Project
Microsoft's widely used desktop and server operating system family, including Windows 10, 11, and Windows Server, with NTFS as its core file system.
Cisco Talos disclosed eight vendor-patched flaws in Foxit Reader, Windows, Photoshop's installer and macOS CoreWLAN. The two Foxit Reader bugs reach code execution from an attacker's file, so Reader is the update to confirm on endpoints first.
Reality
Mozilla counts six Windows and Copilot behaviors that still override users' browser choice, 100 days after its Over The Edge 2.0 report. By Mozilla's own tests, the EU's Digital Markets Act fixed part of that in Europe and did not reach the newest surfaces.
Reality
A review of 1,383 public Claude Code mods found that 167 break on Windows because they call Unix tools like tail and open through $.process.run. The call uses no shell, so a tool Windows does not ship rejects on launch.
Reality
Graz University of Technology researchers used file-change alerts to catch 95.7% of another Windows user's Firefox site visits from an unprivileged account. On shared hosts and on servers that run services under their own accounts, separation between users is weaker than the account model suggests.
Reality
Three exploited flaws, three very different exposure classes. The self-hosted Metabase zero-day is the one with an unpatched population behind it.
Reality
GDB 18.1 adds every type symbol to .gdb_index to fix failed type lookups, and its notes say existing indexes should be regenerated. Teams that pin the debugger in CI should rebuild those indexes with it and retest any script that parses Windows paths.
Reality
Opera asked judges in Luxembourg to force Microsoft Edge under the Digital Markets Act and lost, which tells platform teams that crossing the user thresholds only opens a market investigation the gateway argument can still close.
Reality
Graz University researchers showed unprivileged apps can infer keystroke timing and browsing from file-change notifications on Linux, Android and Windows. The fixes shipped so far are partial, and the keystroke and KDE clickjacking flaws are still present.
Reality
CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC each take a low-privilege foothold to SYSTEM, and the remediation guidance asks for verified restarts, which is a harder number to report than install counts.
Reality
Proofpoint says at least four China-linked espionage groups fired the same BlueMoon code at different victims during the four weeks a Chromium fix took to reach stable Chrome, and two more groups probably did too.
Perspective Coverage
9 publishersReality
Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.
Reality
Graz University of Technology researchers used OS file-change alerts to identify sites another Windows user visited with 97.8% accuracy in Firefox. Every attack needs code already running on the device; on Android, an app that asks for no permissions is enough.
Reality
One operator's move of two TrueNAS servers onto a dual-TOR fabric failed at all five storage layers while the change plan reported healthy. Each break was invisible from the layer above it, so each layer needs its own cutover check.
Reality
A file-type detector passed 260 tests and scored 100% on a hand-built benchmark. Pointed at about 8,900 files already sitting on the author's PC, it called thirteen System32 files dangerous and hung for minutes on one .ini.
Reality
Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.
Reality
The public proof-of-concept watches Defender's update directories, hoards nearly all the free space on C: with delete-on-close files, and hands the space back once the update has already failed. At rest, the disk looks normal.
Reality
Cisco Talos read CLOSEDQUORUM statically: a Go binary that polls DeepSeek, Qwen, Mistral and Gemini before it touches LSASS. The distributed sample has dummy keys. One answering provider can carry the vote.
Reality
Veeam Agent for Windows has a local flaw that promotes a standard account to SYSTEM. Exploit code has been public since September 14. Arctic Wolf says there is no official workaround for systems that cannot patch yet.
Reality
Kaspersky says a previously unknown multi-stage loader has spread since mid-August through a compromised public torrent archive. It reaches its command server through the Solana blockchain. Victims include government and transport organisations.
Reality
A Flask app packaged by PyInstaller kept running after users quit, because os._exit(0) fired from a daemon thread does not reliably kill a frozen build. The cleanup now happens at the next startup.
Reality