windows
Safeguard articles tagged "windows" — guides, analysis, and best practices for software supply chain and application security.
25 articles
Patch Tuesday June 2026: ~200 Flaws, 6 Zero-Days, and a Wormable Kernel RCE
Microsoft's June 2026 Patch Tuesday is among the largest on record — roughly 200 fixes, six zero-days including one exploited in the wild, and a top-severity Windows Kernel RCE. Here's what actually matters.
CVE-2021-3331: How the WinSCP URL Handler RCE Works
CVE-2021-3331 is a critical remote code execution flaw in WinSCP's URL handling before 5.17.10. Here is how a crafted link triggers it and how to fix it.
CVE-2026-41089: The Unauthenticated Netlogon RCE That Owns Your Domain Controller
CVE-2026-41089 is a CVSS 9.8 unauthenticated remote code execution flaw in Windows Netlogon: an integer overflow in MS-NRPC handshake parsing leads to a stack overflow on domain controllers, with no credentials or user interaction required.
Microsoft May 2026 Patch Tuesday: No Zero-Days, but Two CVSS 9.8 Wormable RCEs
Microsoft's May 2026 Patch Tuesday shipped without a single exploited zero-day for the first time since June 2024, but it still carried two unauthenticated CVSS 9.8 remote code execution bugs in core Windows services that every domain should treat as emergency patches.
Paragon Partition Manager BYOVD: CVE-2025-0289 Kernel-Level Exploitation
Five vulnerabilities in Paragon Partition Manager's kernel driver were exploited in BYOVD attacks, allowing attackers to gain SYSTEM privileges on Windows systems. Microsoft added the driver to its blocklist.
CVE-2025-24071 Windows Explorer NTLM Hash Leak
A .library-ms file extracted from a zip archive can leak NTLM hashes without the user opening anything. Breakdown of CVE-2025-24071 and the defensive response.
Safeguard Desktop App 1.0 Release
The Safeguard desktop application is 1.0 on macOS, Windows, and Linux. It brings the full workflow engine, Local Runner, and offline posture reviews to developers.
CVE-2024-4577 PHP CGI Argument Injection Explained
CVE-2024-4577 is a CVSS 9.8 argument injection in PHP-CGI on Windows that bypasses CVE-2012-1823's fix. Root cause, exploitation, and remediation.
CVE-2023-4807: The OpenSSL POLY1305 Flaw on Windows
A cryptographic MAC that silently trashes CPU registers: why CVE-2023-4807 only bites Windows builds of OpenSSL, what it can actually do, and which releases fix it.
Follina and the MSDT Lesson: What CVE-2022-30190 Taught About Trusted Handlers
Follina exploited a Microsoft Support Diagnostic Tool URI handler that nobody thought about. The technical mechanics, the rapid exploitation, and the lasting defense lessons.
Windows LDAP LSASS CVE-2024-49113 (LDAPNightmare)
CVE-2024-49113 crashes LSASS over LDAP referrals and pairs with CVE-2024-49112 for RCE. Exploit chain, detection, and domain controller hardening.
Docker Desktop WSL2 Security Changes in 2022
Docker Desktop's WSL2 backend reshaped container security on Windows. Here is what changed in 2022 and the defects that forced those changes.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.