patch tuesday

13 articles · newest first

A laptop running Windows in a dim office setting, at night

North Korean hackers had a Windows bug for weeks before Microsoft even knew about it

Check Point caught the exploit chain in the wild before Microsoft's own August Patch Tuesday shipped the fix — and this one installs a kernel-mode rootkit.

Kernel · Aug 26 · 6 min

Networking hardware and cabling, representing the Windows Deployment Services infrastructure affected by CVE-2026-62893

Software

microsoft patched a critical bug in the tool that images every PC in your office — then the fix broke it

CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.

Kernel · Aug 18 · 7 min

A data center server rack, representing the ColdFusion and Campaign Classic servers affected by Adobe's critical August 2026 patches

Software

adobe just patched THREE perfect 10/10 security bugs on the same day — and that many at once isn't normal

CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 all score a maximum 10.0 — unauthenticated, no clicks needed, full remote takeover. Here's exactly what's broken and what fixes it.

Kernel · Aug 18 · 7 min

Data center server racks, representing the Windows DNS Server vulnerability

Software

microsoft just patched a Windows bug that could worm through every DNS server on earth

CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.

Kernel · Aug 16 · 6 min

A person typing on a laptop in a dark room, representing a cyberattack

Software

North Korea hid a Windows zero-day inside fake job offers for five weeks

Lazarus used a bug in a core Windows driver to grab SYSTEM access and disable antivirus — Microsoft patched it Tuesday, weeks after North Korea started using it.

Kernel · Aug 13 · 7 min

Rows of server racks in a data center, representing the enterprise SharePoint infrastructure exposed by CVE-2026-63520

Software

an AI spent 24 days hacking SharePoint. it found a way in that needs zero login

Rapid7 pointed an agentic AI at Microsoft's code for 120 hours across 24 days — and it built the same kind of exploit chain nation-state hackers used to spend months on.

Kernel · Aug 13 · 6 min

Cloud server infrastructure representing Microsoft Azure services patched for critical vulnerabilities

Software

Microsoft just fixed three perfect-10 bugs in Azure and Teams — five days before Patch Tuesday

Three CVSS 10.0 vulnerabilities in Planetary Computer Pro, Azure SQL Database, and Teams got quietly patched on August 6 — completely outside Microsoft's scheduled August 11 Patch Tuesday.

Kernel · Aug 9 · 6 min

Rows of enterprise server racks in a data center, representing Active Directory infrastructure exposed by the Certighost vulnerability

Software

Any employee's login can now become domain admin — and the exploit code is already public

A low-privileged Active Directory account is all it takes to forge a Domain Controller certificate — Microsoft patched it in July, and a working exploit just landed on GitHub.

Kernel · Aug 1 · 6 min

NVD detail for CVE-2026-56188 showing a Windows Server network driver RCE

Software

a 9.8 in a Windows Server network driver lets an attacker run code with nothing but network traffic

CVE-2026-56188 is a race condition in a core Windows Server network driver that an unauthenticated attacker can exploit remotely. It affects every supported Windows Server. Patch it.

Kernel · Jul 30 · 9 min

NVD detail for CVE-2026-60198 showing a 9.8 CRITICAL Oracle WebLogic RCE

Software

Oracle just patched five separate 9.8 bugs that hand WebLogic to an anonymous attacker. patch all of them

CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.

Kernel · Jul 28 · 9 min

An IT professional with a laptop beside enterprise server racks

Software

there's an unauthenticated 9.8 in Windows RDP. we've seen how this movie ends — patch before the sequel

CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.

Kernel · Jul 28 · 7 min

Software

the Windows Print Spooler is a security hole again. if your servers don't print, just turn it off

CVE-2026-58608 is a fresh remote code execution flaw in the same Windows service that gave us PrintNightmare. It's on by default on virtually every Windows machine — and most servers have no reason to run it at all.

Kernel · Jul 24 · 7 min

A dark data center rack full of network cabling

Software

everyone rushed to patch the SharePoint zero-day. the 9.8 sitting on your DHCP server is the one that scares me

CVE-2026-50518 is an unauthenticated remote code execution flaw in Windows DHCP Server — no login, no clicks, network access is the only requirement. It got overshadowed, and Microsoft says exploitation is 'more likely.'

Kernel · Jul 23 · 7 min