Vulnerability Details & Exploitation

The flaw, tracked as CVE‑2025‑59287 (with a CVSS score of 9.8), is a remote code execution vulnerability impacting WSUS instances when the Server Role is enabled. It arises due to “unsafe deserialization of AuthorizationCookie objects” sent to the GetCookie() endpoint, which decrypts AES-128-CBC data and then passes it into the .NET BinaryFormatter without proper type validation. This chain allows an attacker to gain SYSTEM privileges.
Microsoft’s advisory confirms the update applies to supported versions of Windows Server including 2012, 2012 R2, 2016, 2019 and 2022, plus the 23H2 Edition “Server Core installation”.
Significantly, the exploit is live. Security researchers at Eye Security and Huntress report that threat actors have been targeting WSUS endpoints exposed on ports 8530 and 8531 since around October 24, 2025. A payload was observed that used a simple “aaaa” HTTP header value to execute commands via cmd.exe and PowerShell.
Microsoft noted that initial mitigation did not fully address the issue and re-released the CVE accordingly.

Background & Risk Context

WSUS forms a key part of Microsoft’s patch-management and update-distribution infrastructure for Windows-based systems. When misconfigured or exposed, it becomes a high-value target for attackers seeking to deploy malicious code across an enterprise. This newly discovered deserialization flaw is particularly worrying because BinaryFormatter has long been flagged as unsafe for handling untrusted input. In fact, Microsoft removed it in .NET 9 as of August 2024.
The weakness is not universal: it affects only servers where the WSUS Server Role is enabled. Servers without this role are unaffected, according to Microsoft.
Further raising the stakes, the Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, meaning U.S. federal agencies are required to remediate by 14 November 2025.

Expert Insights & Mitigation Guidance

According to Eye Security’s CTO, Piet Kerkhofs:

“The payload uses the request header with the name ‘aaaa’ as a source for the command that is to be executed … This avoids commands appearing directly in the log.”
Huntress reported:
“Attackers leveraged exposed WSUS endpoints to send specially crafted requests (multiple POST calls to WSUS web services) that triggered a deserialization RCE against the update service.”
Given the public proof-of-concept and active exploitation, organisations are urged not to delay. Microsoft recommends applying the out-of-band update and then rebooting the server. For cases where patching isn’t immediately feasible, Microsoft and NCSC-NL advise temporary mitigations:

• Disable the WSUS Server Role if enabled.
• Block inbound traffic to ports 8530 and 8531 on the host firewall.
  It is vital not to disable these workarounds after applying the patch until full verification of the fix.

Conclusion

The discovery and rapid exploitation of CVE-2025-59287 demonstrate how even trusted enterprise infrastructure—such as WSUS—can become a vector for high-impact attacks. With an RCE in the wild that permits SYSTEM-level execution via exposed update services, the threat is real and imminent. Organisations using WSUS must treat this as high priority: verify whether the Server Role is enabled, patch immediately, ensure firewall protections are in place, and audit exposure of ports 8530/8531. Delay could invite unwanted execution of attacker-controlled code, data exfiltration or network compromise. For cybersecurity teams already stretched, this is a sharp reminder: patch management remains one of the most critical, yet under-resourced parts of defence.

The post Microsoft Issues Emergency Patch for Critical WSUS Flaw appeared first on CyberHood Sentinel.

Key Takeaways: What Microsoft Recommends

Microsoft’s “Keep your computer secure at home” article outlines several foundational steps users should adopt:

• Keep all software up to date — Enable automatic updates in Windows Update for Windows itself, Microsoft Office, and other applications. Don’t forget non-Microsoft tools (e.g., browsers, Adobe Reader).
• Use antivirus protection and maintain currency — Windows includes built-in protection via Windows Security (which includes Microsoft Defender). For Microsoft 365 Personal/Family subscribers, this protection extends across Windows, macOS, Android, and iOS devices.
• Adopt strong password hygiene — Choose robust, unique passwords and safeguard them.
• Be cautious with emails, links, and attachments — Don’t open attachments or click links from untrusted sources, even if they appear to come from familiar names.
• Use a firewall — Windows has a firewall enabled by default to help block unauthorized access.
• Avoid pirated or illicit content — Downloading media or software from unverified sources is a common vector for malware.
• Treat external devices with caution — Use only trusted USB drives or external media; avoid plugging in unknown devices.

