privilegeescalation

Microsoft’s security portal lists CVE-2025-55228 as a Windows Graphics Component issue in the Win32K — GRFX code path that can be abused by an authenticated local actor through a concurrency/race condition; the flaw is described as allowing execution of attacker-supplied code in kernel context...

Microsoft has published an advisory for CVE-2025-54110, a Windows Kernel vulnerability caused by an integer overflow or wraparound that can be triggered by a locally authorized attacker to achieve elevation of privilege to SYSTEM on affected machines; administrators should treat this as a...

A compact but sophisticated campaign tracked as GhostRedirector has infected at least 65 Internet‑facing Windows IIS servers and paired a stealthy native backdoor with an in‑process IIS module to run a covert, profitable SEO fraud operation that pushes third‑party gambling sites while leaving...

ESET’s researchers have uncovered a previously undocumented threat cluster that covertly poisons legitimate IIS-hosted websites to manipulate Google rankings while also planting a stealthy C++ backdoor on Windows servers — a campaign ESET calls GhostRedirector that, according to an internet-wide...

ESET researchers have uncovered a compact but sophisticated campaign — tracked as GhostRedirector — that has compromised at least 65 Internet‑facing Windows servers and combined a native C++ backdoor with a malicious IIS native module to deliver long‑lived persistence and server‑side SEO fraud...

ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...

Title: What sysadmins need to know about the WinSock AFD race-condition EoP entry you sent (CVE-2025-53134) — situation, risk, and what to do now Executive summary You sent the MSRC URL for CVE-2025-53134 (Windows Ancillary Function Driver for WinSock — race condition / improper synchronization...

Note — quick verification before I start I checked public vulnerability databases and Microsoft’s Security Update Guide but could not find any record for the exact identifier CVE‑2025‑53133. Microsoft and NVD list several recent PrintWorkflowUserSvc issues (for example CVE‑2024‑49095 and a pair...

Microsoft has confirmed CVE-2025-53132 — a race‑condition elevation‑of‑privilege vulnerability in the Windows Win32k – GRFX component — and administrators must treat affected hosts as high‑priority patch targets while applying layered mitigations to reduce immediate risk. Background Windows’...

When the doors opened on the first day of Pwn2Own Berlin 2025, few could have predicted just how quickly and decisively some of the world’s most widely used enterprise operating systems would fall to the creative might of leading security researchers. Within hours, Windows 11 and Red Hat...

The Mysterious “inetpub” Folder: An Unexpected Windows 11 Quirk Windows 11 users have recently encountered an unexpected twist following the cumulative update KB5055523—a seemingly innocuous yet puzzling folder named “inetpub” appearing on the C drive. This odd discovery, highlighted by multiple...

Revision Note: V1.0 (January 10, 2017): Advisory published. Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in the public version of Identity Model Extensions 5.1.0. This advisory also provides guidance on what developers can do to help ensure...