Microsoft Defender’s Cleanup Driver Can Become the Tool That Removes Defender.
BTR Reforged shows how Microsoft Defender’s own signed boot-time cleanup driver can be redirected to remove endpoint protection after administrative compromise.
Black Hat USA 2026
A Zoom Participant Could Reach Every Other Device. AI Built the Exploit in a Day.
Zoom has patched a set of memory-safety vulnerabilities that researchers combined into a zero-click remote-code-execution attack through the live-meeting annotation protocol. A malicious participant could target a presenter, while a malicious presenter could reach participants across Windows, macOS, iOS and…