4 articles
A researcher released SignDrop, a public exploit that claims a standard Windows user can escalate to SYSTEM through the CLFS driver. Microsoft has not confirmed the flaw, assigned a CVE or shipped a fix.
Attackers began exploiting a new N-able N-central zero-day, 4EverAble2Shell, hours after a public exploit appeared, compromising at least 21 servers, 19 of them on the latest security update.
November Patch Tuesday fixes an exploited Outlook zero-day: a crafted message file silently connects to an attacker's server and leaks the user's NTLMv2 hash.
Chrome 157.0.8103.50 fixes an exploited use-after-free flaw in an XML component, now listed in CISA KEV. Edge, Opera and other Chromium browsers are at risk.
