Windows Zero Day - GoKawiil

Researcher publishes unpatched Windows privilege-escalation zero-day called SignDrop

A researcher using the pseudonym Nightmare Eclipse publicly disclosed a new Windows zero-day vulnerability dubbed SignDrop. The flaw lets a standard local user gain full System-level privileges by tricking Windows Defender into creating a privileged file through the Common Log File System, exploiting symbolic link manipulation and inherited file permissions.

arstechnica.com · 2026-11-13

Microsoft ships record 974 security fixes in September Patch Tuesday

Microsoft released patches for 974 vulnerabilities across Windows and other products, its largest single update batch ever, surpassing July's record of 570 fixes. The release includes two actively exploited zero-day flaws that let attackers escalate privileges, plus 113 critical-rated bugs including a dangerous DNS weakness and a Windows Shell remote code execution flaw scoring 9.8 out of 10 in severity.

krebsonsecurity.com · 2026-09-08