Beyond these steps, Microsoft also stresses broader measures:

• Protect personal information — Be selective about what you share online and who can access it.
• Guard against scams and phishing — Criminals commonly use deceptive messages (via email, social media, or ads) to steal credentials or financial data. Microsoft provides guidance to identify phishing and tech support scams.
• Detect and remove malware — Windows Security offers real-time protection, while Microsoft Defender Offline (built into Windows 10 and 11) can run outside the OS to find threats (e.g. rootkits) that evade normal detection.

Together, these recommendations form a practical “defense in depth” approach for home computers.

Background: Why This Guidance Matters Now

Home users today face ever-growing digital risks. With remote work, distance learning, and increased online activity, home networks often lack the robust protection typical of enterprise environments. Threat actors frequently exploit unpatched software, phishing attacks, and unauthorized external media to gain entry into personal systems.

Microsoft’s support page serves as a refresher and a public reference to reinforce that even built-in tools (like Windows Security) can provide substantial defense — provided users enable, update, and manage them correctly. By consolidating foundational security practices, Microsoft helps users reduce vulnerabilities without necessarily relying on third-party products.

Expert Insight & Considerations

While Microsoft’s guidance is broadly sound, cybersecurity experts often underscore a few nuances worth noting:

1. Layered defense is key — No single tool is foolproof. Even with antivirus and firewall in place, human behavior (falling for phishing, using weak passwords) remains a major vector. Experts stress combining technical tools with user education.
2. Use a password manager — Rather than trying to remember dozens of strong passwords, experts recommend password managers. This aligns with Microsoft’s advice to have well-chosen, protected passwords.
3. Enable multi-factor authentication (MFA) wherever possible — Though not always mentioned explicitly in home guidance, MFA adds a crucial extra barrier when account credentials are compromised.
4. Periodic audits and scans — Running deep scans manually and checking system logs or security dashboards helps catch anomalies that automated systems might miss.
5. Backups as last line of defense — While not the focus of Microsoft’s article, cybersecurity authorities consistently urge regular backups (offline or in secure cloud) so that, in a worst-case compromise (e.g. ransomware), you can restore without paying or losing data.

By combining Microsoft’s built-in tools with these expert practices, users can raise their security posture significantly.

Conclusion

Protecting your home computer begins with basic, consistent habits: keep software updated, use antivirus, employ strong passwords, avoid unknown attachments, and rely on built-in defenses like Windows Security and firewall. While Microsoft’s guidance provides a strong foundation, users should also layer in practices like multi-factor authentication, password managers, and backups — and stay alert for phishing attacks.

In the ever-evolving landscape of cyber threats, vigilance and consistency are your best allies.

The post How can you Protect Your Home Computer ? Essential Security Tips for Microsoft appeared first on CyberHood Sentinel.

Overview of the Zero-Day Vulnerabilities

The three zero-day vulnerabilities are identified as:

• CVE-2025-21333
• CVE-2025-21334
• CVE-2025-21335

These flaws are privilege escalation vulnerabilities within the Windows Hyper-V NT Kernel Integration VSP. Exploitation of these vulnerabilities could allow attackers to gain SYSTEM-level privileges, a critical security breach that could provide control over targeted systems.

While Microsoft has acknowledged active exploitation of these flaws, specific details regarding the threat actors and exploitation techniques remain undisclosed. This lack of information underscores the importance of immediate patch application to mitigate potential risks.

Other Vulnerabilities of Concern

In addition to the zero-days, the update also addresses five publicly known vulnerabilities:

1. CVE-2025-21186
2. CVE-2025-21366
3. CVE-2025-21395
4. CVE-2025-21275
5. CVE-2025-21308

Notably, CVE-2025-21308 is a Windows Themes Spoofing Vulnerability that serves as a bypass for a previously reported flaw, CVE-2024-38030. This bypass highlights the persistent challenge of patching interconnected vulnerabilities within complex systems.

Federal Directives and Broader Implications

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded swiftly, adding the Hyper-V zero-days to its Known Exploited Vulnerabilities catalog. Federal agencies are mandated to implement the necessary patches by February 4, 2025, emphasizing the critical nature of these vulnerabilities.

Organizations outside the federal sphere are equally advised to prioritize these updates. The exploitability of these zero-day vulnerabilities poses a significant risk not only to individual enterprises but also to the broader digital ecosystem.

