The IT Nerd

Microsoft has released emergency security updates for .NET 8, 9, 10 and 11 to address multiple vulnerabilities, including a buffer overflow flaw that could allow unauthenticated attackers to access or corrupt application memory.

The critical buffer overflow vulnerability, CVE-2026-111497, affects all platforms and could lead to information disclosure, denial of service or privilege escalation. Microsoft also patched CVE-2026-114148, a Linux vulnerability that could allow local attackers to modify files and gain elevated privileges.ㅤ

Microsoft additionally reissued fixes for two vulnerabilities after discovering that its October 13 updates had not fully addressed them. The company urged immediate patching, noting that organizations running self-contained applications or containers must rebuild and redeploy them rather than simply updating their systems.

ㅤDenis Calderone, Principal / CTO, Suzu Labs:

“Organizations that did everything right on October 13 are still running vulnerable code, and Microsoft’s own advisories say so. The flaw is getting the headlines, but the detail that should stop security teams cold is that CVE-2026-70197, the SocketAsyncEventArgs memory corruption fix, was disclosed in the October 13 advisory but never made it into that release. The Blazor WebAssembly debugger fix the same day, CVE-2026-102870, shipped with a packaging error that kept the corrected component from reaching machines. Unfortunately, we have two vul announcements, but neither got fully delivered.

“This lands in an awkward spot for the patching process most organizations actually run. CVE-2026-70197 is an unauthenticated out-of-bounds write in the socket layer, and the new Brotli flaw, CVE-2026-111497, is an out-of-bounds write in a decompression library embedded across .NET 8 through 11. Anyone relying on a patch report dated October 13 has been carrying a false green light for almost two weeks, and a version check would not have caught it, because on paper those deployments looked current. When the vendor’s release notes are the source of truth and the source of truth was wrong, verification has to mean more than a version number.

“The operational part turns this from a bad afternoon into a bad week. Self-contained applications and containers bundle the .NET runtime inside the artifact, so installing the October 25 update on the host changes nothing for them. They have to be rebuilt and redeployed. Ask yourself whether you can list, right now, which applications in your environment are self-contained versus framework-dependent, and where they run. Most can’t, and that inventory gap is what turns a one-day emergency patch into a two-week project.

“So, you should be updating the runtimes, rebuilding and redeploying every self-contained application and container, and updating the Blazor NuGet packages directly instead of trusting the shared runtime. For anything that can’t be rebuilt this week, the Brotli exposure has a configuration work around. The work around is simple enough. Brotli decompression is off by default, so the first question is whether you turned it on anywhere. If you did, remove “br” from request decompression and drop Brotli from HttpClient automatic decompression. That is a config change you can ship in hours, and it is your bridge until the rebuild lands. Then confirm the runtime version actually running in production, not the one in the change ticket. The teams that verify just had a better two weeks than the teams that checked a box.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“This story almost feels like Microsoft saw the PHP vulnerabilities, looked around, said, ‘Hold my beer,’ and handed us these .NET vulnerabilities.

“It’s been bad. Apparently, Black October isn’t done yet. These critical .NET vulnerabilities look like they’re hitting a large section of the websites that the PHP vulnerabilities missed.

“I do wonder if there were some .NET developers and Microsoft website maintainers feeling a little smug last week, thinking, ‘Well, good thing we weren’t running PHP.’ Now they have their own critical vulnerabilities to deal with.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock:

“When vulnerabilities like CVE-2026-111497 are left unpatched, an attacker exploiting this chain can start with memory corruption inside a vulnerable .NET process, escalate privileges against the service account running it, and inherit whatever reach that account has. Enterprises typically grant those accounts more reach than they need.

“Teams that already know what runtime versions are running in production and who owns each one will patch this fast. The rest should start that inventory work now.”

ㅤIf you rely on .NET, you need to patch all the things and do it fast.

Today, Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience, moved to dismantle domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure. Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone.

Microsoft has a blog on it here: https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations

Sina Chehreghani, Head of Threat Intel and Threat Research at Securonix, provided the following comments:

“The takedown disrupted three services that helped criminals acquire accounts, phishing kits and infrastructure at scale. Microsoft says they were used to send more than one billion malicious messages since January, targeting people and more than 75,000 organizations across 150 countries. That volume reflects a service economy built to lower the effort required to launch and repeat campaigns. Health-ISAC’s involvement also points to the pressure on hospitals and healthcare organizations, where compromised accounts can expose sensitive information and disrupt essential operations.

