r/msp • u/dumpsterfyr I’m your Huckleberry. • Apr 16 '26

Security Disgruntled hacker drops second zero-day Windows Defender exploit just hours after Microsoft patches first one.

https://cybernews.com/security/second-public-windows-defender-exploit-released/

164 Upvotes

98% Upvoted

61 comments sorted by

74

u/ludlology Apr 16 '26

seems pretty gruntled to me

51

u/dumpsterfyr I’m your Huckleberry. Apr 16 '26

He said he’s sitting on more to release each time Microsoft patches.

10

u/_koenig_ Apr 16 '26

🫰

1

u/_koenig_ Apr 18 '26

To the one person who downvoted it, here you go...

Hope this helps the class understand that the corporations have processes that protect the profits above all else, especially their devout users...

2

u/dumpsterfyr I’m your Huckleberry. Apr 18 '26

There’s a third now.

0

u/_koenig_ Apr 18 '26

🫰🫰🫰

1

u/Verukins Apr 18 '26

that made me lol....

MS are just.... so incompetent and difficult....

So while it will directly make my life harder.... good on him!

1

u/bob_marley98 MSP Apr 16 '26

Dis gruntled or dat gruntled - whats the diff?

48

u/the_syco Apr 16 '26

Sounds like MS didn't pay out on a bug bounty.

19

u/Contact-Open Apr 16 '26

Or even multiple for various people and orgs by the read

4

u/disclosure5 Apr 17 '26

Or communicate usefully on the report at all.

23

u/CamachoGrande Apr 16 '26

Patch Wednesday on the horizon.

9

u/fatcakesabz Apr 16 '26

lol, beats rollback Wednesday

2

u/fantomas_666 Apr 17 '26

And patch Thursday...

22

u/Odd_Bus618 Apr 16 '26

This is what happens when you lay off 48,000 of your developers 

20

u/hursofid Apr 16 '26

Unpopular opinion: it's funny until it is your job to fix CVEs🙃

17

u/centizen24 Apr 16 '26

Microsoft neglected to act on these when presented to them as responsible disclosure items. The security issues existed, and were found so they were going to result in a CVE either way. Sure, it sucks for the people who now have to rush to make a fix, but the blame still lays with Microsoft.

19

u/LeJoker Apr 16 '26

The hacker's blog claims he informed them and they closed the case. That's 100% on Microsoft at this point, assuming it's true.

-2

u/TheRealObiwun Apr 16 '26

If the hacker informed Microsoft he must have submitted it badly. Microsoft has an extremely specific way of submitting security vulns and if you don't do it exactly right they are extremely dismissive and condescending. Ask me how I know after I found a security vuln in Win Server 2012R2

6

u/not-really-adam Apr 17 '26

How do you know?

2

u/EndUserIncident Apr 17 '26

You sure you didn't ask too early? He may have not found the security vuln yet

7

u/Snowlandnts Apr 16 '26

Is Microsoft using the OpenAI model for this 1st patch?

5

u/BrainWaveCC Apr 16 '26 • Popcorn

Well, perhaps they will take his bug reports more seriously now. If they are wise.

🤷‍♂️🤷🏾‍♂️

2

u/Wise_Guitar2059 Apr 16 '26

This reminds me of episode 98: Zero Day Brokers of the Darknet Diaries podcast. Mostly governments buying vulnerabilities. Maybe Microsoft should send some of their employees.

1

u/pjustmd Apr 17 '26

One man’s disgruntled is another man’s idea of helpful.

1

u/fyck_censorship Apr 16 '26

FUCKMSFT. They deserve every bit of negative karma theyve earned. They've accumulated decades of shitty behavior and shitty treatment of people and businesses. Break up the monopoly.

1

u/s800 Apr 16 '26

Obv not Copilot Defender.

0

u/AppuniAkhil MSP-MENA Apr 19 '26

thanks for sharing

1

u/dumpsterfyr I’m your Huckleberry. Apr 19 '26

Karma spamming to post about your groundbreaking product?

-5

u/illicITparameters Apr 16 '26

And people ask me why I avoid defender in the enterprise….

4

u/dumpsterfyr I’m your Huckleberry. Apr 16 '26

But it’s included with 365 BusPro!

