The IT Nerd

Microsoft’s record Patch Tuesday isn’t just a milestone – experts say it won’t hold the record for long. This explains why AI is accelerating both software development and vulnerability discovery, why security teams are facing a growing prioritization challenge rather than simply a patching problem, and why organizations will need to rethink traditional approaches to patch management as vulnerability volumes continue to climb.

John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)

“I think we’re just in the beginning stages of the crush of vulnerabilities that’s going to come from vendors across the industry. The Copilot vulnerability with a 9.6 CVSS score is one that many organizations could easily overlook, but the bigger issue is that this pace isn’t slowing down. Microsoft has one of the most mature and automated patching ecosystems in the world, and even then organizations struggle to keep up. Most vendors aren’t anywhere near that level of maturity, which means security teams are going to be increasingly overwhelmed trying to patch AI-related vulnerabilities across dozens of different products.”

Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)

“Six hundred vulnerabilities in a single patch cycle is not a backlog problem, it is a prioritization crisis waiting to happen.

“The CVE count is noise unless you map it against what you are actually running, what is reachable from outside your perimeter, and whether there is confirmed exploitation in the wild, because the actively exploited zero-days in Active Directory and SharePoint deserve your engineers this week, not your ticketing system next quarter. Patch management that treats a record-breaking advisory like a queue to be worked through sequentially will lose, and it will lose to adversaries who read the same bulletin and go straight to the vulnerabilities that matter.”

Jacob Krell, Sr. Director, Secure AI Solutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)

“622 is the biggest Patch Tuesday on record. It won’t hold the record long, because AI is inflating both sides of the vulnerability equation, generating more code that introduces more bugs while scanning existing codebases faster and turning up what humans missed. Microsoft told customers to expect rising volumes from its AI scanning tools, and the trajectory already proves it, June broke the all-time record at 206, July tripled it. Adobe moved to twice-monthly security releases for the same reason.

“That volume changes how patching has to work. The manual process of reading every advisory, scoring by CVSS, and testing in a lab was built for monthly batches of 60, and at 622 it breaks before lunch. What still works is triaging by active exploitation, so the two zero-days in Active Directory Federation Services and SharePoint (CVE-2026-56155, CVE-2026-56164) go first because attackers are already using them to escalate privileges. Anything on CISA’s Known Exploited Vulnerabilities list goes next, then filter by your own attack surface, whether the service is internet-facing, whether the vulnerability chains with existing exposure, and whether it touches identity infrastructure.

“Counting CVEs tells you volume, not risk, and the tools most organizations rely on to tell the difference are failing. Microsoft’s own exploitability index rated this month’s SharePoint zero-day as “exploitation less likely” the same month it landed on CISA’s KEV list as actively exploited. AI models can already produce working proof-of-concept exploits for vulnerabilities that traditional frameworks score as low-priority, which means the scoring systems were calibrated for a human-speed world that no longer exists. Organizations need to match machine-speed discovery with machine-speed defense, because the patch count will keep climbing whether they’re ready or not.”

Patching is one avenue towards addressing this. But organizations need to take a more holistic approach in terms of addressing vulnerabilities in their environment. And the sooner the better.

In The Reverse Information Paradox, coined by Microsoft Chairman and CEO Satya Nadella, he warns that organizations pay for AI twice: once in cash (subscription fees), and again in proprietary knowledge. In doing so, they risk giving away valuable knowledge. Enterprises need greater control over their data and said that a company should be able to use a model without giving up the knowledge that makes it unique – a reverse information paradox we need to confront.

Rohit Valia, CEO of cybersecurity company Tumeryk, provided the following comments: 

“Satya Nadella’s The Reverse Information Paradox is the talk of tech because it uncovers an uncomfortable truth: using Palo Alto Networks, Sentinel One, CrowdStrike or another Security-as a-Service solution means that you’re giving up your intellectual property to another company’s AI. Regulated companies and government organizations need to select security providers that operate within your cloud infrastructure, ensuring no prompts or proprietary data leaves your organization. Prompts are your data.”

While organizations rely on AI, they should not be under the illusion that AI is a free lunch. On the contrary it is the opposite. Organizations may want to keep that in mind.