“A takedown gives defenders useful intelligence, but it does not confirm that every exposed account or related campaign has been contained. Security teams should use the indicators shared by Microsoft and Health-ISAC to review sign-in activity, inbox rules, forwarding changes, consent grants and suspicious access to cloud applications. They should also look for attempts to reuse compromised accounts or shift to replacement domains and infrastructure. Threat intelligence is most useful when it reaches detection and investigation workflows quickly, giving analysts context to connect current alerts with activity tied to the disrupted services.”

Take downs like this work. But there isn’t enough of them, and they aren’t done at scale. Thus they need to more of them and done on a massive scale to have a dent on the cybercrime industry.

Researchers have identified an active device code phishing campaign/kit dubbed “GhostCode” that is distributed through web contact forms, whereby threat actors pose as a procurement officer of a legitimate business. Device code phishing kits abuse the OAuth 2.0 device authorization grant flow to gain access to Microsoft accounts https://www.esentire.com/blog/ghostcode-dissecting-a-novel-device-code-phishing-kit

Michael Jenkins, CTO at  ThreatLocker provided the following comments:

“We’ve known for a while that attackers can get around MFA by stealing valid session tokens or sitting as an attacker-in-the-middle during MFA authentication. In this case, the victim completes a Microsoft authentication process but the attacker walks away with a valid token it can use to gain access. It’s another example of why MFA alone is no longer enough. Authentication should also verify that access is coming from an approved device so a stolen credential won’t work on an untrusted machine. Device identity needs to become another required layer of how we protect accounts online.”

Microsoft accounts are bane of my existence as account takeovers are common. One can hope that Microsoft does something about this so that changes.

Only days after Microsoft published it’s fix for “ShieldBreak”, a privilege escalation vulnerability in the Windows Defender Malware Protection Engine, researcher Nightmare Eclipse published a new “ShieldCrash” proof of concept exploit showing that Msoft’s vulnerability can still be activated. 

The POC was released on GitHub, “demonstrates an arbitrary file read as SYSTEM with September 2026” and is said to impact all Windows versions.

“Under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited,” Nightmare Eclipse said in the GitHub “README” file for ShieldCrash.

Yasir Zahid, Cybersecurity leader, Founding Member, Secure.com 

“The bigger worry here is not one exploit. It is the pattern. This is the third time in a row that a fix for the same Defender component has been bypassed right after Patch Tuesday. When a patch keeps missing the mark, the real problem is the attack surface underneath it, not the individual bug.

“On whether it works: independent public testing on fully updated Windows 10, 11, and Server systems suggests the exploit is functional, at least for reading files as SYSTEM and the attacker already needs a local foothold to use it. So the risk is real but bounded.

Watch your Defender health as a live signal, tighten local access controls, and treat your own security tools as an attack surface. If a researcher can probe it, an attacker can too. Test your defences the way an attacker would, then fix what breaks.”

Denis Calderone, CTO, Suzu Labs (https://suzulabs.com/home-suzu-labs):

“ShieldCrash is the third iteration of the same underlying race condition in the Malware Protection Engine. RoguePlanet came first in June, Microsoft patched it in July. ShieldBreak bypassed that patch in August, Microsoft patched it September 3. ShieldCrash dropped two hours after Patch Tuesday claiming the September 3 fix was incomplete. 

“The current PoC is a skeleton, the researcher’s own words, that demonstrates arbitrary file reads as SYSTEM but not a full SYSTEM shell or arbitrary writes. That is still meaningful because reading files as SYSTEM means you can pull the SAM database, credential stores, and configuration data off a fully patched box.

“On the viability question, I can’t confirm it from a lab, but the circumstantial case for taking this seriously is strong. This is Nightmare Eclipse’s eleventh Microsoft zero-day. Kevin Beaumont independently verified that their prior exploits work. CrowdStrike’s Patch Tuesday analysis says this researcher’s claims have historically been found to be accurate. And honestly, the fact that the researcher is calling this a skeleton PoC and openly admitting it only does file reads rather than overclaiming a full SYSTEM shell actually adds credibility in my opinion. There is no CVE assigned and no Microsoft patch or mitigation available as of September 10^th.”

Microsoft clearly has an issue that it can’t solve. At least not yet. The question is, if Microsoft can actually solve it before the bad guys exploit it.