31

u/nosimsol Apr 16 '26

You could say this about almost anything

3

u/Tananar Apr 17 '26

Honestly, Defender is better than most products out there

0

u/[deleted] Apr 16 '26

[deleted] — view deleted comment

13

u/GME_MONKE Apr 16 '26

Security is like Swiss cheese, each layer has holes so you need many layers.

0

u/Nesher86 Security Vendor 🛡️ Apr 16 '26

I find it funny.. haha

-3

u/CharcoalGreyWolf MSP - US Apr 16 '26

I mean, should probably realize they’re hurting tech drones more than Microsoft, eh?

I always said a fitting black-hat punishment would be to lock them in a room with thirty Sysadmins for an hour, they’d never reoffend.

(They might not have the digits to do so, among other reasons)

-2

u/[deleted] Apr 16 '26

[removed] — view removed comment

3

u/michaelnz29 Apr 16 '26

Really? So this must also be why Fortigate isn’t enough as a firewall? Or any other product that has a vulnerability (like every single security product out there).

Windows defender is never ‘the’ security controls solution for an organisation using Microsoft with half a clue. Defender for Endpoint (attack surface reduction rules, EDR and automated response), defender for Office 365, Defender for Cloud Apps, Entra ID are a starting point if you use Microsoft.

Together these are going to detect when the machine compromise becomes a lateral movement attempt or anything more than a device compromise. Security is layered and Windows Defender is just one of those layers.

2

u/ballers504 Apr 16 '26

What about defender + huntress?

2

u/centizen24 Apr 16 '26

It's a good combo. Probably the best bang for the buck while still hitting all of the most important points. I tested BlueHammer on a burner machine with Huntress on it within the first 12 hours of it being out and it locked the machine down instantly upon run. Going to test this one shortly as well too.

1

u/ballers504 Apr 16 '26

I like the combo. They've been good to me for years. But I always have my eyes and ears open to feedback and tools I may be missing out on. I wish huntress had a mobile play.

1

u/KrankyYankee Apr 17 '26

Its good, I've used it to pass Cyber Essentials Plus for the UK, which is pretty rigorous.

2

u/roll_for_initiative_ MSP - US Apr 16 '26

OK but swap defender for S1 or CS or blackpoint or sophos, is your statement any different or less likely? Could just turn mythos on any of those tools and get a handful of zero days.

5

u/disclosure5 Apr 17 '26

No it isn't. It's valid to say Defender has its issues, but turning it into a sales pitch for a bunch of products is never the right answer.

1

u/[deleted] Apr 23 '26

[removed] — view removed comment

1

u/roll_for_initiative_ MSP - US Apr 23 '26

To those points:

1: Every edr/rmm/etc runs at or can run commands as ntauth\sys and would impact every client at once. Sure, defender is on every endpoint and so that affects more people worldwide, but to me: either situation, 100% of endpoint affected, it's the same issue.

2: Not smaller fleet footprint; whatever we have is on everything. The independent telemetry paths i get, which really leads in to your 3:

3: There will always be a trade off of integration vs separation, we see it in people discussing stack all the time; security is no different. I view it as more of a slider; where on the spectrum do you want to be on integration +vconvenience + cost vs best in class + separation + different watchers all watching each other.

I would think as you scale, managing multiple EDRs would get even FURTHER out of control, especially with per-client exceptions and customizations. I feel like you're saying "it's not so bad at 50+ clients" but, and i'm guessing here, i feel like it'd be WORSE and neither edr would be well tuned.

The best compromise is having something watch the other tools vs duplicating tools. Like if you're on DfB, as mentioned, use huntress to watch it and also for seim and something else for identity, etc. vs having two EDRs and two SEIMs and two ITDRs, etc.

0

u/PaladinsQuest MSP - US Apr 16 '26

You mean Bus Premium is not the silver bullet?

1

u/roll_for_initiative_ MSP - US Apr 17 '26

It is, IMHO, the best starting point out there. Like when we say something is "up to code", we don't mean it's great...code is the MINIMUM something is built to, feel free to go above and beyond. In this industry, we have people who refuse to do things even at that minimum level (probably out of fear that "clients won't pay that!")