Zurück zur Übersicht

TECHFIXBK BLOG

Microsoft's Zero-Day Crisis: 6 Vulnerabilities Under Attack

M

Microsoft's Zero-Day Crisis: 6 Vulnerabilities Under Attack

TechFixBK
||32 min read

Hook and Who This Is For

Microsoft’s February 2026 Patch Tuesday has arrived, bringing news of a significant security challenge for users and administrators alike [36][115]. If you have recently checked your update status, you may have noticed a high volume of fixes targeting critical system components [12]. You are not alone in navigating this update cycle, as security reports indicate this is one of the most critical releases in recent history [115].

This guide is designed for individuals and IT professionals who use Windows and Microsoft Office products. It specifically covers:

  • The 58 vulnerabilities addressed in the February 2026 update [36][115].
  • Impacted software, including Windows 11 version 26H1, 24H2, and 23H2 [8][12].
  • The six actively exploited zero-day vulnerabilities currently being used in real-world attacks [36][115].
  • Specific risks associated with Microsoft Word, the Windows Shell, and Remote Desktop Services [10][13].

Please note that while this article provides technical analysis and recommended actions based on official security advisories, it does not constitute legal or regulatory compliance advice [9].

Who This Is For

This information is primarily for users running modern versions of the Windows operating system, particularly those on Windows 11 version 26H1 who received the KB5074837 cumulative update [8][11]. It is also highly relevant for administrators managing Windows Server environments or deployments of Microsoft 365 and Office [10][12].

This guide does not cover legacy operating systems that have reached the end of their standard support lifecycle, nor does it provide a comprehensive list of non-Microsoft software updates, though general industry trends are noted where applicable [36].

TLDR What This Means for You

Microsoft’s February 2026 Patch Tuesday addresses a significant security surge, including six zero-day vulnerabilities that are currently being exploited by attackers in the wild [2][10][14]. For most users, applying these updates is essential to prevent unauthorized system access, though specific stability concerns remain for certain configurations [3][18].

  • Immediate Risks: Attackers are actively using these flaws to bypass Windows SmartScreen prompts, execute malicious code via Microsoft Word, and escalate privileges to SYSTEM level [6][11][12].
  • Critical Action: Security experts and the Cybersecurity and Infrastructure Security Agency (CISA) advise prioritizing these patches, as the vulnerabilities allow threat actors to bypass security dialogs with a single click [1][2][6].
  • Stability Warning: While updates are necessary, some users have reported issues with recent patches, including a bug that causes compatible PCs to restart instead of shutting down or hibernating [3][9].
  • System Integrity: Beyond security fixes, this update continues the rollout of new Secure Boot certificates to replace expiring 2011 versions, ensuring devices can receive future boot-level protections [1][9].

Vulnerability Summary at a Glance

Vulnerability Type Count Impact
Zero-Day (Active) 6 Bypassing security prompts, local privilege escalation, or denial of service [10][11].
Critical Flaws 5 Potentially allows remote code execution or unauthorized data access [4][10].
Total Patches 59 Addresses flaws in Windows, Office, and Azure services [1][4].

Warning: Failure to update may leave systems increasingly exposed as more adversaries weaponize these exploits. However, users of older systems or specific hardware should verify backup status before proceeding due to recent reports of update-related bugs [1][3][12].

Background Basics

To understand the severity of the February 2026 security updates, it is important to define the technical terms used by security researchers and software vendors. These terms describe how a computer is attacked and how much control an intruder can gain over a system.

What is Patch Tuesday?

Patch Tuesday is the unofficial name for Microsoft’s scheduled release of security updates [9]. These updates occur on the second Tuesday of each month at 10:00 AM PST [9]. This predictable schedule helps IT professionals plan their deployment of security fixes to manage organizational risk [9]. The update released on February 10, 2026, addressed a total of 58 to 59 flaws across various Microsoft products [36][19].

Defining a Zero-Day Vulnerability

A zero-day vulnerability is a security flaw that has been publicly disclosed or actively exploited before an official fix or "patch" is available from the manufacturer [36]. In these cases, developers have "zero days" to fix the issue before it can be used by malicious actors. The February 2026 update was particularly critical because it addressed six actively exploited zero-days [36][11][19].

Common Types of Security Flaws

Security reports often categorize vulnerabilities based on their impact. The February 2026 release included several high-risk categories:

Term Simple Definition Total in Feb 2026
Remote Code Execution (RCE) An attacker can run their own software or commands on your computer from a different location over a network [11][36]. 12 [36][19]
Elevation of Privilege (EoP) An attacker with limited access gains higher-level permissions, such as becoming a system administrator [8][19]. 25 [36][19]
Information Disclosure A flaw that allows unauthorized individuals to view private data they should not be able to see [9][36]. 6 [36][19]
Security Feature Bypass A vulnerability that allows an attacker to ignore or "skip" a security defense, such as a login screen or a warning prompt [36][14]. 5 [36][19]

Why Severity Levels Matter

Microsoft uses a rating system to help users prioritize which updates to install first. This is often based on the Common Vulnerability Scoring System (CVSS), which provides a numerical score for risk [13].

