Topic
Protective features and update mechanisms in Microsoft Windows, including Defender antivirus, kernel safeguards, and the Patch Tuesday fix cycle.
Doyensec ran its own code inside the Windows VBS enclave behind SmartScreen's phishing protection by chaining a four-byte write with a timing bug. Microsoft patched CVE-2026-83498 on September 8, 2026 and says it has not been exploited.
Reality
Huntress details four ways attackers who already hold administrator rights add Microsoft Defender exclusions to keep malicious files out of every scan. A registry value can also hide those exclusions from any admin who checks for them.
Reality
Huntress showed WWAHost.exe rendering attacker JavaScript with full WinRT access, driving a genuine login.microsoftonline.com prompt. The tokens survive MFA. The gate is Developer Mode.
Reality
Between June and September, according to The Verge, Microsoft shipped about 1,820 security fixes where 400 would once have been normal, which leaves the admins who test each one before deployment doing arithmetic they cannot win.
Reality
Tenable's tally for September 2026 is the largest Patch Tuesday on record. It shipped with two bugs already exploited in the wild. The other 962 sit on the calendar as a scheduling problem, and the severity ratings do not sort them by urgency.
Reality
A kernel exploit against HackSys' vulnerable driver pivoted onto a user-mode fake stack in Ring 0 and never faulted, because the syscall entry path sets the AC bit that suppresses SMAP.
Reality