Star player of the Zanarkand Abes. Principal Security Consultant || #CARTP | #CRTL | #CRTO | #OSCP | #OSWP | #OSEP | #CREST CRT/CPSA | Thoughts are my own. ハッカー
But I was told there is no risk on public networks? You're telling me I can be popped by a DNS response and there are 0-days in the security product shipped on consumer laptops? At least nobody is going to MiTM me on a train, right? So I'm safe? Please respond tweeps.
‼️🚨 Microsoft has patched a critical Windows DNS Client remote code execution vulnerability that allows an unauthorized attacker to execute code over a network. All it takes is a malicious DNS response.
The vulnerability is tracked as CVE-2026-41096 with a CVSS score of 9.8. It is a heap-based buffer overflow in dnsapi.dll, the Windows component that processes DNS answers on every machine.
To trigger it, an attacker needs a position where they can influence DNS responses: a rogue DNS server, a poisoned resolver, a compromised router, hostile WiFi, or a man-in-the-middle placement.
That puts ordinary Windows DNS activity in the blast radius. Browsers, VPN clients, enterprise apps, update checks, and background services constantly ask DNS where to connect. The vulnerable processing sits in the Windows DNS Client path, not an edge-facing server product.
Microsoft assessed exploitation as "less likely," and Rapid7 lists the issue as not publicly disclosed and not known to be exploited at release.
On the contrary, a 9.8 unauthenticated network RCE in DNS client handling is exactly the kind of bug defenders should assume will be reverse-engineered quickly.
Defenders should:
- Deploy the May 2026 cumulative updates and confirm coverage across endpoints and servers
- Restrict DNS traffic to trusted resolvers where possible
- Monitor Dnscache and svchost.exe for abnormal child processes or unexpected outbound activity
- Treat public WiFi and untrusted resolver paths as higher-risk until patching is complete
> Epstein writes down email and password
> FBI finds it
> Stores as evidence
> Doesn't censor
> Released
> Nerds find Epstein password
> No MFA
> I wonder if anyone logged in?
> Look inside
"do less" is 🆁🅴🅰🅻🅻🆈 good malware design principle.
>avoid shellcode
>avoid arbitrary code execution
>minimize C2 traffic
>abuse legit features to just redirect packets
>get signed by Microsoft
Canada has ordered Hikvision to shut down nationwide, citing national security concerns. The ban prohibits government use of its products, but Hikvision calls it baseless and biased.
#Canada#HikvisionBan#NationalSecurity#Surveillance#Cybersecurity
https://t.co/QpOqYQiqeT
I’ve just published the official trailer for my upcoming course, Malwareless Adversarial Emulation (MAE).
Watch the trailer & module overview: https://t.co/KQHHNM2MvI
Sign up to be notified when the course goes live: https://t.co/0227rpN2ba
@CyberCakeX Also, I'm not trying to discredit the blog author/researchers as it's a super cool vuln/TTP. I'm more interested in the semantics and the need to use the word "bypass" in every case.
@CyberCakeX Therefore, you didn’t bypass WDAC by defeating its core mechanisms. You leveraged a policy hole which is app and vuln agnostic. It could be any app and any vuln as WDAC trusts binaries not behaviour, no? I'm not an expert on low-level WDAC though.
So, like, do you have to know how to code to be a red teamer? Could save myself the effort of writing loaders and malware to evade EDR, or new C2 comms channels.
In all seriousness, I know red reamers who don't code and are good at it. They have a team for that.
@CyberCakeX Similarly, if WDAC was using a "strictest" policy (however typical) and there was a flaw in how WDAC parses rules or some other logic to run your app/code that should violate the policy then I'd say it's a WDAC bypass. I think it comes down to semantics.
@CyberCakeX I can see where each side is coming from. I am leaning in your favour though. If the WDAC policy allows an Electron app to run that contains a V8 vulnerability, then to me it's the policy that's overly permissive which is not a flaw in WDAC rather the config of it.