Following Microsoft’s September 2026 Patch Tuesday security updates, a security researcher uncovered a new Microsoft Defender zero-day exploit named “ShieldCrash,” a bypass for the recently patched ShieldBreak Defender privilege escalation.

Ensar Seker, CISO at cybersecurity threat intelligence company SOCRadar, provided the following comments:

“ShieldCrash is concerning not simply because it affects Microsoft Defender, but because it appears to expose a recurring weakness in how this attack path has been remediated. When researchers can bypass successive fixes for RoguePlanet and ShieldBreak, it suggests the underlying security boundary or attack surface may require a more comprehensive redesign rather than another narrowly targeted patch.

It is important, however, to describe the current impact accurately. The publicly released proof of concept reportedly performs an arbitrary file read under the SYSTEM security context on fully patched Windows systems. That could expose highly sensitive files that an ordinary user cannot access, including configuration data, credentials or other secrets. Based on the information currently available, it does not yet provide an attacker with a full SYSTEM shell or arbitrary write capability. Nevertheless, privileged file disclosure can become an important component of a larger attack chain.

Organizations should not disable Defender as a reaction. Security teams should closely monitor Microsoft’s guidance and Defender intelligence updates, ensure tamper protection is enabled, restrict local execution and administrative access, and hunt for suspicious processes interacting with protected files through Defender-related mechanisms. Because proof-of-concept code is now public, defenders should assume attackers are examining it for ways to expand the primitive into credential theft, persistence or full privilege escalation. Microsoft should also assess the complete vulnerability class and related code paths, not only the specific condition demonstrated by this latest proof of concept.”

Microsoft responded with warnings of legal action against anyone engaging in “malicious activity causing real harm” to its customers, prompting many to believe that the company was directly threatening the security researcher.

But the fact is that the cat is out of the bag so to speak. Therefore Microsoft will need to deal with it. So lets see if they actually deal with it or not.

Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a critical flaw in Microsoft Copilot Personal made of three chained weaknesses that let an attacker exfiltrate data from a victim’s connected accounts, Gmail, Google Drive, Calendar, with a single click on a malicious link, discovered by researchers who questioned Copilot’s own reasoning rather than attacking its code until it disclosed an undocumented URL parameter and the protections meant to block it. Microsoft patched the flaw August 18, 2026, after Varonis reported it in December 2025 with no evidence of exploitation before the fix shipped, making it the third Copilot vulnerability Varonis has found this year.

Arti Raman, CEO & Founder of Portal26

“The exfiltration matters less than how the vulnerability was found. Researchers didn’t break Copilot’s code. They kept asking it questions until it explained its own bypass to them, an undocumented URL parameter, its own history of using it, and the protections meant to block it, all without ever touching the underlying software. The AI’s reasoning is part of the attack surface now, and most organizations have no visibility into what their assistant would say to a user, or an attacker, who kept pushing. This is the third Copilot flaw the same research team has found this year. That points to a structural gap in how these assistants get governed before they ship. You cannot govern what you cannot see, and right now almost nobody can see what their AI assistant would say under pressure.”

Anar Bayramov, Head of Product, Polygraf AI

“CoSnitch did a good job of finding the exploit. The researchers kept asking Copilot why a prompt wouldn’t run on its own, and it named the parameter, the conditions it worked under, and the protections that were supposed to disable it. The problem is that those protections weren’t set.  Everything after that is a mistake the industry repeats – Varonis found this in their Reprompt research, then in RovoBlast against Atlassian’s Rovo, and now in Copilot Personal.

Same idea every time: let a URL parameter seed the assistant’s prompt because it’s convenient for sharing. Once that parameter can execute inside a logged-in session, you’ve got CSRF with an LLM’s permissions. What’s more interesting is the memory. Microsoft addressed this attack class in June – sanitization on write, Task Adherence checks, memory updates surfaced in Defender, and scoped all of it to Microsoft 365. The consumer assistant, where an injected instruction survives password changes and session revocation without leaving a log entry, wasn’t covered by that guidance. The controls exist, but they just weren’t described for the product where this landed.”

The good news is that no user action is required to fix this. But it should make everyone question if having AI in house without the proper safeguards is worth it or not. I personally say not but I am free to be proven wrong.

UPDATE: Mark Mazur, Field CTO of Approov Mobile Security, offers the following comment:

   “CoSnitch proves that user authentication via OAuth isn’t enough when the execution client can be manipulated. Security teams must enforce Client and API Integrity alongside user identity, ensuring that every API request comes from a verified, untampered environment, preventing hijacked AI workflows from silently exfiltrating sensitive enterprise data.”

