Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of

Tim Beasley, a senior incident response consultant at Semperis, was investigating a cyberattack involving Russia’s Midnight Blizzard when a package containing nesting dolls and other regional gifts showed up on his doorstep. At the time, Beasley served as the lead investigator for Microsoft’s Detection and Response Team (DART). He assumed it was from the group, which has been linked to the Kremlin’s Foreign Intelligence Service (SVR), although the sender didn’t leave a note. “Just little souvenirs and gift basket stuff from that area of the world,” he told The Register. “We-know-where-you-are kind of stuff. It’s a real eye-opener when you get that type of thing.” While digital intrusions having physical consequences is nothing new, cybercriminals in recent years have turned to real-life harm and mental and physical trauma to force victims into paying extortion demands. Some groups even use cybercrime as a gateway drug to real-life violence. Over the summer, Europol and its partners' investigators flagged 4,340 “horrific” URLs for removal as part of an ongoing crackdown on The Com (short for community), a loosely knit network of online groups whose young members participate in a range of illicit activities including hacking, swatting, digital extortion, real-life shootings, and other physical violence. “We’ve seen violence as a service get used,” Beasley said. He’s also investigated ransomware attacks where C-suite executives receive pictures of their kids’ schools directly from the cybercriminals in an attempt to apply psychological pressure to pay the extortion fee. “I've seen threats involving people's families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate,” Beasley said. This type of psychological intimidation and harm against victim companies’ employees has seen an uptick in the last several years to the point where it's almost common. Thirty-seven percent of ransomware attacks involved psychological or physical threats against staff, according to Semperis’ annual ransomware risk report. The global study of 1,200 post-ransomware organizations conducted over the first half of the year found attackers threatening psychological intimidation (23 percent) and physical threats (17 percent), to force payment. They are not only targeting executives and staff, but also families of their victims. A quarter of these victims experienced doxxing – posting individuals' personal details, such as names, home and work addresses, and phone numbers online – while another 25 percent had to seek psychological and/or medical treatment in response to ransomware infections. Nearly the same number (24 percent) hired personal security teams, while 23 percent experienced swatting calls – that's when attackers phone emergency services and report a bogus incident like a bomb or active-shooter threat to trigger an armed response. Additionally, more than half (53 percent) of respondents reported that ransomware attackers carried through on threats in the past year. Some of these threats reported by ransomed organizations’ employees include: threatening texts, letters, or packages: 57 percent threats against family or friends: 37 percent physical intrusion: 19 percent abduction: 17 percent bodily harm: 13 percent stalking: 6 percent. “It's the more well-known groups,” using psychological and physical threats to force payments, Beasley said. “I've seen Scattered Spider, I've seen ShinyHunters, I've seen Lapsus$.” For what it's worth, ShinyHunters claimed in an exclusive interview with The Register that they “don't attack human beings.” They did, however, admit that “there are times in the work we do sometimes we have to push the corporate to the absolute limit to get them on the table.” The takeaway for defenders and executives from this report is to “stand your ground,” Beasley said. “Don’t buckle under the pressure, and just know that you know it's going to be okay. If you feel like you're under duress, then by all means get law enforcement involved. Don't be afraid to call the cops. Don't be afraid to get the FBI involved, sooner rather than later. And don’t pay them.” This last piece of advice is important, as once you pay, they're going to come back for more. Semperis’ report found that 69 percent of surveyed ransomware victims were targeted multiple times within the past 12 months, and 31 percent made multiple payments to attackers. “Don’t pay anything,” Beasley said. “Never pay them.”®

Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code

submitted by /u/mlgbcnmsl
[link] [comments]

A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027).

At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system.

While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

“We’ve now crossed the 4,000 CVE mark with two months left to go,” he said.

Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software.

Tyler Reguly, associate director of security research and development at Fortra, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first.

“Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said.

Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos have a useful roundup of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable roundup that indexes vulnerabilities by severity, CVE number and affected software.

Chatbot prompts reveal the engineer’s alleged efforts to set up a covert listening device days before one was found in a meeting room used by high-level executives.