AI Weekly Malaysia

Three separate research efforts last week demonstrated attacks that defeat passkey protections without breaking the underlying cryptography. SpecterOps showed a Windows + Microsoft Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA (CVE-2026-34348, CVSS 6.5, patched); Unit 42 demonstrated recovering private keys for cloud-synced passkeys via Google Password Manager in Chrome; and independent researcher Dirk-jan Mollema showed malware in an active Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt.

Why: If you ship passkey-based auth or rely on Windows Hello for Business / Entra ID for privileged access, these attacks mean endpoint compromise can undermine your MFA posture even with 'phishing-resistant' credentials. Review whether your architecture assumes a synced passkey store or an active Windows session is trustworthy—it may not be. Microsoft's own Entra migration guidance still describes passkeys as replay-resistant as of August 3, 2026, despite the SpecterOps relay finding, so don't treat vendor docs as a complete threat model.

Security researcher Nightmare Eclipse published a new Windows zero-day, dubbed ShieldBreak, that exploits Windows Defender to escalate from low-level user to full system access. The bug affects Windows 10, Windows 11 (including 25H2), and Windows Server 2025, requires Windows Defender to be enabled, and has no patch yet. Will Dormann independently verified the exploit, which builds on an earlier bug called RoguePlanet whose patch Nightmare Eclipse says is now fully bypassed.

Why: If you run Windows Server 2025 or Windows 11 in production or dev environments, there is no patch for this local privilege escalation bug, and disabling Windows Defender is not a safe workaround since the exploit requires Defender to be enabled. The practical takeaway is to restrict what untrusted executables can run on Windows hosts and treat any local code execution as a full compromise until Microsoft patches.

A hacker known as Nightmare Eclipse published ShieldBreak, the 10th Windows zero-day in their campaign against Microsoft, a local privilege-escalation exploit that gains SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server 2025. Former Microsoft employee Kevin Beaumont confirmed it works on the latest Windows 11 and published three detection and hunting queries. The exploit bypasses Microsoft's July fix for CVE-2026-50656 (RoguePlanet) but operates differently, abusing Defender's cloud-hydration scan via the Cloud Filter API.

Why: If you run Windows Server or Windows desktops in production, apply Beaumont's hunting queries now since Microsoft has not yet patched ShieldBreak and the PoC has a claimed 100% success rate on Windows 11 25H2. Because this is a local privilege-escalation exploit (not remote), the immediate risk is to multi-tenant or shared Windows environments where an attacker already has low-level access.

A researcher going by 'Chaotic Eclipse' has published a proof-of-concept called ShieldBreak that claims to fully bypass Microsoft's patch for CVE-2026-50656 (RoguePlanet), a race condition in the Microsoft Defender Malware Protection Engine (mpengine.dll) that can grant SYSTEM-level privileges. The PoC reportedly has a 100% success rate on Windows 11 25H2 and Windows Server 2025, with Windows 10 also vulnerable but untested. Microsoft says it is investigating the patch bypass claim.

Why: If you run Windows 11 25H2 or Windows Server 2025 in production or dev environments, this PoC means the existing Defender patch for CVE-2026-50656 does not actually protect you — an attacker with local access can still escalate to SYSTEM. Treat Defender's patch as insufficient and add compensating controls (restrict local user privileges, monitor for unexpected child processes from Defender's engine) until Microsoft ships a corrected patch.

Researchers Alejandro Hernando and Borja Martinez demonstrated at DEF CON 34 that Windows 11's Plug and Play auto-install can be chained into full SYSTEM execution on a fully updated machine. The physical path emulates a Sierra Wireless device to install SwiService.exe, abuses its SetDNS primitive, then emulates a Sony FeliCa reader whose co-installer fetches config over plaintext HTTP with a path-traversal flaw to plant a DLL in System32. A remote variant forges synthetic USB traffic over RDP using a phantom Intel RealSense device and a CRYPTBASE.dll search-order hijack, though Microsoft notes RDP USB redirection is not enabled by default.