Microsoft says the growing volume of vulnerabilities identified with AI-powered security tools is contributing to delays in the first Cumulative Update (CU1) for Exchange Server Subscription Edition.

The Exchange team is prioritizing the validation, reproduction, remediation, and testing of newly reported security issues while continuing to release security updates each month.

Microsoft originally expected CU1 in the first half of 2026, later moving the target to the second half of the year. The company now says it has no release date, explaining that 

Steven Swift, Managing Director, Suzu Labs:

   “The problem with using AI to “find vulnerabilities” is that its relatively easy for a model to hallucinate that it’s found a vulnerability, and if  you try to use AI to validate the vulnerability, it will refuse to do so because of its safety tuning. This means teams that are trying to actually process and take these requests seriously end up with an impossible amount of work, trying to prove countless negatives.

   “On one hand, its a good sign that we’re being told security is being taken seriously. If delays are needed to avoid shipping known vulnerabilities, I generally support that. On the other hand, its very easy to blame AI for delays that are due to other factors. Its hard to tell which is which from the outside. Educated guess here is that Microsoft is looking at a bit of both. Its pretty easy to waste cycles on low value AI generated vulnerability reports, and its always easy to mis-manage a project, and end up behind schedule.

   “We should keep in mind that we’ve seen a steady increase in CVEs being published over the past 10 years, before AI became big. We already had a well established industry dedicated to vulnerability management, with tools designed to detect and help remediate vulnerabilities in code. Stacked on top of this now is vibe coded slop being pushed out in bulk by developers, who have been pressured to utilize AI in an effort to improve output. But while AI can push code out faster, it does not mean it does better.

   “AI is currently better at generating code and running test cases to validate functionality, than it is in proving that the code it wrote isn’t vulnerable. Part of this is training data and tuning. Its much more straight forward to validate functionality. There’s no test you can write that will prove a negative though. At best, you can match patterns and some known common weaknesses. As AI improves, it will get better at writing secure code. But if current trends hold, and models continue to refuse to validate potential vulnerabilities, it puts a cap on how useful models can be for detections.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “This is concerning. If we have so many vulnerabilities coming in that it’s actually delaying cumulative updates and patches from vendors, that’s a sign the system is starting to seize up a little bit.

   “And there’s a question that keeps rolling around in my head as we continue to see these issues with companies around the world. Did we really think AI was going to lower security headcount across the industry?

   “What we’re seeing is the opposite. AI is dramatically increasing the volume and velocity of security work that needs to be done. That means we’re going to need more security professionals, not fewer. And we especially need to be bringing in people at the junior level, training them, giving them experience, and building them into the senior security professionals we’re going to desperately need in the years ahead.”

Two experts get into why Lazarus exploiting a Windows zero-day is particularly concerning despite the vulnerability’s “Important” CVSS rating. And how kernel-level rootkits like FudModule can undermine the security tools defenders rely on, and what organizations can do when patching or traditional mitigations aren’t immediately possible.

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“This story highlights an important shift in how organizations need to think about defense. Effective cybersecurity can no longer be reduced to firewall rule changes, patching, and configuration updates. Those remain important, but they’re no longer sufficient on their own.

“Security teams need to start training for the moments when those traditional options aren’t available. What happens when a critical system can’t be patched? What happens when operational requirements prevent you from making firewall changes? Those situations are becoming increasingly common, especially in legacy environments and critical infrastructure.

“That’s where compensating controls become essential. Organizations should be regularly exercising these scenarios and asking, ‘What can we do today to reduce risk while we wait for a patch or a permanent fix?’ Whether it’s increased monitoring, network segmentation, deception technologies, stricter access controls, or enhanced threat hunting, teams need to understand which defensive options are available and when to deploy them.

“The goal of compensating controls isn’t to eliminate the risk. It’s to buy time. As zero-day vulnerabilities continue to emerge at a faster pace, organizations need strategies that slow attackers down and reduce their opportunities while vendors develop patches and defenders work to implement them.

“The organizations that will be most successful over the next several years won’t necessarily be the ones that patch the fastest. They’ll be the ones that have rehearsed how to operate safely when patching isn’t immediately possible.”

