Patchday Microsoft: Attacken auf Windows-Kernel beobachtet

Microsofts Entwickler haben Sicherheitslücken in unter anderem Azure, Office und Windows geschlossen. Es gibt bereits Attacken.

heise online

Windows-Kernel-0-Day: Aktive Ausnutzung von CVE-2025-62215 ermöglicht Rechteausweitung

https://www.all-about-security.de/windows-kernel-0-day-aktive-ausnutzung-von-cve-2025-62215-ermoeglicht-rechteausweitung/

#0-day #zeroday #windows #windowskernel
#mi crosoft

Windows-Kernel-0-Day: Rechteausweitung durch CVE-2025-62215

Microsoft warnt vor der Schwachstelle im Windows-Kernel: CVE-2025-62215 erlaubt eine gefährliche Rechteausweitung.

All About Security Das Online-Magazin zu Cybersecurity (Cybersicherheit). Ransomware, Phishing, IT-Sicherheit, Netzwerksicherheit, KI, Threats, DDoS, Identity & Access, Plattformsicherheit
Microsoft is moving antivirus providers out of the Windows kernel

Microsoft is making changes to Windows to get antivirus apps out of the kernel. A private preview is being released to security vendors in July.

The Verge
Microsoft wirft Antivirensoftware aus dem Windows-Kernel

Ein CrowdStrike-Erlebnis will Microsoft nicht noch einmal haben. Nun fliegt deswegen Antivirensoftware aus dem Windows-Kernel.

heise online

PatchGuard Internals – Deep Kernel Protection Dive

Explains PatchGuard’s initialization phases, secure-hypervisor activation paths, and context setup, revealing potential bypass points.

https://r0keb.github.io/posts/PatchGuard-Internals/

#PatchGuard #WindowsKernel

PatchGuard Internals

Good morning! In today’s blog we’re going to talk about one of the most powerful protections for Windows: PatchGuard, also known as KPP (Kernel Patch Protection).

r0keb

Brokering File System January 2025 Patch Analysis

Microsoft patched two use‑after‑free bugs in bfs.sys via KB5050009 and KB5049984, fixing race‑condition flaws in PipeMappingTable and PolicyTable.

https://ht3labs.com/Brokering-File-System-January-2025-Patch-Analysis.html

#WindowsKernel

A Syscall Journey in the Windows Kernel

Deep dive into how syscalls work in the Windows kernel, exploring structures, debugging, and reversing techniques.

https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/

#WindowsKernel

A Syscall Journey in the Windows Kernel

The analysis on this post was made from a Windows 10 x64 bits. If you are trying to compare the content of this post on a lower Windows version you will be disappointed since changes were made in Windows 10. In my last post dedicated to the different ways to retrieve Syscall ID, I explained quickly how direct syscalls were performed in User Mode and remained vague about how it was processed in Kernel Mode.

Want to dive into the core of Windows? 🦀 Explore crafting Windows kernel drivers with Rust in this deep-dive by Matthias Heiden. From rootkits to antivirus tools, unlock the power and safety Rust brings to kernel programming!

Watch now ➡️ https://youtu.be/NfBXDEgm6VY

#rustlang #eurorust24 #windowskernel

Windows Kernel Programming with Rust - Matthias Heiden | EuroRust 2024

YouTube

I think the #MVI will end up with the #Windows Kernel having a “Security API” where software will be able to peek and poke relevant system information to avoid tampering or suspicious activity.

The problem is the chain of trust. I expect #AntiCheat software to become useless, and servers having to analyze user behavior to find cheaters.

#Proton and #Wine users: you may have a shot playing #Valorant.

#Microsoft #WindowsKernel #Security #Cheating #Linux #Videogames #Gaming #Games #Kernel

Windows Lockdown: A Win for Linux Gamers?

PeerTube