Month: July 2026

Microsoft has patched RoguePlanet, a race condition in the Defender scanning engine that let any local user spawn a SYSTEM shell on fully patched Windows. The fix ships through the definition channel, not Patch Tuesday – which is exactly why you should verify it actually landed on your fleet.

July’s record Patch Tuesday also completed the Kerberos RC4 hardening rollout tied to CVE-2026-20833: audit mode and the registry override are gone, and domain controllers no longer fall back to RC4. If any service account still leans on it, authentication starts failing. Here is what breaks and how to find it before the tickets pile up.

A researcher dropped a working proof-of-concept called LegacyHive hours after July Patch Tuesday. It abuses the Windows User Profile Service to reach admin on fully patched machines – and it only needs a standard user account. Here is what it does and how to contain it while there is no fix.

June 2026 closed as the most aggressive month ever for CISA’s Known Exploited Vulnerabilities catalog, with 23 additions in 30 days, on top of a record 206-fix Patch Tuesday. Here’s why exploitation velocity keeps climbing, and how to run a KEV-driven patching workflow that doesn’t burn out your team.

The June 2026 Intune service release shipped Enterprise App Management auto-updates, EPM approvals for any signed-in user, and rules-based elevation for network settings. Here’s what each one fixes in a least-privilege rollout, and how to switch them on without breaking things.