Vulnerabilities are typically rated as Critical, Important, or Moderate [11]. A Critical rating usually means the flaw could allow an attacker to spread a virus without any action from the user [13]. The February 2026 update contained five flaws officially classified as Critical [36][19].

Problem Explanation

Microsoft has confirmed that hackers are actively exploiting six critical zero-day vulnerabilities across Windows, Microsoft Office, and system management tools [2][13][15]. These flaws were utilized by attackers before official patches were available, leaving systems vulnerable to unauthorized access and malware deployment [2][15][19]. Reports indicate that some of these vulnerabilities allow for "one-click" attacks, requiring very little interaction from a user to compromise a device [2][101].

The practical impact of these bugs is severe, ranging from silent malware installation to full system-level control [1][10][15]. Security researchers have observed these flaws being used to bypass built-in security features like Microsoft SmartScreen, which typically warns users about malicious files or links [1][13]. Because these exploits are currently being used in the wild, the risk of subsequent system compromise, ransomware deployment, or data theft is considered high [1][101].

Critical Vulnerabilities and Their Impact

The ongoing exploitation covers several distinct components of the Windows ecosystem. The following table summarizes the primary flaws currently being abused:

CVE Identifier Affected Component Impact
CVE-2026-21510 Windows Shell Bypasses SmartScreen to plant malware via links [1][13].
CVE-2026-21513 MSHTML (Browser Engine) Executes malicious actions through HTML files [1][13].
CVE-2026-20841 Windows 11 Notepad Executes remote files silently via Markdown links [8][12].
CVE-2026-21533 Remote Desktop Elevates attacker privileges to SYSTEM level [10][13].

Risks of Silent Execution and Privilege Escalation

One of the most concerning aspects of this crisis is the Notepad RCE flaw (CVE-2026-20841). Attackers can craft Markdown files (.md) containing malicious links that, when clicked, execute remote code in the security context of the current user [8][12]. In many cases, Windows may not display any security warning before the malicious file runs, making the attack nearly invisible to the victim [8][24].

Furthermore, vulnerabilities in Windows Remote Desktop and Desktop Window Manager allow attackers who have already gained limited access to escalate their permissions [10][13]. By reaching SYSTEM-level access, a threat actor can disable security software, steal credentials, or achieve full domain compromise within an organization [10].

Warning: Industry experts suggest that because exploit details have been published online, the frequency of these attacks may increase as more hackers adopt the methods [2][10][20].

Finally, a critical SQL injection vulnerability in Microsoft Configuration Manager (SCCM) is also reportedly under attack [20][21]. This flaw is particularly dangerous for enterprises, as it allows unauthenticated remote attackers to execute commands on servers used to manage thousands of laptops and workstations [20]. Analysts suggest that while some of these bugs require user interaction, the "one-click" nature of the exploits makes them a rare and high-priority threat [1][101].

Root Causes and Analysis

The current security landscape is shaped by a combination of sophisticated new exploits and the persistence of unpatched legacy vulnerabilities. Analysts have identified several core factors contributing to this increase in successful attacks against Windows and Microsoft 365 environments.

1. Actively Exploited Zero-Days in Windows and Office

In early 2026, Microsoft issued patches for 59 vulnerabilities, six of which were confirmed as actively exploited zero-days before a fix was available [8][9]. These flaws often involve protection mechanism failures that allow attackers to bypass execution prompts when a user interacts with a malicious file [8].

Specific vulnerabilities like CVE-2026-21513 and CVE-2026-21514 demonstrate this trend, as they can be triggered through crafted HTML or Microsoft Office files to perform dangerous actions with a single click [8]. Other exploits, such as CVE-2026-21519 and CVE-2026-21533, focus on Local Privilege Escalation (LPE), allowing attackers who have already gained limited access to elevate their permissions to SYSTEM level [8].

2. Silent Execution via Common Tools

Attackers are increasingly leveraging built-in Windows applications to evade detection. A notable flaw in the Windows 11 Notepad application allowed malicious files to execute silently when a user clicked on specially crafted Markdown links [10]. This "living off the land" approach is difficult to defend against because it utilizes legitimate, trusted software to initiate the compromise.

3. Critical Flaws in Management Software

Vulnerabilities in Microsoft Configuration Manager (SCCM/MECM) have become high-priority targets. A critical SQL injection vulnerability, rated 9.8, allowed unauthenticated remote attackers to execute commands on the server or the underlying database [9]. Because IT administrators use this software to manage an organization's entire fleet of laptops and servers, a single compromise can lead to widespread network control [9][10].