Why: If your team runs Windows 11 endpoints with RDP USB redirection enabled or allows untrusted USB devices on managed machines, this chain gives an unprivileged user or authenticated RDP user a path to SYSTEM. The practical action is to verify that low-level USB redirection over RDP is disabled (Microsoft says it is off by default) and restrict physical USB device installation on shared or kiosk-style Windows machines.

Microsoft's August 2026 Patch Tuesday closes 398 CVEs (62 Critical), including CVE-2026-68820, a use-after-free in afd.sys (Windows kernel WinSock driver) under active exploitation that escalates privileges to SYSTEM. Check Point Research attributes the zero-day to Lazarus's Operation Dream Job campaign. Four unauthenticated 9.8-CVSS remote code execution flaws affect Windows DNS Server (described as wormable by ZDI), Windows Deployment Services, Microsoft's QUIC implementation, and HPC Pack.

Why: If you operate on-prem Windows servers—especially DNS Server, SharePoint farms, or anything using QUIC—patch immediately and prioritize the actively exploited afd.sys privilege escalation first, then the four 9.8 unauthenticated RCEs. Cloud-native builders on managed infrastructure (AWS/Azure/GCP Linux) are largely unaffected and can deprioritize this.

North Korea's Lazarus Group exploited CVE-2026-68820, a Windows AFD.sys privilege escalation flaw (CVSS 7.0) patched in August 2026 Patch Tuesday, to deploy a new backdoor called Troy against defense and aerospace companies in France, Germany, Brazil, and India. The campaign used fake LinkedIn recruiter messages and trojanized PDF viewers to deliver malware via DLL side-loading, with C2 communication through Microsoft Graph API and OneDrive.

Why: If you or your team are in defense, aerospace, or adjacent industries and receive unsolicited recruiter outreach with PDF attachments on LinkedIn, treat it as a potential intrusion vector — the infection chain starts with opening a malicious PDF or installing a trojanized PDF viewer. For everyone else, this is a reminder that Microsoft Graph API and OneDrive are increasingly abused for malware C2, which may affect egress filtering decisions.

Microsoft's August 2026 Patch Tuesday fixed 421 vulnerabilities, down ~200 from the prior month but described as the new norm under AI-assisted disclosure. One of them, CVE-2026-68820, was already exploited as a zero-day by North Korea's Lazarus Group since early June—a use-after-free in the Windows Ancillary Function Driver for WinSock allowing SYSTEM-level code execution by a locally authenticated attacker with no user interaction.

Why: If you manage Windows desktops or servers, patch immediately—CVE-2026-68820 is a local privilege escalation already weaponized by Lazarus in Operation Dream Job social-engineering campaigns targeting defense-sector job seekers in Europe and India. For most cloud-native or Linux-based builders in this community, there is no direct action; the bug requires local authentication and the attack chain targets a specific sector.

A new Windows zero-day privilege escalation vulnerability granting system-level privileges has been publicly dropped, though the article suggests it may already be patched. The article text itself is almost entirely Tom's Hardware site boilerplate with no technical detail on the CVE, affected versions, or exploitation specifics.

Why: No actionable detail is available in the article body — it is site navigation and membership text, not reporting. Builders cannot determine from this text whether their systems are affected or what to patch. Skip unless a fuller source with CVE ID and affected Windows versions surfaces.

A Wendy's digital menu board in Vancouver displayed a Windows Phone Link (PhoneExperienceHost.exe) error instead of its pickle chicken sandwich ad, likely due to a stack memory issue. The Register's offbeat column notes the irony of a consumer-facing display running Windows with Phone Link enabled at all.

Why: Mildly amusing reminder that if you ship Windows-based kiosks or digital signage, disable unnecessary services like Phone Link; otherwise your brand's ad spend becomes free advertising for Microsoft error dialogs. Not actionable for most builders.

Windows 11's built-in weather app reportedly consumes over 1.2 GB of RAM, functioning as a web wrapper loaded with ads rather than a native application. The article text itself is mostly site boilerplate with no additional technical detail beyond the headline claim.

Why: Minimal practical impact for builders. The only useful takeaway is a reminder that Electron-style or WebView wrappers can balloon memory usage; if you ship desktop apps via web wrappers, this is a cautionary data point, but the article provides no actionable detail beyond the 1.2 GB figure.