Topic
Windows
Microsoft Addresses 973 Vulnerabilities in September Security Update
Vulnerabilities & Exploits
Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery
AI Security
Corporate Wi-Fi Passwords Stored in Plain Text on Every Connected Device
Policy & RegulationWindscribe Releases Open-Source PowerShell Script to Remove Microsoft's Persistent Global Device Identifier from Windows
Windscribe has published an open-source PowerShell script called deGDID that removes Microsoft's Global Device Identifier (GDID) from Windows systems and prevents the creation of new identifiers. The persistent tracker survives IP address changes and operates below the VPN layer, allowing Microsoft to maintain device tracking even when users employ privacy tools. The script was developed after the FBI used GDID to identify a suspected hacker, raising concerns about undisclosed device fingerprinting. deGDID modifies registry access control lists and blocks the DeviceAdd interface to stop Windows from regenerating the identifiers after reboots or server contacts. While effective at disabling the tracking mechanism, the tool can break authentication to login.live.com and disrupt certain Microsoft cloud services. It is intended only for unmanaged consumer devices and will not run on domain-joined or corporate-managed systems. The project is described as experimental and cannot delete identifiers already transmitted to Microsoft servers.
Zero-Day Vulnerability CVE-2026-15682 in AnyDesk Enables Denial-of-Service Attacks on Affected Systems
A newly disclosed zero-day vulnerability in AnyDesk, tracked as CVE-2026-15682, allows attackers to trigger denial-of-service conditions on systems running the popular remote access tool. The flaw centers on a support information transmission feature that can be abused through Windows file system redirection mechanisms. An attacker with limited local access can manipulate these redirections to crash either the AnyDesk application or the underlying operating system. Because AnyDesk is widely deployed by support teams, managed service providers, and internal IT departments, the vulnerability poses a significant risk to remote assistance workflows and incident response operations. Until an official patch is released, organizations are advised to restrict code execution privileges, monitor for anomalous file system redirection activity, and apply updates as soon as they become available.
69% of Browsers Worldwide Vulnerable: How Chrome Sync Enables Stealth Surveillance Without Malware
Google Chrome's standard synchronization feature can be silently abused to turn any browser into a surveillance tool, requiring only brief physical access to a victim's device and the addition of an attacker's Google account. Security researchers at Certo highlighted the technique after multiple cases involving intimate partner surveillance, including one incident where a woman’s visits to a family lawyer and domestic abuse support sites were monitored in real time by her partner. Once sync is enabled, browsing history, bookmarks, open tabs, autofill data, and saved passwords are automatically transmitted to the attacker’s profile, which can be viewed from any device worldwide without needing the victim’s password or installing spyware. Chrome provides no prominent warnings about new profiles or active synchronization, and alerts about logins are sent only to the account owner rather than the device owner. With Chrome holding a 69.65% global market share according to StatCounter data from June 2026, the method potentially affects millions of users on Android, iOS, Windows, and macOS. Experts recommend regularly checking connected profiles in browser settings, using Incognito mode for sensitive activity, securing devices with strong passcodes and biometrics, and immediately removing unknown accounts while changing important passwords.
Secure Boot Bypassed for Over a Decade Through Unrevoked Vulnerable Shim Bootloaders, ESET Finds
ESET researchers have disclosed that Secure Boot, the UEFI mechanism designed to block malicious code before Windows or Linux starts, could be bypassed for more than ten years using old but still-trusted shim bootloader images signed by Microsoft. The 11 vulnerable shims, some dating back to 2013, were never added to revocation lists despite known vulnerabilities, allowing attackers to load unsigned or malicious code early in the boot process. The flaw affected both Linux distributions and Windows systems because UEFI firmware does not tie a Microsoft-signed shim to a specific operating system. After Microsoft finally revoked the images in its June updates following ESET’s disclosure, users were advised to check firmware policies and Linux Vendor Firmware Service for proper propagation of the new revocation data. The incident highlights systemic weaknesses in managing thousands of signed boot components and the central trust role played by Microsoft in the UEFI ecosystem.
Microsoft Patches Record 570 Windows Vulnerabilities in July Update, Including Three Actively Exploited Zero-Days
Microsoft released its largest Patch Tuesday update to date, addressing 570 vulnerabilities across Windows and related products. Among them are three zero-day flaws, two of which have already been exploited in real-world attacks. Fifty-nine issues were rated critical, with 48 enabling remote code execution. The company credited its use of AI for discovering more vulnerabilities in the Windows codebase. The update covers a wide range of components including .NET, Active Directory services, Microsoft Office, Azure services, and Microsoft Defender. Administrators are urged to apply the patches promptly to mitigate risks from privilege escalation, remote code execution, and information disclosure flaws.
WinFsp Vulnerability CVE-2026-3006 Allows Local Attackers to Escalate Privileges to SYSTEM via Race Condition in Kernel Driver
A critical vulnerability has been discovered in WinFsp, the open-source platform used to implement virtual disks, network file shares, and custom file systems on Windows. The flaw, tracked as CVE-2026-3006 with a CVSS 3.1 score of 7.0, affects version 2.1.25156 and all earlier releases, enabling a local attacker to trigger a race condition that leads to a memory overflow inside the kernel-mode driver. Successful exploitation grants full SYSTEM-level privileges, allowing modification of protected files, installation of services and drivers, disabling of security mechanisms, and creation of new accounts. The issue cannot be exploited remotely and requires the attacker to already have the ability to execute code on the target system, either through a compromised account or by running malicious software. WinFsp components are frequently bundled inside third-party virtualization and storage applications, significantly expanding the potential attack surface. Developers have released a fix in WinFsp 2.2B1, while Singapore’s Cyber Security Agency recommends immediate updates, restriction of local administrative rights, and monitoring for unexpected driver or service changes.
Windows Tracks Users Through Persistent GDID Identifier: How to Minimize Your Digital Footprint
A recent case involving a 19-year-old hacker identified through his Windows installation has highlighted how Microsoft’s GDID creates a permanent device fingerprint that survives VPNs and IP changes. GDID serves as a constant identifier across licensing, Microsoft Store, telemetry, and other services, making it difficult for users to stay anonymous even when changing networks. While there is no single button to disable this functionality completely, several practical steps can significantly reduce the amount of data Windows sends to Microsoft. These include switching to a local account instead of a Microsoft Account, disabling activity history, limiting optional diagnostic data, and turning off unused background services such as Phone Link and cloud synchronization. Experts note that simply reinstalling Windows does not erase the link if the same Microsoft Account is used afterward. The story underscores the ongoing trade-off between privacy and convenience in the Windows ecosystem.