Windows Server

Windows users under attack via two new RCE zero-days

March 23, 2020

Attackers are exploiting two new zero-days in the Windows Adobe Type Manager Library to achieve remote code execution on targeted Windows systems, Microsoft warns. The attacks …

Wormable Windows SMBv3 RCE flaw leaked, but not patched

March 11, 2020

Yesterday, when Microsoft released its regular Patch Tuesday fixes, Cisco Talos and Fortinet inadvertently(?) also published information about CVE-2020-0796, a …

BlueKeep RDP flaw: Nearly a million Internet-facing systems are vulnerable

May 29, 2019

Two weeks have passed since Microsoft released security fixes and mitigation advice to defang exploits taking advantage of CVE-2019-0708 (aka BlueKeep), a wormable …

If you haven’t yet patched the BlueKeep RDP vulnerability, do so now

May 23, 2019

There is still no public, working exploit code for CVE-2019-0708, a flaw that could allow an unauthenticated remote attacker to execute remote code on a vulnerable target …

Microsoft’s Attack Surface Analyzer now works on Macs and Linux, too

May 20, 2019

Microsoft has rewritten and open-sourced Attack Surface Analyzer (ASA), a security tool that points out potentially risky system changes introduced by the installation of new …

Microsoft plugs wormable RDP flaw, new speculative execution side channel vulnerabilities

May 15, 2019

For May 2019 Patch Tuesday, Microsoft has released fixes for 79 vulnerabilities, 22 of which are deemed critical. Among the fixes is that for CVE-2019-0708, a …

Windows Servers in danger of being compromised via WDS bug

March 7, 2019

Checkpoint has released more details about CVE-2018-8476, a critical remote code execution vulnerability affecting all Windows Servers since 2008 SP2. The bug was responsibly …

PoC exploit for Windows Shell RCE released

October 12, 2018

Here’s one more reason to hurry with the implementation of the latest Microsoft patches: a PoC exploit for a remote code execution vulnerability that can be exploited …

AMD users running Windows 10 get their Spectre fix

April 12, 2018

AMD has released new microcode updates for mitigating variant 2 of the Spectre attack and Microsoft has released an OS update with the mitigation to AMD users running Windows …

Dangerous CredSSP flaw opens door into corporate servers

March 13, 2018

A critical vulnerability in the Credential Security Support Provider protocol (CredSSP), introduced in Windows Vista and used in all Windows versions since then, can be …

Vulnerable Apache Solr, Redis, Windows servers hit with cryptominers

March 9, 2018

Vulnerable servers of all kinds are being targeted, compromised and made to mine cryptocurrencies for the attackers. Apache Solr servers under attack SANS ISC handler Renato …

Microsoft releases Spectre fixes for Windows 10 on Skylake CPUs

March 2, 2018

Microsoft has pushed out a new set of Spectre (variant 2) security updates. For the moment, these are just for some devices running on Skylake CPUs and Windows 10 Fall …