Microsoft Issues Record 972 Patches; Researcher Bypasses Key Defender Fix Same Day

·79 views

Microsoft's September 2026 Patch Tuesday included 972 CVEs — the largest single patch release in the company's history — with 113 rated Critical and 258 addressing remote code execution flaws. Among the fixes was a second attempt to patch CVE-2026-69414, a Windows Defender vulnerability that had already been incompletely addressed in July and August. On the same day the patches went live, security researcher Nightmare Eclipse published a proof-of-concept called ShieldCrash, demonstrating that the updated Defender fix still fails under specific conditions, allowing arbitrary file reads with SYSTEM-level privileges. This marks the third consecutive disclosure targeting the same underlying flaw in Defender's file-handling logic, with Microsoft having now patched it twice unsuccessfully. The researcher, who has disclosed nine Defender and Windows zero-days since April 2026, continued publishing despite Microsoft previously threatening legal action over the disclosures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Bubble Sort Explained with Simple Python Examples

This DEV Community guide walks through bubble sort, an algorithm that repeatedly swaps neighbouring items that are out of order until the list is sorted. It demonstrates a hand dry run on a six-item list, then shows a basic Python implementation that copies its input before sorting. Comparison and swap counters are added to measure the work done, yielding 15 comparisons and 6 swaps for that example. The article then introduces a swapped flag so sorting can stop early once a pass makes no changes, and compares the approach with Python's built-in sorted() function. All code outputs were produced by running the article's examples on Python 3.12.3.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Near-duplicate detection routes peer reviews but fails as a sybil defense, test of 652 verdicts finds

On the Proof of Agent network, AI agents answer challenges and grade each other, and grading has become a bottleneck with thousands of answers pending. A forum proposal suggested routing answers flagged as near-duplicates into a slower review lane. Community members tested the idea against 652 unanimous verdicts from one settlement round using word-trigram Jaccard similarity. The flag did not reliably catch failing answers, and at common thresholds it slowed far more passing answers than failing ones. A templated answer with fixed phrasing and varied slot words also passed across 47 different authors, suggesting graders evaluate the underlying mechanism rather than the surface text. The author argues that similarity checks are useful for triage but cannot serve as a defense against operators running many accounts, since fresh accounts and varied system prompts sidestep both self- and cross-similarity signals.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CSS Grid Explained with Simple Examples

A CodingCush guide walks readers through CSS Grid, a layout system that positions items across rows and columns simultaneously. It explains how to turn a container into a grid with display: grid and how the browser arranges its children like cells in a spreadsheet. The article covers core terms such as lines and tracks, along with the grid-template-columns and grid-template-rows properties. It also introduces the fr unit for sharing free space proportionally, the repeat() shorthand, and the gap property for spacing. The piece promises a complete card gallery example and a comparison of when Grid is preferable to Flexbox.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

setup-node v7: how caching, version files and publishing behavior changed

The article explains that actions/setup-node installs a Node.js version, adds it to PATH, can restore package manager caches, and can write an .npmrc for publishing. Since v6 it caches npm automatically when package.json names npm as the package manager, and v7.1.0 no longer exports a placeholder NODE_AUTH_TOKEN when registry-url is set. It warns that many workflows copy a setup-node step with a cache line nobody has checked, so major version bumps can silently change caching or break publishing. Caching rules changed twice between v5 and v6, and it recommends reading the caching section before upgrading pinned workflows older than v6. The piece also describes the action's inputs and outputs at tag v7.1.0, including the new cache-primary-key and cache-matched-key outputs.

0 comments Read more at DEV Community