4. "Bring Your Own Vulnerable Driver" (BYOVD)

Ransomware groups, such as those deploying Reynolds Ransomware, are frequently using BYOVD techniques to disable security software [7]. This method involves:

  • Dropping a legitimate but flawed driver (such as NSecKrnl, truesight.sys, or amsdk.sys) onto the target system [7].
  • Exploiting a known flaw in that driver (e.g., CVE-2025-68947) to gain kernel-level access [7].
  • Using that access to terminate processes associated with EDR (Endpoint Detection and Response) tools from vendors like CrowdStrike, Sophos, and Symantec [7].

Because these drivers are digitally signed by legitimate authorities, they often do not trigger traditional antivirus warnings [7][11].

5. Persistence of Legacy Bugs

Many organizations remain vulnerable to "old" bugs that have received public proof-of-concept (PoC) exploits. For instance, a critical bug originally disclosed in October 2024 was still being actively battered by attackers 16 months later [9]. Similarly, attackers have successfully used patch bypasses for older SolarWinds Web Help Desk vulnerabilities (such as CVE-2024-28988) to gain domain-level compromise in 2026 [6][12].

Vulnerability Type Primary Impact Status
Zero-Day (LPE) Elevation to SYSTEM privileges Actively Exploited [8]
SQL Injection Remote Command Execution (RCE) Critical Risk [9]
BYOVD Disabling Security/EDR Tools Increasing Frequency [7]
Markdown Flaw Silent File Execution Confirmed in Notepad [10]

Evidence & Reality Check

Official documentation and industry reports confirm that these trends are not isolated incidents. The Cybersecurity and Infrastructure Security Agency (CISA) has added several of these Microsoft flaws to its "Known Exploited Vulnerabilities" catalog, signaling an immediate risk to both public and private sectors [9][10].

Furthermore, security researchers from firms like CrowdStrike and Tenable have observed that once an exploit binary becomes public, threat actors rapidly incorporate it into their toolsets to automate attacks [8]. While Microsoft provides monthly updates, the "exploitation less likely" labels originally assigned to some of these bugs have frequently proven inaccurate once attackers develop functional exploits [9].

Evidence and Reality Check

Official reports from government agencies and security firms confirm that multiple vulnerabilities are currently being exploited in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) has recently expanded its Known Exploited Vulnerabilities (KEV) catalog to include several high-risk flaws, requiring federal agencies to implement patches immediately [12][17].

The Microsoft Security Response Center (MSRC) has also verified that hackers are targeting zero-day bugs to compromise Windows and Office users [22]. These findings are corroborated by independent research teams, including Google’s Threat Intelligence Group, who identified widespread, active exploitation of system-level vulnerabilities [22].

Verified Exploitation Data

The following table summarizes key vulnerabilities confirmed to be under active attack by major security authorities:

CVE Identifier Primary Target Authority Confirming Exploitation
CVE-2026-21510 Windows Shell Microsoft, Google [22]
CVE-2026-21513 MSHTML (Internet Explorer engine) Microsoft, Brian Krebs [22]
CVE-2026-1731 Remote Support / Privileged Remote Access CISA, Arctic Wolf [12][17]
CVE-2024-43468 Microsoft Configuration Manager CISA, Microsoft [15][17]

Security researchers observe that the window for defenders to respond is shrinking significantly as threat actors rapidly weaponize new flaws [17]. For instance, reconnaissance efforts targeting CVE-2026-1731 were detected in less than 24 hours after a proof-of-concept exploit became available [17].

Reports from organizations such as Arctic Wolf indicate that attackers are using these vulnerabilities to deploy persistence tools like SimpleHelp and perform lateral movement across networks [12]. Furthermore, state-sponsored actors, such as the China-linked group Lotus Blossom, have been linked to the exploitation of recent software flaws to deliver undocumented backdoors [15].

Industry analysts suggest that cyber operations are becoming increasingly aggressive in 2026. While some specific reports, such as the Recorded Future 2026 State of Security Report, are frequently cited by experts to highlight this trend, it is widely accepted across the sector that more sophisticated and harder-to-detect methods are now standard in regional strategic intelligence gathering [17].

Warning: The presence of a vulnerability in the CISA KEV catalog indicates a high risk of imminent attack for unpatched systems [17].

Experts like Dustin Childs note that even when user interaction is required—such as clicking a link—the rarity of one-click bugs that allow remote code execution makes these current threats particularly dangerous [22]. This evidence underscores that the current crisis is not theoretical; it is a documented series of events impacting global infrastructure [17][22].

Self-Check and Diagnosis

Identifying whether your system is currently running the February 2026 security updates is the first step in assessing your exposure to the documented zero-day vulnerabilities [12][13]. Because these updates address flaws already being exploited in the wild, verifying your patch status is a high priority for maintaining system integrity [12].

