All news with #security misconfiguration tag

🔒 In July 2025 an expired CDN domain was re-registered and began serving content to thousands of sites that still referenced its hostnames. The new owner controls wildcard DNS and can choose what those pages load, creating a supply-chain risk that server-side tooling often misses. Content Security Policy (CSP) in report-only mode provides a low-risk way to discover and monitor what third-party scripts actually execute. Compliance mandates such as PCI DSS v4.0.1 now require inventorying and alerting on scripts that run on payment pages, and services like Report URI can collect, archive, and alert on client-side script activity without adding site-side code.

🔒 Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust on some enterprise systems, preventing valid domain logins. Administrators report that affected devices lose their secure channel with Active Directory after reboot and observed Kerberos and NTLM failures. The issue may be linked to the Machine Identity Isolation setting, especially when set to enforcement mode, and some have restored access by adjusting registry values and repairing the secure channel.

🛠️ Microsoft confirmed that the September 2026 KB5002914 security update can cause copy-and-paste, autofill, and formula dragging to silently fail in Excel. Affected versions include Microsoft Excel 2016, 2019, 2021, and 2024, and users receive no error when the paste operation does not complete. Microsoft is investigating and will update its support document; some users report uninstalling KB5002914 restores functionality. The article also notes related recent Office and Windows fixes and emergency out-of-band updates.

🔧 Microsoft released out-of-band Windows updates on September 14 to address Remote Desktop Services (RDS) failures and related component crashes introduced by the September security updates. The fixes include updates for Windows 11 (KB5129194, KB5129195), Windows 10 (KB5129236), and Windows Server (KB5129235, KB5129237), and are available via Windows Update, WSUS, and the Microsoft Update Catalog. The Windows 11 updates also resolve a Hyper-V Plan9 share issue and some USB Audio Class 1.0 multichannel problems, though Microsoft is still working on remaining audio bugs.

🔔 Microsoft confirmed that its September 2026 security updates are causing Remote Desktop Services (RDS) failures on Windows Server and client systems. The issue affects Windows Server 2012 and later, as well as Windows 10 and Windows 11, producing RDP connection drops, sign-in problems, and unresponsive management tools. Microsoft published Group Policy mitigations for enterprise environments and noted temporary recovery by restarting affected VMs or uninstalling the updates, though removal also drops security fixes. The company is working on a permanent fix.

🔊 Microsoft confirmed that installing the KB5124008 and KB5124012 September 2026 security updates can cause some USB Audio Class 1.0 devices to fail on Windows 11 version 24H2 or later. Affected users report "This device cannot start (Code 10)" errors, no audio output, and unresponsive volume controls; some speakers fail only with multichannel or 3D audio. Microsoft has not provided an official workaround, though switching to 2-channel mode has restored audio for some users.

🔒 Surfshark disclosed that a misconfigured internal test server was reachable from the internet and accessed by unauthorized parties, exposing service configurations, portions of binaries, and build-related credentials. The company said production VPN infrastructure and customer data were not impacted, and the compromised machine acted as a proxy without access to user identities, IPs, encryption keys, or browsing traffic. Surfshark detected the activity on August 31, contained it by September 2, rotated affected credentials, revoked exposed tokens, and implemented additional monitoring and hardening.

🔍 AWS Systems Manager now diagnoses six additional root causes preventing Amazon EC2 instances and hybrid-activated nodes from becoming managed. The expanded checks include IAM permissions, SSM Agent version, instance status checks, operating system configuration, Default Host Management Configuration, and hybrid activation, in addition to prior network connectivity diagnostics. The console reports specific issues with step-by-step guidance and can run Automation runbooks to remediate some problems directly.

🔒 N‑able released Hotfix 4 (build 2026.3.1.14) for its N‑central RMM to fix CVE-2026-86218, a pre-auth remote code execution vulnerability affecting all on‑premises builds prior to 2026.3.1.14. The company says hosted instances are patched and urges on‑premises customers to upgrade immediately; agents do not require updates. Communications diverge on whether the flaw has been observed exploited in the wild, and no indicators of compromise or interim mitigations were provided.

🔧 Amazon EC2 now allows AMI owners to declare which instance types are compatible or incompatible with their AMIs. Owners can specify supported, unsupported, or both lists, and any launch on a non-permitted type is blocked automatically. By default AMIs remain launchable on any instance type, so existing workflows are unchanged until restrictions are applied. The feature is available in all AWS Regions at no extra cost.