Frequent readers of this blog won’t find this new. But some of you will which is why I am covering it. For years fake Microsoft alerts have popped up via surfing around. But what makes this campaign unique is that these fake popups have been used to deliver North Korean-linked NarwhalRAT. This is another reminder that attackers don’t always need sophisticated exploits to compromise organizations. Increasingly, threat actors are succeeding by impersonating trusted brands, security notifications, and software providers to manipulate user behavior and bypass traditional defenses. The malware itself is only part of the story. The real challenge is that users are being asked to make security decisions in environments where legitimate and malicious prompts can look nearly identical.

Cybernews for example has details:

The infection begins with a spear phishing email pretending to be an urgent security alert from the “Microsoft Account Team.”

The message warns the recipient about suspicious one-time password activity and directs them to open an attached advisory document. In reality, the attachment is a ZIP archive hiding a malicious LNK shortcut file, not a real document.

Analysts at Genians Security Center said in a report shared with Cyber Security News (CSN) that this threat bears strong similarities to a Python-based backdoor campaign documented in May 2026.

Researchers named the malware NarwhalRAT, drawing on the string “naverwhale” found inside its code, believed to be an attempt to masquerade as Naver Whale, a popular browser in South Korea.

The malware primarily targets Korean users, and its behavioral structure confirms this. NarwhalRAT uses “naverwhale” as its working directory name and assigns Hidden and System file attributes to the created folder to stay out of plain sight.

It also handles KakaoTalk-related window identifiers separately during data collection, strongly pointing to Korean targeting. 

The threat actor operated a dual command-and-control structure using a Korean relay server alongside the pCloud API as a Dead-drop Resolver. This lets the attacker change the actual C2 address without touching the malware, and helps traffic blend with normal web activity, making detection harder.

Yagub Rahimov, CEO, Polygraf AI

“It’s interesting to see what NarwhalRAT tells us about where APT37 is focusing on. This group was almost entirely on RokRAT, it was their signature, basically the thing analysts used to point to them. Moving to a new Python-based RAT helped them break that signature – it helps them to look like someone else.

Everything else in this campaign is built around being invisible, not getting in clever. All the attempts like, the LNK chain, the fileless in-memory execution or the Python runtime taken from the official site – none of it is interesting on its own. APT37 has been running using similar playbook for over a year. What’s interesting is the attention to details. Wiped timestamps, a staging directory named to impersonate Naver Whale, persistence through a scheduled task with a name designed to blend into legitimate Windows entries. Every decision was trying not to trip anything that watches disk or signatures. There’s nothing for traditional antivirus to grab onto because almost nothing touches the disk in a recognizable form.

A fake Microsoft account security alert warning about OTP abuse is almost perfectly designed, it uses the victim’s own security awareness against them. The more trained someone is to take account-security warnings seriously, the more likely they are to open the attachment. That’s what this attack relies on. Every technical layer can be defeated by detection eventually, but the entry point is a human being doing what they’ve been told is the responsible thing. That’s where the chain actually breaks.”

While this is targeting Korean’s, you can expect it to target you next. Thus if your charged with defending your organization from threats, consider yourself warned.

In a statement published yesterday, Microsoft warned that recent public disclosures of unpatched zero-day vulnerabilities without prior coordination have placed customers at “unnecessary risk.”  The company said several researchers disclosed vulnerability details publicly before Microsoft had an opportunity to develop and distribute security fixes.

The company said coordinated vulnerability disclosure allows vendors time to investigate reports, prepare mitigations, and release patches before technical details become widely available to attackers. Microsoft argued that premature disclosure can increase the likelihood of exploitation against customers who have no available patch or remediation at the time information becomes public.

The warning comes as Microsoft continues addressing multiple recently disclosed vulnerabilities across Exchange Server, Defender, Azure, Windows networking components, and enterprise products during an unusually high-volume patching cycle. Microsoft released fixes for 138 CVEs during May Patch Tuesday alone, while additional vulnerabilities and mitigations were disclosed outside the regular patch release schedule.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Coordinated disclosure is a shared obligation. Microsoft generates hundreds of billions in annual revenue. No researcher should be expected to subsidize product security for free. Six vulnerabilities across core Windows components including Defender and BitLocker that reached production represent a vendor engineering failure. These flaws should never have shipped. Vendors who ask for coordination must also invest in responsive triage and the development rigor that prevents this.