1. Verify your Windows version

The impact of the February updates varies depending on which version of Windows you are running. You can check your version by navigating to Settings > System > About.

Windows Version Relevant Update Package
Windows 11, version 26H1 KB5074837 (.NET 4.8.1) [1][2]
Windows 11, version 24H2 / 25H2 KB5074109 or KB5077181 [5][7]
Windows Server 2025 KB5073379 [7]

2. Review Update History for specific KBs

To confirm if the security patches have been applied, you should examine your installation logs. Go to Settings > Windows Update > Update History and look for the following entries released on or after February 10, 2026:

  • KB5077181: The primary February cumulative update for Windows 11 [5][6].
  • KB5074837: The cumulative update for .NET Framework 4.8.1, which addresses information disclosure vulnerability CVE-2025-55248 [1][2].
  • KB5074109: A security update specifically targeting versions 24H2 and 25H2 [7].

3. Identify centralized management tools

In professional or enterprise environments, updates are often not managed individually. If your organization utilizes Windows Server Update Services (WSUS), Microsoft Intune, or Windows Update for Business, these tools will automatically sync and deploy the February 10, 2026 updates if configured to do so [2][7].

If you use these tools, check the compliance dashboard to see if the "Security Updates" classification for Windows 11, version 26H1 has been successfully distributed to your fleet [1][2].

4. Watch for unusual startup or network behavior

Even if an update is listed as successfully installed, it may not be functioning correctly. Reports indicate that KB5077181 has triggered critical startup problems for some users [5]. You should check for the following symptoms:

  • Boot Loops: The system enters an endless cycle of restarts immediately after the update installation [5][6].
  • Error Codes: Common identifiers for update failure or service conflicts include SENS (System Event Notification Service), 0x800f0983, or 0x800f0991 [5][6].
  • Connectivity Issues: Look for DHCP errors or failures when attempting to connect to WPA3-Personal Wi-Fi networks [5][12].
  • Gaming Glitches: Unusual behavior or crashes when playing games in full-screen mode [12][13].

Note: If your system displays a SENS error, it likely indicates that the system cannot interact with the required service due to missing data or network-related conflicts caused by the patch [6].

Solutions and What to Do

To address the recent surge in vulnerabilities, including six zero-day exploits detected in real-world attacks [12], administrators and users should take a tiered approach to securing their systems.

Prioritize Critical Security Patches

The February 2026 update includes 55 security fixes, which is significantly lower than the 114 fixes released in January 2026 [12]. However, the presence of actively exploited vulnerabilities makes this update urgent for critical systems [12].

  • Server Environments: Ensure Windows Server 2025, 2022, and 23H2 are updated with the latest cumulative packages, such as 5073379 or 5073457 [1].
  • Legacy Systems: Organizations running Windows Server 2008 or 2008 R2 must have a valid Extended Security Update (ESU) subscription to receive these protections [1].
  • Verification: Administrators can use the Microsoft Update Catalog to download standalone packages if automatic updates are restricted [15].

Implement Real-Time Monitoring

For enterprise environments, the new CCF Push feature for Microsoft Sentinel is currently in public preview to enhance identity security and SaaS visibility [8].

  • Credential Security: The connector provides centralized visibility into credential usage to help detect potential misuse in real-time [8].
  • SaaS Visibility: Integrating behavior feeds allows security teams to correlate SaaS risks with enterprise telemetry, which may accelerate investigations into account compromises [8].
  • Automation: Utilizing automated playbooks within Sentinel can help enforce Zero Trust principles across hybrid environments [8].

Manage Update Stability Risks

While security patches are critical, reports indicate that recent updates have caused technical issues for some users, such as restart loops or connectivity glitches [12].

  • Pause Updates: If a system is stable but not yet patched, users may consider a temporary pause of 7 days to monitor for reported hardware incompatibilities [12].
  • Rollback Procedure: If a PC experiences startup problems or failure to hibernate after the January or February updates, a rollback to a previous restore point may be necessary until a specific hardware fix is released [12].
  • Check Known Issues: Before deployment, consult the Windows message center or the "Known Issues" column in the Microsoft Deployment tab to identify potential conflicts with specific hardware configurations [1].

Update Microsoft Edge Separately

Microsoft Edge security fixes are often released on a different cadence than the standard Windows Patch Tuesday updates [5][11].

  • Version Check: Ensure the browser is updated to at least version 144.0.3719.82 or higher to address specific vulnerabilities like CVE-2026-21223 [5][14].
  • Chromium Fixes: Recent Edge updates incorporate critical security fixes from the Chromium project, some of which address exploits already existing in the wild [7][14].
  • Manual Update: Open Edge, navigate to Settings > About Microsoft Edge to trigger an immediate check and installation of the latest security version [5].

