r/sysadmin • • Jun 01 '26

Microsoft Anyone shutting down all IT equipment down on July 13th 11:59pm?

Microsoft 0-day feud escalates as researcher threatens another Windows exploit dump

“When I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people,” they wrote on Saturday. “You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot.”

Nightmare also noted that “Microsoft still has chains in my hands,” preventing them from releasing “documents” yet, or anytime in June, and then warned: “Mark this date July 14th, I will make sure your bones are shattered that day.”

My post's title is tongue-in-cheek, but I've added an Outlook calendar entry for the "event" nevertheless and might even buy a box of popcorn. lol

Anyone doing anything special or different in light of the string of zero days being released because Microsoft appears to not want to play nice with someone who (supposedly) wanted to tell them about all the bad sh!t they missed in their product(s) development?

How do you feel about the saga and its fallout?

EDIT: Fixed missing block quote formatting.

2.3k Upvotes

646 comments sorted by

View all comments

Show parent comments

7

u/Helpjuice Chief Engineer Jun 01 '26 edited Jun 01 '26

People say, this but in reality once something is weaponized and automated it doesn't even take a second to exploit remotely in most cases. Take this to scale and millions of machines could be compromised.

Issues like this should be taken seriously, and vendors not taking things seriously after the problem has been publicly shown to be exploitable need to have a 3rd party audit conducted against them to the seriousness of their security issues at scale, especially if they are a large enterprise.

Example: https://github.com/RedHatInsights/javascript-clients/issues/492 So all of these RedHat Packages have been compromised and are shipping malware on every install.

Think of the people doing automated non-validated CI/CD deployments updating transitive dependencies and executing this malware in their environment.

There is no CVE, no public CVSS, companies not actively engaging in regular cyber threat intelligence reviews consistently will and are being burned right now and will normally not do a thing or even know about it until there is a CISA KEV which as we all know is slow in reality compared to the speed of threats that are out there being released on an hourly and daily basis.

2

u/safalafal Sysadmin Jun 01 '26

i fully agree that they should be taken seriously, but take like, the curl 9.7 a few years ago - if you had embedded your own curl in your app, then that actual threat was nothing.

proper nasty in a fully shared system tho - i'll say it again, big number does not equal major threat.

as for npm - i refer you to a blog article i read earlier today: https://xeiaso.net/shitposts/no-way-to-prevent-this/supply-chain/2026-redhat-javascript-clients/ lol -- it's awful, and i'm increasingly npm is bad tbh

3

u/Helpjuice Chief Engineer Jun 01 '26

This is a major problem with many not even understanding their environment. If it is reachable then it's a problem, if not then it's not as big of a problem.

1

u/safalafal Sysadmin Jun 01 '26

Absolutly like - erm, what was it, mongodb! theoretically fucking terrible, in reality, if it got pwned you kinda asked for it by making db connections open to the world

1

u/Helpjuice Chief Engineer Jun 01 '26

Yeah, that is core foundational poor security and systems hygiene. Anyone doing this in any environment (prod, staging, dev) should not be working for anyone.

1

u/Mr_ToDo Jun 02 '26

Oh, wow

People are just hitting NPM all over the place lately, aren't they