   “The traditional 90 day embargo was designed for a slower world. AI has compressed vulnerability discovery timelines so dramatically that ninety days is enough time for an entirely new frontier model to be deployed and pointed at the same codebase. Microsoft has patched over 500 CVEs in the first five months of 2026 alone. That volume is a signal that product security posture across the ecosystem is weaker than the market assumes. The Nightmare-Eclipse campaign has followed through on every public threat so far, and the warnings of further disclosures should be taken seriously.”

John Carberry, Solution Sleuth, Xcape, Inc.:

   “Microsoft’s sharp public rebuke against zero-day drops highlights an escalating war of attrition between independent researchers and enterprise vendors. While Microsoft argues that dropping vulnerabilities like RedSun, UnDefend, and BlueHammer puts the entire ecosystem at risk, this friction points to a deeper systemic breakdown. The security research community is clearly growing frustrated with vendor triage timelines, a bottleneck that has become critical given that Microsoft is already drowning in an engineering workload, evidenced by a massive 138-CVE patch cycle this month alone.

   “For enterprise risk leaders, this public spat is a dangerous distraction from the actual operational threat. The moment a researcher publishes full technical details or a working proof-of-concept for core Windows components like Defender, Azure, or Exchange Server, the time-to-exploit window for threat actors drops to zero.

   “Security executives cannot afford to wait around for vendor patches to slowly wind their way through QA and deployment pipelines. They must establish an aggressive, internal mitigation capability that treats uncoordinated disclosures as immediate, active incidents, forcing them to deploy temporary configuration workarounds and hyper-specific EDR detection rules the moment a flaw hits GitHub, long before the official automated fix arrives on a future Patch Tuesday.

   “Critical Takeaways

•    “The zero-day names to watch: The uncoordinated drops specifically targeting core architecture(RedSun, UnDefend, BlueHammer, and the YellowKey BitLocker bypass) are not theoretical exercises. They represent immediate blueprints that threat actors are actively integrating into automated scanning tools.
•    “Vendor triage under siege: Microsoft’s massive 138-CVE May release proves that vendor patch pipelines are stretched to their limits, systemically increasing the delay between a researcher’s initial private bug report and a public patch.
•    “The mitigation engineering mandate: Relying entirely on automated patch management leaves an enterprise completely exposed during uncoordinated drops. Teams must be structurally capable of manually applying complex, out-of-band scripts and registry mitigations.

   “When researchers choose to drop working exploit code for core enterprise infrastructure directly to the public, they are giving the entire Internet an immediate, unauthenticated pass into your network before a lock has even been engineered.

   “The current standoff proves that the traditional model of coordinated vulnerability disclosure is buckling under its own weight, leaving enterprise security teams stuck in the crossfire between impatient researchers and overextended software vendors.”

Lydia Zhang, President & Co-Founder,Ridge Security Technology Inc.:

   “The number of CVEs patched by Microsoft on Patch Tuesday highlights the challenge facing security teams which is, what should I be prioritizing?   Security tools that just identify vulnerabilities are insufficient.   In fact, even knowing that a vulnerability is exploitable is insufficient.  Knowing the kill-chain is insufficient.  The missing piece of the puzzle is combining that exploitability and kill-chain knowledge with business context such as what assets can be reached thru these exposures and how valuable are those assets?”

My only advice is to hold companies like Microsoft accountable. Otherwise we will have vendors deciding what is and isn’t public domain. Which is of course dangerous.

So over the last few days, the Internet has been losing its mind over the fact that Microsoft on July 13 2026, Microsoft Office 2021 and 2019 for Mac will only be able to open files. But they cannot save them. This is documented here. And the reason for this is an expired certificate. If you want examples of how people are losing their minds over this, take this Reddit thread or this one to see what I am talking about.

But is the outrage justified? I am not sure because I can see this from both sides.

On one hand, Office 2019 for Mac has reached the end of support in October 2023. That means that it is not receiving security updates or bug fixes. Office 2021 for Mac will be in the same state in October 2026. So users realistically should be installing either Office 2024 or using Microsoft 365 as it’s never a good idea to run unsupported software as that’s a gateway for threat actors to pwn you.