Risks Limits and When to Stop

While many users attempt to resolve update-related issues independently, the February 2026 Windows 11 update (specifically KB5077181) presents unique risks that may exceed standard troubleshooting capabilities [1][2]. Software patches intended to improve security can potentially conflict with specific hardware configurations or existing system files, leading to critical instability [2].

Understanding the Risks of Manual Troubleshooting

Attempting to force a system to boot or repeatedly hard-resetting a device during a boot loop can potentially lead to file system corruption or hardware strain. Reports indicate that for the KB5077181 update, standard recovery mode options have shown varying degrees of success [2].

If a system is stuck in an endless restart cycle, the risk of data loss increases if the operating system's internal repair tools attempt to "reset" the installation without a verified backup [1][2].

When to Stop Troubleshooting

It is generally recommended to cease manual repair attempts and seek professional technical assistance if you encounter the following scenarios:

  • Persistent Boot Loops: If the device restarts more than three times consecutively without reaching the login screen [1][2].
  • Critical Error Codes: If the system displays persistent SENS (System Event Notification Service) errors or network-related DHCP failures that prevent internet access even when hardware is connected [2][4].
  • Installation Failure Codes: Recurring errors such 0x800f0983 or 0x800f0991 that reappear after an attempted uninstallation [2][4].
  • Hardware Unresponsiveness: If the keyboard, mouse, or built-in display fails to respond during the BIOS/UEFI or Recovery Environment stages [2].

Warning: Attempting advanced command-line repairs or registry modifications without a full system image backup can lead to permanent operating system failure.

Limits of Current Official Fixes

As of mid-February 2026, these specific startup problems are not yet officially listed in the "Known Issues" section of the Microsoft update dashboard for KB5077181 [2][4]. Consequently, there is currently no verified automated fix from the vendor.

While uninstalling the update via the Control Panel is a primary recommendation for those who can still access their desktop, users who are completely locked out of their systems may find manual recovery tools insufficient [1][2]. In such cases, professional diagnostic tools are often required to stabilize the environment and preserve user data.

Summary Checklist: Should You Continue?

Scenario Recommended Action
Can access Windows Desktop Uninstall KB5077181 and Pause Updates [1][2].
Stuck in a "Automatic Repair" loop Attempt System Restore once; if it fails, stop [2].
Seeing SENS or DHCP errors Check network hardware; if errors persist, seek help [2][4].
System displays a Black Screen Stop immediately to avoid unnecessary hardware power-cycling [2].

If you are unsure of the correct steps, it is usually cheaper to ask someone once than to fix a mistake later.

FAQ

Should I update my system if there are reported bugs?

Yes, it is generally recommended to install security updates because they address critical vulnerabilities that could be exploited [3][10]. While Microsoft subjects updates to extensive testing, some releases may contain "known issues," which are documented in the Knowledge Base (KB) articles accompanying the release [7][9]. To minimize risks, users should check the Security Update Guide for caveats before installation and maintain a current backup of their data [5][9].

Is Windows 10 included in these security updates?

Yes, Windows 10 continues to receive security fixes, though the delivery method depends on the specific version's support status [6]. For versions that have reached the end of their standard lifecycle, Microsoft provides Extended Security Updates (ESU), which require a valid license to receive ongoing protection [1][4]. These updates are cumulative, meaning the monthly release includes all security fixes for vulnerabilities affecting the operating system in addition to non-security improvements [6].

What is a BYOVD attack?

A Bring Your Own Vulnerable Driver (BYOVD) attack is a method where an attacker bypasses system security by loading a legitimate but old and vulnerable driver onto a target machine. Once the vulnerable driver is active, the attacker exploits its known flaws to gain kernel-level access or execute unauthorized commands. While the provided documentation does not explicitly define this term, it lists several driver-related vulnerabilities—such as those found in modem drivers or the Windows Kernel—which are common targets for such exploitation techniques [11][12].

How can I verify if an update is installed correctly?

You can use the Windows Update Agent (WUA) to scan your computer for missing security updates, even if the device is offline [5]. For organizations, tools like Windows Server Update Services (WSUS) or Microsoft Intune are typically used to oversee deployment and confirm patch compliance across multiple managed devices [3][8]. If you are manually installing packages, you should cross-reference the KB Article ID numbers with the documentation found in the Security Update Guide [4][5].

Where can I find information about specific "Zero-Day" exploits?

The Security Update Guide is the authoritative source for information regarding Microsoft security updates and vulnerabilities [2][10]. Within the guide, a vulnerability is marked as Exploited (YES) if it has been utilized in the wild before the release of the security update [3]. Additionally, the Microsoft Exploitability Index provides data on the potential for future exploitation for "Important" or "Critical" severity updates [3].