Mitigation Steps

Microsoft users and administrators should take the following steps to safeguard their systems:

1. Immediate Patch Deployment: Apply the latest updates to all affected systems without delay.
2. Monitor Threat Intelligence: Stay updated on emerging information regarding the exploitation of these vulnerabilities.
3. Strengthen Privilege Management: Ensure robust access controls to mitigate the impact of potential privilege escalations.
4. Regular Security Assessments: Conduct vulnerability assessments to identify and remediate other potential security gaps.

Conclusion

The discovery and active exploitation of these zero-day vulnerabilities serve as a stark reminder of the evolving threat landscape. With attackers continually refining their techniques, organizations must remain vigilant, ensuring timely updates and adherence to best security practices. Microsoft’s January 2025 Patch Tuesday underscores the critical importance of proactive defense mechanisms in safeguarding digital infrastructures.

The post Three Actively Exploited Zero-Day Flaws Addressed in Microsoft’s January 2025 Security Update appeared first on CyberHood Sentinel.

Understanding the Vulnerability

System Integrity Protection, or SIP, is a cornerstone of macOS security, introduced to safeguard the system against unauthorized modifications. Often referred to as “rootless,” this feature restricts even the root user—traditionally the most powerful account on a Unix-based system—from making changes to critical system files and directories. SIP plays a pivotal role in maintaining the stability and security of macOS devices, making any potential bypass a matter of serious concern.

The flaw discovered by Microsoft’s Threat Intelligence team involves the Storage Kit daemon (storagekitd) in macOS. Exploiting this vulnerability, attackers with root privileges could manipulate the “com.apple.rootless.install.heritable” entitlement, enabling them to circumvent SIP protections. The attack vector leverages storagekitd’s capability to invoke arbitrary processes, allowing the introduction of new file system bundles to critical directories such as /Library/Filesystems. By overriding binaries associated with Disk Utility, malicious actors could bypass SIP entirely.

Jonathan Bar Or, a leading researcher from Microsoft’s team, emphasized the potential impact of such an exploit. “A successful attack could lead to the installation of rootkits, creation of persistent malware, and expansion of the attack surface for further exploits. It underscores the need for vigilant security practices,” he noted in a detailed blog post.

Previous SIP Bypass Vulnerabilities

This discovery marks the third major SIP bypass vulnerability reported by Microsoft in recent years. Previously identified flaws, such as CVE-2021-30892 (dubbed “Shrootless”) and CVE-2023-32369 (known as “Migraine”), similarly showcased the potential for attackers to exploit macOS’s protective mechanisms. Together, these vulnerabilities underscore a pattern of exploitation attempts targeting the SIP framework.

Potential Impacts of Exploiting CVE-2024-44243

The implications of this vulnerability are severe, particularly given the critical role SIP plays in macOS’s defense against malware and other threats. By bypassing SIP, attackers could:

1. Install Rootkits: With unrestricted access, attackers can introduce rootkits—malicious software designed to remain undetected while providing privileged access to the system.
2. Persistent Malware Installation: Exploiting this flaw could allow attackers to install malware that remains active even after system reboots or security updates.
3. Expand Attack Surfaces: SIP bypass opens the door for additional exploits, enabling attackers to escalate privileges further or gain access to sensitive user data.
4. Erode Trust in macOS Security: Beyond technical risks, such vulnerabilities could undermine user confidence in macOS as a secure platform.

Apple’s Response and Mitigation

Apple responded swiftly to Microsoft’s disclosure by releasing a patch in the macOS Sequoia 15.2 update. Users are strongly encouraged to update their devices immediately to mitigate potential risks. Regular system updates are a fundamental aspect of maintaining a secure computing environment, particularly as threat actors continuously evolve their techniques.

To ensure your macOS device is protected, follow these steps:

1. Check for Updates: Navigate to System Settings > Software Update and install the latest macOS version.
2. Enable Automatic Updates: Configure your system to automatically download and install security updates.
3. Review Security Settings: Ensure SIP is enabled. You can verify its status by running the csrutil status command in the Terminal.
4. Monitor for Anomalies: Regularly check for unexpected system behavior or unauthorized changes to critical files and directories.

The Role of Collaborative Security Research

The discovery of CVE-2024-44243 highlights the importance of collaborative efforts between technology companies to identify and mitigate vulnerabilities. Microsoft’s role in uncovering this flaw demonstrates the value of cross-platform security research and shared responsibility in safeguarding users.