On the other hand, many people on Reddit feel that this is anti consumer as comes across Microsoft deciding to effectively kill a license that they paid for. Also they feel that Microsoft could easily come out with a software update that addresses the certificate issue. But clearly they don’t want to do that. And forcing users to pay for an upgrade is good for Microsoft’s bank account.

Mac users have a few choices if they are in this situation:

• Upgrade to Office 2024 or Microsoft 365. I should note that Microsoft 365 is currently free via the web version of the suite. So that’s a free alternative if you have constant access to the Internet.
• Use Apple’s iWork suite as it is free for normal use.
• Switch to an open source alternative such as LibreOffice. 

A few random thoughts. I have said for years that that hell hath no fury as an Apple user scorned. Microsoft may be about to find this out shortly as this is unlikely to go away. Also, these Mac users who are outraged need to recognize that there are options for them and they should look into those alternatives ASAP. Because running these versions of Office is not going to be an option.

A critical attack chain has been found that completely bypasses Microsoft Entra ID Conditional Access without deploying malware or touching an endpoint. Using just a single set of credentials, the researchers compromised a production tenant with over 16,000 users.

Howler Cell conducted authorized red team operations against a production enterprise Microsoft Entra ID tenant (~16,000 users, ~82,000 devices, 78 Conditional Access policies). Starting from a single set of valid user credentials blocked by Conditional Access, the engagement produced a full bypass chain: 

• Phantom device registration
• Primary Refresh Token minting 
• Intune compliance without a real device 
• Enterprise application exfiltration 
• On-premises-to-cloud privilege escalation path mapped to Global Administrator.

No corporate endpoint was touched. No malware was deployed. The vulnerability is not in any single component. It is in the trust chain between them.

More details here: https://www.cyderes.com/howler-cell/azure-ad-conditional-access-device-identity-abuse

Ensar Seker, CISO at threat intel company SOCRadar, commented:

“The Howler Cell research highlights a dangerous reality many organizations still underestimate: identity has become the new perimeter, and attackers know how to abuse the trust built into cloud identity ecosystems. What makes this attack path especially concerning is that Conditional Access was technically functioning as designed, yet the attacker was still able to introduce a “trusted” phantom device into the environment and obtain a valid Primary Refresh Token. Once the identity system believes a device is compliant, many downstream protections effectively collapse.

This also demonstrates why organizations cannot rely solely on default Entra ID configurations or compliance states as proof of trust. Attackers increasingly target enrollment workflows, token issuance, and device registration processes because these areas often receive less scrutiny than endpoint malware defenses. Organizations should aggressively restrict device registration permissions, require hardware-backed authentication such as phishing-resistant MFA, continuously audit newly joined devices, monitor abnormal PRT issuance activity, and implement strong conditional policies around privileged access and unmanaged enrollment scenarios.”

Consider this to be your wake up call. Zero trust isn’t a buzzword, it should be a reality for you. And this red team exercise illustrates why.

On April 29, researcher Tom Jøran Sønstebyseter Rønning, posting as @L1v1ng0ffTh3L4N, presented findings showing that Microsoft Edge decrypts every saved password at startup and holds all of them in process memory, in cleartext, for the entire browser session. The researcher reports that this includes both passwords for sites the user is visiting and every credential the user’s ever saved. The passwords are held in memory from the moment Edge opens.

Uzair Gadit, Founder & CEO, Secure.com

“What makes this Edge finding unusual is not just the technical behavior, it is the assumption behind it. Users are told to follow best practices, use strong passwords and use a password manager, and they did. The problem is the software holding those credentials made a design decision that fundamentally changes the risk, and most users were never made aware of it.

“On its own, requiring administrative access might sound like a limiting factor. In reality, that’s exactly where many enterprise breaches begin. Once an attacker gains privileged access in a shared environment like RDS or Citrix, the difference between decrypting credentials on demand versus holding them all in memory becomes significant. It can turn a single compromised account into a broad credential exposure event across multiple users.