If you are unsure about the update process, it is usually cheaper to ask someone once than to fix a mistake later.

Summary and Key Takeaways

The February 2026 Patch Tuesday addresses a significant volume of security risks, focusing on vulnerabilities that allow for remote code execution and local privilege escalation. Ensuring systems are updated is a critical step in maintaining long-term hardware and software integrity.

  • Massive Security Patching: Microsoft released updates for 59 vulnerabilities this month [10][19]. Of these, six zero-day vulnerabilities were confirmed to be actively exploited in the wild at the time of release [9][10][13].
  • High-Priority Targets: A critical remote code execution vulnerability in Windows Notepad (CVE-2024-49080) with a CVSS score of 8.8 is a major focus, as it could allow attackers to gain the same rights as the current user [8]. Other high-priority fixes target the Windows Shell, MSHTML Framework, and Microsoft Office Word [10][13].
  • Update Risks: While immediate patching is recommended to mitigate active threats, industry reports indicate that recent updates have occasionally introduced glitches, such as issues with Secure Launch causing PCs to restart instead of shutting down [6][12].
  • Secure Boot Transitions: Updates are currently rolling out new Secure Boot certificates to replace those expiring in June 2026 [12][19]. If these are not installed, devices may eventually enter a degraded security state, potentially limiting their ability to receive future boot-level protections [7][19].
  • Stability Support: If a system experiences stability issues or startup glitches during the update process, seeking professional technical assistance is recommended to ensure the operating system is properly restored without data loss.

If you’re unsure about the update process or your system's stability, it’s usually cheaper to ask someone once than to fix a mistake later.

Quellen

[1] Safer Internet Day 2026: Helping students be AI aware | Microsoft Education Blog

[2] Building a safer digital future, together

[3] Microsoft Flags Rising Online Risks on Safer Internet Day 2026

[4] Microsoft Security Response Center Blog

[5] Public Preview Announcement: Empower Real-Time Security with Microsoft Sentin...

[6] Release notes for Microsoft Edge Security Updates

[7] Microsoft January 2026 Security Updates (FYI) - Microsoft Q&A

[8] February 10, 2026-KB5074837 Cumulative Update for .NET Framework 4.8.1 for Wi...

[9] Security Update Guide FAQs

[10] Security Update Guide - Microsoft Security Response Center

[11] A one-prompt attack that breaks LLM safety alignment | Microsoft Security Blog

[12] Cyber Press - Google News

[13] About the security content of iOS 26.3 and iPadOS 26.3 - Apple Support

[14] The Hacker News - Google News

[15] Apple security releases - Apple Support

[16] Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools

[17] Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerab...

[18] Microsoft's February Patch fixes 6 zero-days - but some Windows users sh...

[19] Microsoft Patches 59 Vulnerabilities Including Six Actively Exploited Zero-Days

[20] Critical Microsoft bug from 2024 under exploitation

[21] CISA flags critical Microsoft SCCM flaw as exploited in attacks

[22] Microsoft says hackers are exploiting critical zero-day bugs to target Window...

[23] Someone

[24] Windows 11 Notepad flaw let files execute silently via Markdown links

[25] Apple patches decade-old iOS zero-day exploited in the wild

[26] February's Windows 11 update is causing startup problems for users

[27] Forget zero-days -

[28] Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network P...

[29] Microsoft dials up the nagging in Windows, calls it security

[30] How Microsoft obliterated safety guardrails on popular AI models - with just ...

[31] A perfect match – NordVPN teams up with CrowdStrike to take its Threat ...

[32] Windows 11 is testing new 2026 features and some are already live

[33] Windows 11 version 26H1 won

[34] Microsoft releases Windows 10 KB5075912 extended security update

[35] Microsoft best�tigt, dass Windows angegriffen wird - und das BSI warnt

[36] Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws

[37] Recorded Future 2026 State of Security Report Warns Cyber Operations Have Bec...

[38] RH-ISAC Announces Keynote Speakers for 2026 Cybersecurity Summit

[39] Cyolo Accelerates Momentum into 2026 Following Record Year of Growth in Indus...

[40] Hyperproof Releases 2026 Benchmark Report, Revealing How AI Is Reshaping GRC

[41] ZAST.AI Raises $6M Pre-A to Scale "Zero False Positive" AI-Powered ...

[42] February 2026 Patch Tuesday includes six actively exploited zero-days

[43] MSHTML Framework Zero-Day Vulnerability Lets Attackers Bypass Security Featur...

[44] Microsoft Warns of Hacks via Zero-day Vulnerabilities on Windows, MS Office

[45] Microsoft advierte sobre tres exploits de día cero en Windows y Office

[46] Google Chrome Releases Early Preview Of WebMCP

[47] CVE-2026-20841: Windows Notepad RCE Fixed in Microsoft’s February Patch Tuesd...

