Microsoft Defender’s Cleanup Driver Can Become the Tool That Removes Defender.
BTR Reforged shows how Microsoft Defender’s own signed boot-time cleanup driver can be redirected to remove endpoint protection after administrative compromise.
Microsoft
Microsoft Retracted the Entra ID Exploitation Claim. CISA Still Lists the CVE as Known Exploited.
Update, 22 August 2026: Microsoft has told BleepingComputer that it mistakenly marked a maximum-severity Microsoft Entra ID vulnerability as exploited in the wild. The correction removes the strongest public claim behind the first version of this article. It does not…
Patching SharePoint Did Not Revoke the Keys Attackers Had Already Stolen.
A critical SharePoint deserialization flaw is under active exploitation. Applying the security update closes the entry point, but stolen machine keys can preserve attacker access unless recovery goes further.
The Image Was Generated Locally. Its Identifier Came From Microsoft.
Microsoft Paint and Photos embed server-issued identifiers into locally generated AI images, joining remote moderation, pixel watermarking and C2PA provenance.
LegacyHive Was Public for a Month Before Microsoft Gave It a Patch and a CVE.
A public LegacyHive proof of concept exposed a Windows privilege-escalation path after July's updates. Microsoft patched it in August, showing how public research can compress the defender's window.
The Attack Needed No Exploit. ‘Anonymous’ Already Had Read Access.
ExfilSquad’s leaked data points to exposed Dataverse records, not a confirmed Dynamics exploit. Anonymous low-code permissions can be the entire breach path.
Microsoft Is Making Phishing-Resistant MFA the Default. Your Exceptions Become the Risk.
Microsoft will retire its Entra SMS and voice authentication service in February 2027, making passkey migration and exception governance urgent.
ShieldBreak Shows Why “Patched” Is Not the Same as Fixed
ShieldBreak is now CVE-2026-69414, a Microsoft Defender elevation-of-privilege vulnerability assessed as exploitation more likely and still awaiting a verifiable fix. This update separates it from RoguePlanet CVE-2026-50656, explains the different CFAPI attack path, conflicting Windows 11 reproduction results, affected-build uncertainty, and the operational controls security teams should use instead of treating patch deployment as proof that exposure is fixed.
SharePoint PoC Goes Live, and Attackers Start Using It Within a Day
Exploit code for CVE-2026-55040, a Microsoft SharePoint authentication bypass, was weaponised almost immediately after Rapid7 published its analysis. With thousands of SharePoint servers exposed online and a separate SharePoint flaw now tied to ransomware, administrators should treat patching, exposure reduction and compromise checks as one urgent task.
CVE-2026-68820 Turns a Windows Foothold Into SYSTEM
Microsoft’s August 2026 updates fix a WinSock privilege-escalation flaw used by North Korea’s Lazarus group against defence, aerospace and aviation organisations. The exploit helped Operation Dream Job turn a local Windows foothold into SYSTEM access, deploy a kernel rootkit and interfere with endpoint-security controls.