Microsoft has just released an emergency out-of-band (OOB) update

-




 Microsoft has just released an emergency out-of-band (OOB) update for Windows 11 to fix critical issues introduced in the October 2025 Patch Tuesday update (KB5066835). Here's what you need to know:

 What Went Wrong

• Broken Localhost Connections: The update disrupted HTTP/2 connections to , affecting developers and apps relying on local servers like IIS and ASP.NET.

• WinRE Failure: USB keyboards and mice stopped working in the Windows Recovery Environment (WinRE), leaving users unable to troubleshoot or recover their systems.

• Peripheral Issues: Logitech devices and File Explorer previews were also affected.

 Emergency Fix: KB5070773

Microsoft has issued KB5070773 to resolve these problems:

• Restores USB functionality in WinRE for Windows 11 versions 24H2 and 25H2.

• Fixes the localhost regression caused by HTTP.sys mishandling HTTP/2 handshakes.

 How to Get the Update

• Automatic Installation: The update is rolling out via Windows Update and will install automatically for most users.

• Manual Option: If it doesn’t appear, you can download it from the Microsoft Update Catalog.

 Additional Server Patch

Microsoft also released emergency patches (KB5070881, KB5070879, KB5070884) for Windows Server to address a remote code execution vulnerability (CVE-2025-59287) in WSUS.


Popular posts from this blog

WSUS CVE-2025-59287 Mitigation

-
Image
CVE-2025-59287 is a critical Remote Code Execution (RCE) vulnerability affecting Windows Server Update Services (WSUS) . Here's a detailed breakdown of what it is, how it works, and what you should do about it: Overview Disclosed: October 2025 Patch Tuesday CVSS Score: 9.8 (Critical) Affected Systems: Windows Server 2012 through 2025 (including Server Core installations) Exploitability: Microsoft rates it as “Exploitation More Likely” Technical Details The vulnerability arises from unsafe deserialization of untrusted data in WSUS. Specifically, the GetCookie() endpoint in WSUS processes encrypted AuthorizationCookie objects without proper type validation. The deserialization occurs via .NET BinaryFormatter , which is known to be insecure when handling untrusted input. Attackers can send a crafted SOAP request to WSUS over port 8530 , containing a malicious AuthorizationCookie . The cookie is decrypted using a hardcoded AES key and then deserialized, allow...
Read more

Microsoft Defender for Endpoint (DFE) and Mitigation for It

-
Image
  The recent vulnerability affecting Microsoft Defender for Endpoint (DFE) involves critical flaws in how the agent communicates with its cloud backend, potentially allowing attackers to bypass authentication and manipulate incident response processes. Key Vulnerabilities in Defender for Endpoint (DFE) Authentication Bypass : Attackers can impersonate the Defender agent using only the machine ID and tenant ID, which are accessible to low-privileged users via registry reads. This allows them to spoof commands and responses. Command Interception : By querying endpoints like /edr/commands/cnc , attackers can intercept or fake responses (e.g., falsely reporting a device as isolated), undermining actual security status. Certificate Pinning Circumvention : Researchers bypassed HTTPS protections by patching memory functions (e.g., CRYPT32!CertVerifyCertificateChainPolicy ) to inspect traffic in plaintext using tools like Burp Suite and WinDbg. Azure Blob Upload Exploits : Attackers c...
Read more

Oracle has disclosed a critical vulnerability (CVE-2025-61882) (Patch Notes)

-
Image
  Oracle has disclosed a critical vulnerability (CVE-2025-61882) affecting E-Business Suite versions 12.2.3 through 12.2.14. This pre-authentication remote code execution (RCE) flaw enables unauthenticated attackers to exploit multiple chained weaknesses — including SSRF, CRLF injection, authentication bypass, and unsafe XSLT processing — to gain full control of affected systems. Risk Assessment: Severity: Critical (CVSS 9.8) Exposure: Internet-facing Oracle EBS instances are at immediate risk Threat Activity: Active exploitation confirmed by threat intelligence sources, including Cl0p ransomware group Business Impact: Potential compromise of financial systems, data exfiltration, and operational disruption Recommended Actions: Immediate Patch Deployment: Apply Oracle’s July 2025 Critical Patch Update to all affected EBS environments. Network Segmentation: Restrict public access to Oracle EBS systems. Ensure they are isolated from internet-facing zones. Threat Monito...
Read more