Security researcher Abdelhamid Naceri has published a zero-day called SignDrop that abuses a Microsoft mitigation introduced in October 2025 to protect against Common Log File System authentication attacks. Naceri says the flaw lies in how CLFS handles creation of its '.cnpf' authentication file, which can be forced open by a privileged process such as Windows Defender, allowing attackers to gain SYSTEM privileges. He also says the technique can bypass tamper-protection defenses in any antimalware engine because the file-creation request appears to originate from the engine's own trusted process.
bleepingcomputer.com
· 2026-11-12
Microsoft has expanded Microsoft Defender, its anti-malware and endpoint security product, to support major Linux distributions for enterprise use. The Linux version includes a next-generation antivirus engine, vulnerability management, device inventory, and threat-hunting tools, mirroring capabilities already available on Windows.
techspot.com
· 2026-10-16
Security researcher Abdelhamid Naceri published a new proof-of-concept exploit called BigDiskBuster that, when run in the background, prevents Microsoft Defender from installing platform or signature updates on any supported Windows version. Naceri describes it as similar to his earlier UnDefend exploit, and says the code is still buggy but demonstrates the concept clearly. This is the latest in a string of nearly a dozen Defender and Windows-related exploits he has released since April 2026 amid an ongoing dispute with Microsoft over his termination.
bleepingcomputer.com
· 2026-09-22
Security researcher Nightmare-Eclipse has published a new proof-of-concept exploit called ShieldCrash on GitHub, claiming it circumvents Microsoft's fix for CVE-2026-69414 (ShieldBreak), a privilege escalation bug in the Malware Protection Engine. The exploit reportedly allows arbitrary file reads as SYSTEM on all supported Windows versions, despite Microsoft's September patch. Microsoft has not yet responded to requests for comment on the claim.
darkreading.com
· 2026-09-10
GoKawiil