New Windows zero-day lets hackers gain system access — no patch available yet
This week, security researchers disclosed two distinct Windows vulnerabilities that attack your PC from different angles but share a troubling common thread: both can let a malicious actor gain system privileges on your device, and neither has been patched yet.
The first is a zero-day flaw dubbed ShieldBreak, discovered by bug hunter Nightmare Eclipse, who reportedly has a major dispute with Microsoft and no hesitation about sharing newly found vulnerabilities before a patch is released. ShieldBreak is said to bypass the previous RoguePlanet fix and allows attackers to obtain system privileges on fully patched Windows 10, Windows 11, and Windows Server systems. According to The Register, the exploit has been independently tested and confirmed by other security researchers.
Security expert Kevin Beaumont explained that ShieldBreak leverages a "user-mode callback hook" to alter file contents during a Defender cloud-hydration scan via the Cloud Filter API (cfapi). In practical terms, the flaw exploits Microsoft Defender, when enabled, during its scanning process, granting the attacker system-level access. This means that even systems with all recent updates installed remain exposed to the attack.
The second issue is a new attack called "Plug and Pwn," which emulates USB devices and exploits similar weaknesses. While the full technical details of this method have not been disclosed in the current report, it is confirmed that this attack vector can also provide system privileges, posing a serious risk to users who plug in untrusted USB hardware.
Neither vulnerability has received an official fix from Microsoft as of now. In the meantime, users are advised to exercise caution, avoid connecting unknown USB devices, and keep a close eye on security updates from Microsoft to reduce the risk until patches are rolled out. Security researchers also recommend reviewing Defender settings and monitoring system activity for any signs of unusual behavior, though the most reliable protection will only come with the official updates.
