Windows zero-days exploited in 2026: what was attacked and what to do
Shell, Mark-of-the-Web and NTLM flaws were exploited before or soon after patches this year. A short overview and the protections that help against the whole class.
Read article
CySec blog
Windows — articles and guides
All CySec articles about Windows: current vulnerabilities, step-by-step guides and practical protection advice for businesses in Armenia.
How to encrypt company laptops with BitLocker
A lost laptop should be an expense, not a data leak. Turn on BitLocker and store the recovery keys properly.
Read articleWindows Server hardening with PowerShell: five quick wins
Disable SMBv1, stop the Print Spooler where it is not needed, enforce the firewall and secure Remote Desktop — with ready commands.
Read articleWindows Server Update Services (CVE-2025-59287): when the update server itself was attacked
A deserialization flaw in WSUS allowed unauthenticated code execution. The first fix was incomplete; an emergency update followed after attacks began.
Read articleWindows TCP/IP IPv6 (CVE-2024-38063): zero-click remote code execution
Specially crafted IPv6 packets could run code on any Windows machine with IPv6 enabled — no login, no user action. Patch first; disabling IPv6 was only a fallback.
Read articleFollina (CVE-2022-30190): a Word document that ran code without macros
Attackers abused the Microsoft Support Diagnostic Tool through Office documents. No macros, sometimes not even opening the file was needed.
Read articleHiveNightmare / SeriousSAM (CVE-2021-36934): any user could read the password database
Wrong permissions on Windows registry files let normal users read password hashes through shadow copies. Installing the update alone was not enough.
Read articlePrintNightmare (CVE-2021-34527): when the print service endangered domain controllers
A flaw in the Windows Print Spooler allowed code execution with SYSTEM rights, including on domain controllers. Why the print service should be off where it is not needed.
Read articleZerologon (CVE-2020-1472): taking over a Windows domain in seconds
A cryptographic flaw in the Netlogon protocol let an attacker on the network become domain administrator. Why domain controllers must be patched first.
Read articleSMBGhost (CVE-2020-0796): a wormable flaw in SMBv3 compression
Three years after EternalBlue, a new SMB vulnerability with a maximum score affected Windows 10. Patch, and keep port 445 closed to the internet.
Read articleCurveBall (CVE-2020-0601): fake certificates that Windows trusted
A flaw in Windows certificate validation, reported by the NSA, let attackers forge code signatures and HTTPS certificates.
Read articleBlueKeep (CVE-2019-0708): the wormable Remote Desktop flaw
A pre-authentication bug in Remote Desktop Services was so serious that Microsoft even patched Windows XP. Why RDP must never face the internet.
Read articleEternalBlue (MS17-010, CVE-2017-0144): the SMBv1 flaw behind WannaCry and NotPetya
Microsoft patched it in March 2017. Two months later, WannaCry hit unpatched networks worldwide. The lessons still apply to every office network.
Read articleLet's make your IT secure and predictable
Tell us about your infrastructure and goals. We'll get back to you within one business day with next steps.