have introduced a new one of its own. As regular readers will know, I'm something of an advocate, almost evangelical in fact, when it comes to security updates. Whether it is the latest Google Chrome browser emergency update, or the monthly Patch Tuesday rollout of fixes, often relating to zero-day vulnerabilities are actively being exploited, impacting Windows users, my advice is always the same: update now. Sometimes, however, the early bird that gets the worm discovers it's a rotten one. Who can forget the recent security update that killed Microsoft's Windows Hello security feature, for example. Or, even more recently, the disastrous April 8 update to protect against the CVE-2025-21204 vulnerability that installed a mysterious folder, and got everyone's collective conspiracy theory panties in a bunch. Microsoft had to issue a notice explaining that the folder was critical protection against being attacked by threat actors exploiting the vulnerability in question and, unlike the advice spreading across social media platforms, not to delete it under any circumstances. That folder was called inetpub and it's at the heart of this latest warning, from a highly respected security researcher who used to work for Microsoft itself. 'I've discovered this fix introduces a denial of service vulnerability in the Windows servicing stack that allows non-admin users to stop all future Windows security updates,' the researcher, Kevin Beaumont, said. I have reached out to Microsoft for a statement, but in the meantime this is some of the response that was sent to Beaumont after he contacted Microsoft about the issue: 'After careful investigation, this case is currently rated as a Moderate severity issue. It does not meet MSRCs current bar for immediate servicing as the update fails to apply only if the 'inetpub' folder is a junction to a file and succeeds upon deleting the inetpub symlink and retrying.' Microsoft told Beaumont that it had shared the report with the relevant Windows security team, which would consider a potential fix, but for now, the case was closed.