[48] Microsoft’s February 2026 Patch Tuesday: Six Zero-Days, 58 flaws Patched Amid...

[49] Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026 - Help ...

[50] Microsoft and Adobe Patch Tuesday, February 2026 Security Update Review | Qualys

[51] Microsoft reports six actively exploited zero days in Patch Tuesday

[52] Microsoft February 2026 Patch Tuesday Fixes 54 Vulnerabilities, Including 6 Z...

[53] Microsoft Fixes Six Zero Day Vulnerability in February Patch Tuesday

[54] Windows Patch Tuesday: Notepad RCE Fix, Secure Boot Update & Taskbar Prot...

[55] Microsoft patches zero-day flaws in latest Windows update

[56] CISA Warns of Actively Exploited SQL Injection Flaw in Microsoft Configuratio...

[57] Microsoft Fixes 59 Vulnerabilities, Including Six Under Active Exploitation -...

[58] Apple fixed first actively exploited zero-day in 2026

[59] U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Expl...

[60] February 2026 Microsoft Patch Tuesday | Tenable®

[61] CISA Warns of Microsoft Configuration Manager SQL Injection Vulnerability Exp...

[62] U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration M...

[63] Phishing campaign chains old Office flaw with fileless XWorm RAT to evade det...

[64] Microsoft Patch Tuesday: February 2026 - Arctic Wolf

[65] CVE-2026-20700: Apple Patches Zero-Day Exploited in Sophisticated Cyber Attac...

[66] Apple fixes zero-day flaw exploited in targeted attacks (CVE-2026-20700) - He...

[67] Attackers finally get around to exploiting critical Microsoft bug from 2024 -...

[68] Critical BeyondTrust vulnerability CVE-2026-1731 exploited

[69] CVE Alert: CVE-2026-21238 - Microsoft - Windows 11 version 26H1 - RedPacket S...

[70] Reynolds Ransomware Exploits CVE-2025-68947 in NsecSoft NSecKrnl Driver to Di...

[71] Microsoft fixes six actively exploited flaws in latest Windows 11 update

[72] Researchers unearth 30-year-old vulnerability in libpng library

[73] Microsoft fixes six zero-days on February 2026 Patch Tuesday

[74] Microsoft patch Tuesday fixes multiple zero-days and dozens of flaws

[75] 9th February – Threat Intelligence Report - Check Point Research

[76] Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731) - H...

[77] Preventing Reflected XSS Threats in Geo Widget

[78] BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access...

[79] BeyondTrust fixes critical RCE flaw in remote access tools

[80] CVE-2026-1731 on BeyondTrust: Critical unauthenticated remote code execution ...

[81] CVE-2026-20841 PoC: When “Just a Text Editor” Becomes a Link-to-Code Executio...

[82] BeyondTrust RCE (CVE-2026-1731) is being probed and attacked in the wild

[83] Researchers Document Active Exploitation of BeyondTrust CVSS 9.9 Vulnerability

[84] Critical flaw in BeyondTrust Remote Support sees early signs of exploitation

[85] Apple Just Patched Its First Zero-Day Security Vulnerability of 2026

[86] Apple discloses first actively exploited zero-day of 2026

[87] Time to Exploit Plummets as N-Day Flaws Dominate

[88] Microsoft patches six zero-days targeting Windows, Word, and more – her...

[89] Fix Windows 11 KB5077181 Install Error

[90] Windows 11 Update KB5077181 Traps Users in Boot Loops

[91] KB5007651 Keeps Reinstalling on Windows 11 — What It Is and How to Fix It

[92] NVD - CVE-2026-21509

[93] Windows 11 Cumulative Updates KB5077181 & KB5075941 Released

[94] NVD - cve-2026-22277

[95] Windows 11 February Update Triggers Startup Issues for Users

[96] Windows 11 KB5077181 boot loop fix: uninstall guide | tbreak

[97] Windows 11 February 2026 Patch: KB5077181 and KB5075941 fix zero-days, shutdo...

[98] News brief: 6 Microsoft zero days and a warning from CISA | TechTarget

[99] Microsoft issues urgent patches for actively exploited Windows, Office zero-days

[100] Microsoft Windows And Office Users Are At Risk, Here's What You Should D...

[101] Zero-Day Bugs Under Attack; Microsoft Issues Alert to Windows and Office Users

[102] Microsoft pushes fixes for six exploited zero days

[103] CVE-2025-59287: WSUS Exploitation Hunting Guide

[104] 7,000 Servers and Counting: The Rise of the SSHStalker Linux Botnet

[105] Windows Notepad Markdown feature opens door to RCE (CVE-2026-20841) - Help Ne...

