MalwareTips News Windows update closes two zero-days used in active attacks

[News Now]

Microsoft’s September 2026 security update fixes 964 vulnerabilities, including two Windows zero-days already being exploited. Windows users and administrators should install the available updates and restart affected devices promptly.

Good to know

The two zero-days do not provide remote access on their own. An attacker must already have some access to the device before using them to gain higher privileges.

Why these flaws matter​

Both zero-days are local elevation-of-privilege flaws. They could let an attacker or malware with limited access gain SYSTEM privileges, the highest level of control in Windows.

That added control can help an intruder disable defenses, reach protected information, remain on the device or spread through a network. The initial foothold would still need to come from another route, such as phishing or stolen credentials.

• Microsoft lists 104 flaws as Critical and 860 as Important.
• The wider release covers Windows and products including Exchange Server, SharePoint, SQL Server and Office.
• High-severity remote-code-execution flaws were also fixed in Windows DNS Server and Remote Desktop Services.

What the attackers exploited​

One zero-day affects the Windows Update Stack. Microsoft says Windows can be made to access the wrong file by following a pointer without properly confirming where it leads.

The second affects Windows ALPC, an internal system that programs use to communicate on the same PC. Microsoft says code running inside a restricted AppContainer could exploit it to escape that sandbox and gain higher privileges without further user interaction.

Install and verify the update​

Open Settings from the Start menu, select Windows Update and choose Check for updates. Allow available updates to download and install, then restart when prompted.

• After restarting, return to Windows Update and check once more.
• Confirm that Windows reports “You’re up to date.”

 

[papabanana]

I regularly update mine, though it varies depending on the updates.

 

[Zero Knowledge]

The same day. But honestly if your a advanced nation state or advanced attacker you would assume have access to these models or ones with less guardrails.

Honestly it's gotten ridiculous, AI has just accelerated pwnage. You basically have to accept you will be pwned but someone some where.

Patching is a afterthought, it can't keep up. Maybe things will settle down in the future, doubt it though.

 

[Sorrento]

I can't see things getting much better, browsers, mail clients etc updates now are becoming more frequent, there is rarely a day goes by without update patching ? Or has it always been this way??

 

[Sampei.Nihira]

The next day.
Because updates are posted after 7:00 p.m. Italian time, and I usually don't use my computer in the evening until the next day.

 

[jerzy601]

the very next day, as soon as they come out.
or as soon as I turn on the computer.