Archive

General * Windows Autopatch, which reached General Availability (GA) in July 2022, is moving to on-by-default. Autopatch is designed to patch a running system, without requiring a reboot. It's an Enterprise-only (E3, E5, E7, et cetera licence) feature. * https://www.bleepingcomputer.com/news/microsoft/microsoft-to-enable-hotpatch-security-updates-by-default-in-may/ * Microsoft Entra now supports

General * New from Brian Krebs - "How AI Assistants are Moving the Security Goalposts". It's a little different to normal Krebs posts, looking more at the ecosystem. AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can

General * Timely advice from (Google) Mandiant - "Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition". Very likely released due to the war in the Middle East. There's a lot covered in the document, and it gets all the way down into the details. * https://cloud.

General * Wikipedia suffers their own brief Samy Worm incident. The Wikimedia Foundation suffered a security incident today after a self-propagating JavaScript worm began vandalizing pages and modifying user scripts across multiple wikis. ... BleepingComputer's review of the archived test.js script shows it self-propagates by injecting malicious JavaScript loaders

General * Multi-Factor Authentication Phishing service - 'Tycoon 2FA' - was disrupted in a Europol-coordinated activity. The service used a proxy-style approach (as popularised by elivginx), to capture session cookies after users had passed through all single- and multi-factor challenges. Passkeys are not vulnerable to this attack, as the

General * Android users, it's patch time. Eleven 'Critical' bugs, including a Qualcomm display bug that Google have flagged "Note: There are indications that CVE-2026-21385 may be under limited, targeted exploitation." * https://source.android.com/docs/security/bulletin/2026/2026-03-01 * https://docs.qualcomm.com/securitybulletin/

General * The FBI is on the media path for its "Operation Winter Shield: Ten Actions to Improve Cyber Resilience". As pointed out by Cyber Scoop, this fits much more into the Cybersecurity and Infrastructure Security Agency (CISA)'s mandate. Recommendations: - Adopt phish-resistant authentication - Implement a

General * Brian Krebs is continuing his investigation into the Kimwolf botnet, this time looking at one of the administrators - "Dort". Lesson #1 - attacking Brian Krebs rarely ends well for the attacker. In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was

General * Juniper doesn't want to be left behind, after Cisco's CVSS10 vulnerability, they've got a CVSS (v3) 9.8 bug in their PTX routers. It's in a service enabled by default, and leads to remote code execution (RCE) as root. The On-Box

General * ACSC is warning of a CVSS10 vulnerability in Cisco Catalyst Software Defined Wide Area Network (SD-WAN) Controller and Manager. Cisco's advisory indicates that this attack has been underway for "at least three years (2023)". Malicious cyber threat actors are targeting SD-WANs of organisations, globally. These