[106] Windows Shell Zero-Day Vulnerability Allows Attackers to Bypass Authentication

[107] Patch Tuesday - February 2026

[108] Microsoft urgent patch: Hackers exploit critical Windows and Office vulnerabi...

[109] February’s Patch Tuesday release fixes 59 flaws, including 6 being exploited

[110] Desktop Window Manager Zero-Day Vulnerability Allows Privilege Escalation

[111] State-Backed Hackers Use Gemini AI for Cyberattacks Aimed at Cyber Espionage:...

[112] Microsoft Beefs Up Runtime Security

[113] Microsoft to roll out a ‘consent first’ model to protect Windows

[114] Windows Secure Boot 2026: Microsoft issues final warning over expiring certif...

[115] Patch Tuesday February 2026: Security Updates & CVE Analysis

[116] Microsoft Discloses ‘Extraordinarily High’ Number Of Zero-Day Vulnerabilities...

[117] Microsoft wants Windows 11 “secure by default," could allow only properl...

[118] Srsly Risky Biz: Microsoft's Forgoes Its Secure Future

[119] Microsoft patches six actively exploited zero-days in February update

[120] Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed, Including 6...

[121] CVE-2026-21509: Actively Exploited Microsoft Office Zero-Day Forces Emergency...

[122] Microsoft

[123] February 2026 Patch Tuesday: Multiple Zero-Days

[124] Your Encryption Is Already Outdated. A $6.15 Trillion Fix Is Underway

[125] Microsoft schließt sechs gefährliche Zero-Day-Lücken

[126] Microsoft Patch Tuesday matches last year’s zero-day high with six actively e...

[127] Microsoft: Sechs Zero-Day-Lücken erfordern sofortiges Handeln - BornCity

[128] Windows 11 Updates KB5077181 & KB5075941 Released

[129] Microsoft: Sechs Zero-Day-Lücken zwingen zu sofortigen Updates

[130] Windows 11 February 2026 Update: New Features, Quality Improvements & Eve...

[131] bsi.bund.de

[132] Microsoft: Sechs Zero-Day-Lücken in Windows 10 aktiv ausgenutzt - BornCity

[133] Safety warnings - RPTU Rheinland-Pfälzische Technische Universität Kaiserslau...

[134] Warnung: Kritische Zero-Day-Schwachstelle in Microsoft Office - Unternehmen C...

[135] I tested Windows 11 February 2026 Updates: Everything new, improved, and fixed

[136] Microsoft warns of zero-day attacks on Windows, Office

[137] BSI warnt: Hacker nutzen Sicherheitslücke in Windows aus

[138] Kritische Sicherheitslücke in Windows: BSI warnt vor Zero-Day-Exploit

[139] Windows Remote Desktop Services 0-Day Vulnerability Exploited in the Wild to ...

[140] Building immutable backups without breaking your budget - Spiceworks

[141] February 2026 Patch Tuesday: Six Zero-Days Under Active Exploitation Demand I...

[142] Six Zero-Days Under Fire: February 2026 Patch Tuesday Breakdown

[143] Every Tech Conference & Trade Show in the U.S. (2026)

[144] Windows 11 Taskbar Mobility Returns: Patch Tuesday Fixes & PowerToys Enha...

[145] Fancy Bear Exploits Microsoft Zero-Day to Deploy Backdoors and Email Stealers

[146] iTWire - February 2026 Patch Tuesday comment from Tenable

[147] XFN 1.1 profile

[148] Known Exploited Vulnerabilities Catalog | CISA

[149] XFN 1.1 profile

[150] Careers at Foundry: Global Martech Jobs | Foundry

[151] Cision - Global Cloud-Based Communications and PR Solutions Leader

[152] PR Newswire for Agency Partners

[153] PR Newswire | LinkedIn

[154] Cision - Global Cloud-Based Communications and PR Solutions Leader

[155] CISA Adds Four Known Exploited Vulnerabilities to Catalog | CISA

[156] The Hacker News

[157] fonts.googleapis.com

[158] The Hacker News | LinkedIn

[159] Zero Day Initiative — The February 2026 Security Update Review

[160] Registration • The Register

[161] fonts.googleapis.com

[162] CSO Audience: Reach, Engage & Advertise | Foundry

[163] Foundry Ad Choices & Interest-Based Ads Policy

[164] Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here&#x...

[165] Known Exploited Vulnerabilities Catalog | CISA

[166] BleepingComputer (@[email protected]) - Infosec Exchange

[167] Cyber Press ® | LinkedIn

[168] Your California Privacy Rights Under the CCPA | Foundry

[169] CVE-2026-1731: Pre-Auth RCE in BeyondTrust Remote Support & PRA

Relevant Services

More from the Blog

Brauchen Sie Hilfe?

Wir reparieren Ihren PC oder Laptop schnell und zuverlässig.

Jetzt Reparatur anfragen