🐭 Microsoft confirmed that a bug introduced by the KB5120998 August 27, 2026 preview update reverts mouse personalization settings on some Windows 11 devices. The issue was found to affect only non‑English installations, where necessary code components fail to load and default cursor settings are applied. KB5120998 is an optional preview update that can install automatically if users opted to receive updates as soon as available. Microsoft has acknowledged related mouse and desktop settings issues and continues to investigate and address them.

🛠️ Microsoft confirmed that installing the KB5120998 August 27, 2026 preview update can cause desktop settings to fail to load on some Windows 11 devices. Affected systems running Windows 11 24H2 and 25H2 may see wallpapers revert to a solid black background and experience lost themes, slideshow, or contrast settings. The issue also prevents users from restoring their custom settings, and a related mouse settings regression was acknowledged. KB5120998 is an optional, non-security preview update that may install automatically if users enabled immediate update delivery.

🛡️ Microsoft acknowledged a bug causing Windows to display “Microsoft Defender Antivirus is turned off” notifications even though the product is functioning correctly. The vendor says it will issue a fix in a future Defender update and listed affected Windows client and server versions spanning recent and legacy releases. Security experts warn the advisory may train users and SOCs to ignore critical alerts, enabling attacker tradecraft and increasing risk.

🐭 Microsoft confirmed that the KB5120998 August 2026 non-security preview update can change or reset mouse cursor personalization on affected Windows 11 systems. Reports indicate high‑DPI cursors may be replaced with larger white cursors and custom animations revert to defaults, with users unable to restore previous settings. Microsoft is investigating and asks affected customers to report the issue via the Feedback Hub.

🛡️ Microsoft has asked customers to ignore false notifications indicating "Microsoft Defender Antivirus is turned off" after recent Defender updates. The issue, affecting all supported Windows client and server versions including Windows 11 26H1 and Windows Server 2025, causes alerts to appear in the Windows Security app despite the antivirus functioning normally. Microsoft confirmed it is investigating and plans to roll out a fix in a future Defender update.

🔒 A recent cyber incident that took a small UK electricity generator offline for days — without causing national outages — highlights a weakness across Western critical infrastructure: thousands of small, internet-exposed industrial control devices lack the security protections of larger utilities. Governments and security firms are investigating attribution and impacts while urging operators to remove PLCs from direct internet access, secure cellular modems, and test manual-operation procedures. The episodes mirror attacks on US water systems and underscore how modest targets can create disproportionate disruption.

🛡️ Oasis Security disclosed a flaw in NVIDIA NemoClaw that can allow an attacker-controlled webpage to take unauthenticated control of a local Ollama instance and implant hidden instructions inside a model's chat template. The issue stems from NemoClaw setting OLLAMA_HOST to 0.0.0.0 on some Windows/WSL paths, exposing an unauthenticated API on port 11434 that skips Host/Origin checks and can be exploited via DNS rebinding. No CVE or patch is yet linked and no exploitation was reported as of August 25, 2026.

🎮 Microsoft provided a temporary workaround for a gaming crash issue introduced with the August 11, 2026 Windows 11 updates (KB5121003). The bug caused crashes, freezes, EXCEPTION_ACCESS_VIOLATION errors, and restarts when launching certain games on 24H2 and 25H2 systems. Investigation linked the problem to RGB device drivers/components, specifically files like inpoutx64.sys. Microsoft’s interim fix disables the driver via a Registry change, with warnings to back up and potential loss of RGB functionality.

🎮 Microsoft is investigating reports that August 2026 updates may prevent some games from launching or cause crashes on affected Windows 11 systems. Affected users report freezes, unexpected closures, EXCEPTION_ACCESS_VIOLATION errors, and random restarts after installing KB5121003. The company confirmed it is probing the issue and asked impacted gamers to submit Feedback Hub reports while it works to determine if Microsoft is the cause.

🔒 This article explains where the threat to IP cameras comes from and outlines five practical rules to reduce the risk of becoming a target. It describes real-world incidents — mass hacks, livestreamed footage sales, and stalker cases — and highlights common failures such as unchanged factory passwords, insecure cloud implementations, and lack of firmware updates. The guidance covers device selection, local storage, network segmentation, and good security hygiene to lower exposure.