Denis Calderone, CTO, Suzu Labs (https://www.linkedin.com/in/deniscalderone)

“Lazarus has now exploited use-after-free vulnerabilities in Windows built-in drivers three times in two years to deploy the same rootkit. They went from appid.sys to AFD.sys to AFD.sys again. For a while, the standard playbook for getting kernel access was bring-your-own-vulnerable-driver: load a signed but buggy third-party driver, exploit it, get kernel privileges. Defenders adapted with driver allowlisting. Lazarus adapted by finding bugs in drivers that Windows ships by default. AFD.sys handles every socket operation on every Windows machine. You can’t blocklist it.

“Once the use-after-free fires, the attacker gets a kernel read/write primitive, and from there FudModule takes over. This is a rootkit that disables EDR callbacks, zeros out ETW provider registrations, and hides its own processes from the tools security teams rely on. The latest version, v3.1, adds the ability to tamper with Smart App Control, which means the rootkit is evolving faster than the mitigations Microsoft is building around it. And this CVE carries a CVSS 7.0, rated Important. There are 42 Critical patches in the same August Patch Tuesday release. If your vulnerability management program triages by severity score, this one is going to land in the middle of the queue behind remote code execution bugs that nobody has actually exploited yet. That’s exactly backwards.

“CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities catalog on August 11 with a federal remediation deadline of August 25, so needless to say, get this one patched right away, regardless of the CVSS score. Given that Lazarus had at least five weeks of active exploitation before the fix shipped, organizations in defense, aerospace, and adjacent sectors should be particularly diligent and treat anything unpatched since early July as potentially compromised. Check Point’s report includes the full IOC list covering file hashes, C2 domains, and the specific malware components used in the campaigns. Hunt for evidence of the MISTPEN downloader. It beacons out using Microsoft Graph API and OneDrive traffic, so look for anomalous indicators from workstations that don’t typically use those tools. Also look for unsigned DLLs loaded alongside legitimate PDF viewers and any evidence of ETW provider or kernel callback manipulation. Lazarus has shown that it’s possible to render EDR telemetry useless from the kernel level, and too many defenders still treat their EDR as a single source of truth. That dependency is exactly what FudModule is built to exploit.”

China-linked hackers exploiting a critical vulnerability in Microsoft’s software and turning that access toward ransomware. While you can find out about the issue here, this is the TL:DR. Please read the entire chain:

Phillip Wylie, Chief Security Evangelist & Sr. Consultant, Suzu Labs (https://www.linkedin.com/in/phillipwylie)

“The biggest takeaway isn’t just another critical vulnerability – it’s that attackers are increasingly targeting the tools organizations trust most. RMM platforms, identity systems, and security products provide privileged access by design, making them ideal force multipliers for threat actors. Organizations should treat these platforms as crown-jewel assets, prioritize rapid patching, closely monitor privileged activity, and assume that even trusted management infrastructure can become an attack vector.”

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“This particular attack fits into China’s broader cyber great power initiative that they’ve been working on for well over a decade, building the capability to exploit and gain access to as many systems as possible. I tend to think this particular attack was triggered by the vulnerability being discovered. China may have already been exploiting it for some period of time before the vendor publicly disclosed it on July 31.

“And this gets into a larger question that I think we need to ask whenever we see nation-state attacks suddenly transition into ransomware campaigns. What were they doing before?

“Remember, with a nation state like China, Russia, or even the United States, the primary goal generally isn’t ransomware. The goal is access. They want to dwell inside environments and maintain that access for as long as they possibly can. The way this particular attack has been linked to China leads me to believe the vulnerability may have been used for that type of access and persistence for some period of time. But once the vulnerability became public and a patch was available, its usefulness for longer-term nation-state operations dropped significantly. At that point, you might as well transfer the capability over to ransomware operations and extract whatever remaining value you can from the vulnerable systems that are still out there.

“There’s another issue here involving the vendors we choose for core security technologies, especially RMM tools. We really need to question whether we should be self-hosting these systems at all. If it’s a cloud service, the provider can potentially patch and update that service very quickly across its entire customer base. If you’re self-hosting it, you’re now dependent on your own organization getting that patch deployed as quickly as possible. And that matters here. Some of the research we’ve been seeing indicates that more than 25% of these servers may still be unpatched and vulnerable to this attack.

“Once again, this highlights one of the major problems with on-premises technology when a serious vulnerability drops. Getting a patch is one thing. Getting that patch deployed everywhere fast enough to matter is something completely different.”

The threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the CISA KEV catalog on August 3, 2026. You should apply all updates to your Windows systems and Microsoft Defender for Endpoint detects this activity. So update that too.