Transcript
Patch Tuesday recap. Did you also know that today is National Donald Duck Day? It seems fitting that the Disney character that most sysadmins can relate to, perpetually frustrated, often unlucky, overworked, prone to fits of rage, occasionally missing pants, is celebrated on a Patch Tuesday? Grab your pants and let's dive into the details. All right, so total exploits patched today, 198, 198. You remember how two months ago we talked about, you know, Project Glasswing and Clawed Mythos and how that might change how many patches and CVEs are released and stuff? Well, I mean, two months ago we had 163. Last month we had, I want to say it was like 118, somewhere around there. This month we've got 198. Before the whole Glasswing Mythos thing happened, it wasn't too uncommon for us to only have like 50, 60. I think now we're going to be considering those the good old days and maybe this is the new normal. Anyways, let's keep going with it. We got 32 of those are critical and then the rest are all important. So 166 important, that leaves zero moderate or low. And now this is kind of wild. We got 54 remote code executions and only 63 elevation of privilege. I mean, that's still a lot, but the ratio there of RCE to elevation of privilege, that's wild. I don't think I've ever seen it that close together. We've got a bunch of information disclosure, spoofing, tampering, denial of service and feature bypass CVEs in there as well, which I mean, what do you expect when you have 198? We do have three publicly disclosed, which considering the sheer amount of CVEs that we've got, that's not too bad. And none of those are being actively exploited. Okay. So those are just publicly disclosed. Let's dive into some of the highlights. This month's headliners are five CVEs, all rated at a 9.8 CBSS score, all rated remote code execution vulnerabilities, and all just waiting to ruin your day. I'm calling this group the party of five. I haven't seen the show, but the name fits. The target span HTTP.SYS, Windows kernel, the DHCP client service, Azure Stack Edge and Nuance PowerScribe. None are publicly known or actively exploited yet, but with network accessible attack vectors, low complexity and no user interaction required across the board, these are ones that I would prioritize first. All right, moving on. We got remote desktop client gets 11 RCE CVEs this month, which is a lot of attention for one component. This grouping I'm calling the Redmond football club. Now, three of these CVEs are rated at an 8.8 and the rest are all 7.5. The exploit pattern is consistent across the group. Connect a vulnerable RDP client to a malicious server and an attacker gets remote code execution on your device. None are exploited yet, but 11 CVEs in one component in one month is definitely worth keeping your eye on. For our last highlight, we have three CVEs impacting BitLocker this month, one of which is one of the three publicly disclosed CVEs this month. What's interesting is that all three CVEs were given a different rating, but CVE-2026-50507 isn't the highest rated of the three, even though that's the one that's publicly disclosed. Seems odd, but again, I don't give the scores. I just report them. Now, while these aren't the scariest CVEs this month, obviously BitLocker is there to keep your data safe if your device falls into the wrong hands. So if your users have a history of misplacing their laptops, these patches all of a sudden become a big deal. That wraps up our Patch Tuesday coverage this month. Happy Donald Duck Day to all my fellow sysadmins out there. We're overworked, underappreciated, and one faulty patch away from a meltdown, but keep the lights on anyway. Maybe system administration isn't all it's quacked up to be, but could you imagine the absolute chaos that would ensue if we let normal users touch our precious systems? If you find yourself needing a well-deserved break this Patch Tuesday, check out PDQ Connect. It can automate your Windows and third-party patching needs in just minutes. Just imagine not having to worry about new Chrome updates every other day that ends in Y. That's the dream. For PDQ, I'm Brock. Thanks for watching. We'll catch you next time.