“This is where the cyber sector needs to shift its thinking. We have spent years telling users to improve password hygiene, but this isn’t a hygiene problem, it’s an exposure problem. The question is no longer just how strong a password is, but how long it exists in a usable state, where it exists, and who or what can access it there.

‘The architectural difference highlighted here is important: minimizing the time credentials exist in plaintext reduces risk. Keeping everything decrypted for convenience increases it. Both are intentional design choices, but only one aligns with how attackers increasingly operate, especially with automation and AI make it easier to move laterally once access is established.

“World Password Day tends to focus attention on user behavior. This is a reminder that the bigger risk often sits one layer below that, in the design decisions made by those producing the tools people are told to trust. If those decisions prioritize usability over exposure reduction, then even a user’s perfect password hygiene won’t consistently deliver the security outcome their organizations expect.

“The real takeaway isn’t that passwords are weak, it’s that credential exposure still isn’t being treated as a first-order risk in system design. Until that changes, attackers will continue to focus less on breaking in and more on taking advantage of what’s already available once they are inside.”

This is pretty bad and it is a epic problem that needs to be addressed. I would be very interested to see how Microsoft addresses this as they are the only Chromium based browser to have this issue.

Researchers have published new findings PhantomRPC: A new privilege escalation technique in Windows RPC on April 24^th about a  has no patch as it is said to be an architecture problem, and affects all Windows systems.

In response, three cybersecurity experts offer perspective.

Sameed Aijas Ahmed Khan with Dubai-based Secure.com:

“PhantomRPC is a meaningful finding because it sits at the architectural level of Windows, not in an isolated feature that can simply be switched off or patched. What makes it particularly relevant for organizations is the lateral movement risk. 

Once an attacker has a foothold, a flaw in how Windows systems communicate internally can become a pathway across the broader environment and that kind of silent spread is exactly what makes unpatched vulnerabilities so costly over time. We’ve written about how the Dell zero-day campaign went undetected for over 400 days precisely because the initial entry point wasn’t caught in time.

Architectural changes are genuinely complex, and caution is understandable. But as we’ve covered in looking at the Microsoft Word zero-day earlier this year, the window between disclosure and active exploitation tends to be short and organizations are left managing that risk largely on their own.

When remediation isn’t immediately available, mitigation becomes the working strategy. That means network segmentation to limit unnecessary exposure, tightening access controls around privileged accounts, and increasing monitoring for anomalous behavior in affected systems. As we note in our coverage of vulnerability remediation vs. mitigation, a mitigated vulnerability is still present so the goal is to reduce the blast radius while staying alert to how the situation evolves.”

Jacob Krell, Senior Director, Secure AI Solutions and Cybersecurity, Suzu Labs:

PhantomRPC can turn a lower-privileged service compromise into SYSTEM-level control. For an organization, that means a normal foothold can become full host compromise. From there, an attacker may be able to access sensitive credentials, tamper with security tooling, establish persistence, and use the machine as a staging point for lateral movement. The important point is that this is not just a single bad component. Kaspersky’s research points to a broader weakness in how Windows RPC handles server provenance, which means new abuse paths may continue to appear as researchers and attackers find additional privileged RPC clients.

Microsoft’s decision not to issue a patch makes sense only within a narrow vulnerability-triage model. The issue typically requires SeImpersonatePrivilege, and Microsoft appears to have treated that prerequisite as a limiting factor. The problem is that SeImpersonatePrivilege has been central to Windows privilege escalation research for years. It is not rare, exotic, or purely theoretical. Many real-world compromises already land in service contexts where impersonation privileges are available by design.

That is especially important because service accounts are often one of the first positions an attacker obtains after exploiting a web-facing application or local service. From an attacker’s perspective, the question after that initial foothold is simple: how do I become SYSTEM? PhantomRPC provides one answer by abusing the trust relationship between privileged RPC clients, expected endpoints, and impersonation. That makes the prerequisite less reassuring than it may appear on paper.

Microsoft should remediate the underlying architectural weakness, or at minimum provide stronger platform-level safeguards around RPC endpoint authenticity and privileged impersonation flows. The lesson from the Potato family was that broad impersonation rights can turn service-level access into SYSTEM. PhantomRPC shows that lesson still applies, just through a different IPC path. A flaw that repeatedly converts common service compromise into full host control should not be dismissed simply because the dangerous privilege was granted by design.