“Security is a shared endeavor,” said Bar Or. “Our partnership with Apple reflects a commitment to protecting users and staying ahead of evolving threats. Transparency and collaboration are key to building resilient systems.”

The Broader Context: Security Challenges for macOS

While macOS is often perceived as a more secure platform compared to its counterparts, it is not immune to vulnerabilities. The increasing popularity of macOS devices has made them an attractive target for cybercriminals. Exploits like CVE-2024-44243 serve as a reminder that no system is invulnerable.

Recent years have seen a rise in macOS-specific threats, from adware and ransomware to sophisticated spyware targeting high-value users. Attackers are leveraging both social engineering tactics and technical vulnerabilities to bypass security measures. For macOS users, maintaining robust cybersecurity practices is more critical than ever.

Best Practices for macOS Security

To enhance your macOS security posture, consider the following recommendations:

1. Stay Updated: Install updates promptly to address newly discovered vulnerabilities.
2. Use Strong Passwords: Implement strong, unique passwords for system accounts.
3. Enable Two-Factor Authentication (2FA): Protect your Apple ID and other accounts with 2FA.
4. Limit Admin Privileges: Use a standard user account for daily activities and reserve administrative access for specific tasks.
5. Install Security Software: Utilize trusted antivirus and anti-malware tools to detect and prevent threats.
6. Exercise Caution with Downloads: Avoid downloading software from untrusted sources and verify app permissions.
7. Regularly Back Up Data: Maintain backups of your critical files using Time Machine or other reliable backup solutions.

Conclusion

The disclosure of CVE-2024-44243 serves as a stark reminder of the dynamic nature of cybersecurity threats. While Apple’s swift response in patching the vulnerability is commendable, users must remain vigilant and proactive in maintaining their security. Collaborative efforts between technology companies, combined with user awareness, are essential in mitigating risks and ensuring a safer digital ecosystem.

As macOS continues to gain popularity, it will undoubtedly remain a focal point for attackers. By staying informed and adopting best practices, users can play an active role in defending against emerging threats. Ultimately, security is not just a feature but a shared responsibility that requires constant vigilance and adaptability.

The post Microsoft Uncovers New macOS Vulnerability Allowing System Integrity Protection Bypass appeared first on CyberHood Sentinel.

In July 2024, a significant incident unfolded in the cybersecurity realm when a faulty update to CrowdStrike’s Falcon Sensor led to widespread crashes of Windows systems worldwide. The issue, which caused the notorious “Blue Screen of Death” (BSOD) on affected devices, disrupted operations across various sectors and underscored the critical importance of rigorous update testing and disaster recovery plans. This article explores the incident, its impact, the response from CrowdStrike, and the broader implications for the industry.

The Incident: What Happened?

Faulty Update Release

On July 19, 2024, CrowdStrike released a content update for its Falcon Sensor product, a widely used endpoint detection and response (EDR) tool. This update contained a defect that triggered BSODs on many Windows systems, rendering them unusable and causing significant operational disruptions.

Immediate Impact

The impact of the faulty update was felt across the globe. Businesses and individual users reported system crashes shortly after applying the update. Key sectors, including airlines, financial institutions, retail chains, and hospitals, experienced severe disruptions in their operations. Cloud service providers such as Google Cloud, Microsoft Azure, and Amazon Web Services (AWS) also reported significant issues with their Windows virtual machines, exacerbating the situation.

CrowdStrike’s Response and Mitigation Efforts

Identifying the Problem

CrowdStrike swiftly identified the update as the root cause of the system crashes. The company responded by issuing a fix and providing detailed mitigation instructions to help affected users restore their systems:

1. Boot into Safe Mode or Windows Recovery Environment: This step helps in avoiding the BSOD during the recovery process.
2. Navigate to the CrowdStrike Directory: Users were instructed to go to C:\Windows\System32\drivers\CrowdStrike.
3. Delete the Problematic File: Deleting the file named “C-00000291*.sys” from the directory.
4. Restart the System: Users were then advised to restart their computers or servers normally.

Communication

George Kurtz, CEO of CrowdStrike, emphasized that this incident was a defect in the update process and not a security breach. The company actively communicated with its customers, urging them to follow the provided mitigation steps and stay informed through the support portal for ongoing updates.

Broader Implications and Industry Reactions

The CrowdStrike update incident not only caused immediate operational challenges but also raised broader concerns about software update management and cybersecurity practices.

