Microsoft fixes exploited zero-day (CVE-2024-49138)

On December 2024 Patch Tuesday, Microsoft resolved 71 vulnerabilities in a variety of its products, including a zero-day (CVE-2024-49138) that’s been exploited by attackers in the wild to execute code with higher privileges. CVE-2024-49138 exploi… Continue reading Microsoft fixes exploited zero-day (CVE-2024-49138)

Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)

November 2024 Patch Tuesday is here, and Microsoft has dropped fixes for 89 new security issues in its various products, two of which – CVE-2024-43451 and CVE-2024-49039 – are actively exploited by attackers. The exploited vulnerabilities (… Continue reading Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)

Windows Server 2025 gets hotpatching option, without reboots

Organizations that plan to upgrade to Windows Server 2025 once it becomes generally available will be able to implement some security updates by hotpatching running processes. What is hotpatching? “Hotpatching has been around for years in Windows… Continue reading Windows Server 2025 gets hotpatching option, without reboots

Is it normal to have Sysmon detect CreateRemoteThread on a fresh and clean Windows Server installation?

A fresh Windows Server installation (20212 R2), all updates applied. Sysmon v15.15 installed. Literally nothing else was installed/added. Never started a browser, never opened a web page. Only apps used were standard utilities that come wi… Continue reading Is it normal to have Sysmon detect CreateRemoteThread on a fresh and clean Windows Server installation?