security patch

Microsoft has confirmed a Windows BitLocker security feature bypass tracked as CVE-2025-55332, and the advisory — backed by third‑party aggregators — describes an issue that allows an attacker with physical access to influence BitLocker’s boot or recovery decision logic and bypass protections...

Windows administrators and identity teams should treat a newly disclosed Active Directory Federation Services (AD FS) vulnerability — tracked as CVE‑2025‑59258 — as a high‑priority operational item: Microsoft’s advisory describes an insertion of sensitive information into AD FS log files that...

Microsoft has published an advisory for CVE-2025-53717, a high‑impact elevation‑of‑privilege vulnerability in Windows Virtualization‑Based Security (VBS) Enclave that Microsoft characterizes as “reliance on untrusted inputs in a security decision.” The vendor‑published metrics list a CVSS v3.1...

Google released an emergency Chrome stable update that fixes a use‑after‑free (UAF) vulnerability in the WebRTC component tracked as CVE‑2025‑10501, and Microsoft Edge (Chromium‑based) customers should treat the issue as relevant until Microsoft ships the Chromium ingestion for Edge. Background...

Windows 10 will stop receiving free security fixes on October 14, 2025 — and if your PC can’t take the free Windows 11 upgrade, you have five realistic paths forward: enroll in Extended Security Updates (ESU), buy or rent a new Windows 11 PC (including cloud PCs), perform an unsupported upgrade...

Short answer up front — I can write the 2,000+ word WindowsForum.com feature you asked for, but I need one quick clarification before I start: I can't find any public record for CVE‑2025‑59220. Public trackers and vendor records instead show multiple Windows “Bluetooth Service”...

Executive Summary Microsoft has released a security update addressing a new heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS), tracked as CVE-2025-54113. The flaw could allow remote code execution (RCE) if exploited, and administrators are strongly urged to patch...

A newly disclosed race‑condition vulnerability in the Windows Capability Access Management Service (camsvc) can be abused by a local attacker to escalate privileges to SYSTEM on unpatched hosts, and organizations should treat the advisory as a high‑priority patching event for affected Windows...

Microsoft’s advisory identifies CVE-2025-53803 as a Windows Kernel memory information disclosure vulnerability: an error message generated by kernel code can contain sensitive kernel memory contents, allowing an authenticated local actor to read data that should remain protected. Background The...

A newly disclosed Microsoft Excel vulnerability tracked as CVE-2025-54902 is an out‑of‑bounds read flaw in Excel’s file‑parsing logic that Microsoft warns could allow an attacker to achieve code execution on a targeted machine when a user opens a specially crafted spreadsheet, and organizations...

A newly disclosed vulnerability affecting Windows' Routing and Remote Access Service (RRAS) can allow remote attackers to execute code against unpatched RRAS hosts — administrators must treat any RRAS-enabled servers exposed to untrusted networks as high-priority for patching, isolation, and...

Microsoft’s advisory identifies a vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that can be triggered locally to escalate privileges — described on the vendor page as a buffer overflow in the WinSock ancillary driver — and administrators must treat this as a...

Microsoft has confirmed CVE-2025-53798 — an information-disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS) — and released a vendor update; administrators who run RRAS must treat exposed RRAS endpoints as high-priority to remediate or isolate until patches are...

A recently republished U.S. federal advisory warns that Rockwell Automation’s FactoryTalk Activation Manager contains a cryptographic implementation flaw that can be exploited remotely to decrypt or tamper with activation and management traffic — an issue assigned CVE‑2025‑7970 and rated with a...

With the clock counting down to October 14, 2025, millions of PCs face a stark choice: upgrade to Windows 11, pay for a short-term safety net, or keep running an increasingly risky, unsupported Windows 10—while the debate over hardware compatibility, drivers and sustainability suddenly looks...

Microsoft Edge’s September update lands as a significant security-and-productivity release: Edge 140 (stable build 140.0.3485.54) ships a local AI-powered Scareware blocker, an HTTPS‑first upgrade path, automatic persistence for Tab Groups, expanded Copilot/GPT-5 integrations and media-creation...

Microsoft has acknowledged a compatibility regression introduced by the August 12, 2025 cumulative Windows updates that can cause unexpected User Account Control (UAC) elevation prompts and MSI Error 1730 failures for non‑administrator users when applications trigger Windows Installer (MSI)...

Google's Chromium team has fixed a medium-severity UI spoofing flaw—tracked as CVE-2025-9865—that existed in the browser's Toolbar implementation and could allow domain spoofing on Android when a user performed specific UI gestures on crafted pages. Background Chromium's September 2025 security...

Delta Electronics’ engineering tool EIP Builder contains an XML External Entity (XXE) vulnerability (CVE-2025-57704) that can expose sensitive files when the application parses crafted XML, and vendors and national incident responders now recommend an immediate upgrade to mitigate the risk...

Parallels Desktop’s latest update lands as a consequential bridge between macOS’s year-based refresh cycle and the Windows ecosystem, delivering official macOS Tahoe compatibility while tightening enterprise controls and Windows VM reliability for the post-2024 OS landscape. The release —...