To protect themselves, organizations should focus on detection, hardening, and reducing unnecessary impersonation exposure. Kaspersky’s recommended approach is ETW-based monitoring for RPC activity where high-privileged clients attempt to connect to unavailable servers, especially when those calls use elevated impersonation levels. Those failures can indicate places where a malicious RPC server could be inserted.

They should also review which custom and third-party services hold SeImpersonatePrivilege and remove it where it is not strictly required. Where possible, legitimate services should be configured so expected RPC endpoints are actually registered, reducing the opportunity for an attacker to occupy the missing endpoint first. This is not a complete fix, but it reduces the attack surface and gives defenders observable signals.

PhantomRPC should be viewed in the same lineage as the Potato family of Windows privilege escalation techniques. Those exploits showed years ago that service accounts with SeImpersonatePrivilege can become a dangerous bridge to SYSTEM when Windows allows a lower-privileged process to impersonate a higher-privileged caller. PhantomRPC matters because it shows that the underlying design issue was never fully eliminated. The abuse path has moved from familiar COM-based techniques into the RPC layer itself.

That is why treating SeImpersonatePrivilege as a simple prerequisite misses the larger point. The privilege is widely granted to service identities because Windows services need impersonation for legitimate functionality. In practice, that makes it part of the operating system’s architectural attack surface, not an unusual edge condition. If a common service context can register the right endpoint, wait for a privileged client, and inherit its authority, the weakness is in the trust model around impersonation and endpoint provenance.

This is also unlikely to be the last route researchers find. Once the pattern is understood, the question becomes how many other privileged Windows clients connect to expected IPC endpoints without strong enough assurance about who is actually listening. Security teams should treat PhantomRPC less like a one-off vulnerability and more like a signal that Windows IPC and impersonation flows need sustained monitoring, hardening, and architectural attention.

Xcape, Inc. board member Damon Small:

Microsoft’s decision not to patch is technically defensible under their traditional servicing criteria – since the attacker already needs SeImpersonatePrivilege – but it is operationally negligent in a landscape where attackers frequently use compromised service accounts as a beachhead. This “Moderate” rating ignores how easily these prerequisites are met during real-world lateral movement. Since no patch is forthcoming, defenders must treat this as a permanent architectural debt. To be clear, it is not so much that Microsoft decided not to patch, but at this time it appears that it cannot be patched without fundamentally changing how RPC functions.

The most effective mitigation organizations should invoke is to restrict SeImpersonatePrivilege to the absolute minimum number of accounts and utilize Host Intrusion Prevention Systems (HIPS) or EDR rules to monitor for unauthorized processes attempting to bind to known RPC ports, particularly those associated with the Terminal Services port range.

This was reported to Microsoft on September 25, 2025. Microsoft assessed this as a moderate severity, not eligible for a bug bounty, and not in need of a CVE or immediate fix at the time. Because of the fundamental, architectural, nature of this vulnerability, we should expect to see variants on this attack pattern emerge in the future. Defenders should keep an eye on service accounts exhibiting anomalous behavior, such as spawning arbitrary listeners. This publication at this time is indicative of a pattern where Microsoft has downplayed an external researcher’s finding because resolving the underlying issue is a deep architectural change. It is a bold strategy for Microsoft to claim a flaw is not a bug simply because you have to be halfway into the house before you can use it to unlock the safe.

I strongly recommend that you read this report and consider this to be a “today” problem because there is no fix. Which means that it’s only a matter of time for threat actors exploit this if they have not already.

I have received two calls today about people having issues with Outlook.com email accounts (which can be also hotmail.com). Here’s what they are reporting:

• Outlook on iPhone is making users sign in.
• You go through the steps to sign in and you still get a prompt to sign in.
• Removing and re-adding the account does not fix this. Mi

I’ve been able to replicate this myself.

This issue seems to be widespread based on Down Detector which has similar reports of this issue. Microsoft’s Service Status page as well as on Twitter confirm this as well:

Thus it is safe to say that Microsoft has an issue that it is trying to wrap its hands around. There does not appear to be an ETA to resolution. Thus users of Outlook.com will have to wait it out until Microsoft fixes this.