Cloud Service Providers’ Actions

• Google Cloud: Reported that Windows VMs affected by the faulty patch crashed and could not reboot. Google advised customers with running VMs that these should now be stable and provided additional support for those still facing issues.
• Microsoft Azure: Indicated that some customers reported recovery after multiple restart attempts, with up to 15 reboots potentially needed for a full recovery.
• AWS: Implemented mitigation steps and provided guidance to customers for restoring connectivity and stability.

Expert Insights

Security professionals underscored the significance of this incident as a reminder of the potential risks associated with software updates, especially those involving high-privilege security products. Kevin Beaumont, a prominent security researcher, highlighted the severe impact of the defective driver causing consistent Windows crashes.

Jake Moore, global security advisor at ESET, emphasized the necessity of having multiple fail-safes and diverse IT infrastructure to avoid widespread disruption. He pointed out that relying on a single technology provider or product can lead to significant vulnerabilities.

Omkhar Arasaratnam from OpenSSF stressed the importance of technological diversity within supply chains. He advocated for gradual rollouts of updates to monitor and manage impacts in smaller, controlled batches, thereby reducing the risk of widespread failures.

Lessons Learned and Future Precautions

The CrowdStrike update debacle provides several key lessons for businesses and cybersecurity professionals:

Importance of Rigorous Testing

Before deploying updates, especially those affecting critical security systems, extensive testing in varied environments is crucial. Simulating potential issues and running comprehensive quality assurance checks can help identify defects that might cause operational disruptions.

Fail-Safe Mechanisms

Organizations should implement robust fail-safe mechanisms to quickly revert to a stable state in case of an update failure. This includes maintaining backups, having recovery procedures in place, and ensuring that there are alternate systems to fall back on during such incidents.

Diversifying IT Infrastructure

To mitigate the risk of widespread impact from a single point of failure, businesses should diversify their IT infrastructure. Using a mix of different security products and services can provide resilience against failures in one specific system or provider.

Gradual Rollouts

Gradually rolling out updates, starting with a small segment of users or systems, allows organizations to monitor and address any issues before they affect the entire user base. This approach reduces the risk of widespread disruptions and allows for more controlled management of potential problems.

Conclusion

The faulty CrowdStrike update incident serves as a critical reminder of the complexities and risks inherent in managing cybersecurity products. While the immediate focus was on mitigating the damage and restoring system functionality, the broader implications highlight the need for rigorous testing, robust fail-safes, and diversified IT infrastructure.

Moving forward, both cybersecurity firms and their clients must prioritize these best practices to enhance resilience against similar incidents. By staying vigilant and proactive, organizations can better protect themselves against the cascading effects of faulty software updates.

The post Faulty CrowdStrike Global Windows System Crashes: A Comprehensive Analysis appeared first on CyberHood Sentinel.

Gilles Lionel a French Researcher discovered that PrtitPotam is a new method that can be used to conduct and NTLM relay attack. The POC was displayed along with the script used to perform the attack.

The new attack uses the Microsoft Encrypting File System Remote Protocol (EFSRPC) to force a device, including domain controllers, to authenticate to a remote NTLM relay controlled by a threat actor.

Once a device authenticates to a malicious NTLM server, a threat actor can steal hash and certificates that can be used to assume the identity of the device and its privileges.

Mitigation for Domain Controllers

Microsoft published a security advisory with recommendations for organizations that needs to protect its assets against this attack.

The attackers are targeting the NTLM authentication enabled on the domain and are using Active Directory Certificate Services (AD CS) with Certificate Authority Web Enrollment or Certificate Enrollment Web Service.

Microsoft recommends disabling NTLM where it is not necessary, e.g. Domain Controllers, or to enable the Extended Protection for Authentication mechanism to protect credentials on Windows machines.

The company also recommends on networks with NTLM enabled that services allowing NTLM authentication to use signing features such as SMB signing that’s been available since Windows 98.

PetitPotam is about abusing the EfsRpcOpenFileRaw function of the MS-EFSRPC API to pass on authentication requests, leaving the door open for other attacks.

Microsoft’s advisory is clear about the action to prevent NTLM relay attacks but does not address the abuse of the MS-EFSRPC API, which would need a security update to fix.

It is noted by the various security researchers that EFSRPC protocol is not even mentioned in the Microsoft advisory.

The post Mitigations for new PetitPotam NTLM relay attack appeared first on CyberHood Sentinel.