fidzu : nerd

An anonymous reader quotes a report from Ars Technica: Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day. On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a "general-purpose logging service used by software clients running in user-mode or kernel-mode." By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System. [...] Researcher Will Dormann said in an interview that he has been able to reproduce the exploit and that it works as described, but not on all versions of Windows 11. But there's a catch, he said. "The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems," he explained. "That is, you can't just take a new 26H2 system and install updates and have it work." For a system to be vulnerable, Dormann said, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode value must be 0 or 1." Of the many machines Dormann uses, only a single one met this requirement. Microsoft said in a statement that it was investigating the vulnerability and had no evidence it was being exploited in the wild. The company also said Defender blocks potential exploitation attempts.

Read more of this story at Slashdot.

14 Nov 2026 3:30am GMT

Comments

14 Nov 2026 2:52am GMT

Comments

14 Nov 2026 2:28am GMT

Comments

14 Nov 2026 2:21am GMT

Longtime Slashdot readers cold fjord and sinij share news that the FAA grounded flights nationwide after a communications failure disrupted air traffic control centers across the country. By Friday evening, the outage had resulted in nearly 5,000 flight cancellations and roughly 10,000 delays, with no timeline for restoring normal operations. Rumors are swirling that this could be related to the FAA's newly deployed SMART AI system or Microsoft's recent global outage, but both the agency and Microsoft said they had no indication that their technology was responsible. Business Insider reports: US Transportation Secretary Sean Duffy said just after 4:15 pm. Eastern time that the nationwide flight traffic halt came "following a communication issue impacting all Air Route Traffic Control Centers." "FAA technicians are investigating the issue," he said in a post on X. The outage comes the same week as the FAA deployed SMART, a new AI tool to help air traffic control. ASI, the company that makes the SMART system for the FAA, said that Friday's issues weren't "based on or a result of the SMART system, any product of ASI or our integration with FAA and ATC." Homeland Security Secretary Markwayne Mullin said in a press conference Friday, when asked if the AI system might be related to the outage: "That's what we're looking at." Microsoft, which faced massive issues across its services this week, also said that it had "no indication" the ground stop was related to any Microsoft services. Meanwhile, the FAA said that the ground stop was due to "extraordinary circumstances and for reasons of safety." UPDATE 1:33 UTC: Secretary Mullin and Secretary Duffy are currently briefing members of the press on the issue. UPDATE 1:46 UTC: The FAA has lifted the nationwide ground stop after more than four hours. Officials said the disruption appears to have stemmed from a network router issue that cascaded nationwide, with no evidence of a cyberattack or connection to Microsoft's recent outage. Airlines warned that disruptions could continue in Saturday.

Read more of this story at Slashdot.

14 Nov 2026 1:30am GMT

SpaceX's 15th Starship test flight successfully reached orbit Friday, but its historic attempt to catch both stages at the launch tower was derailed when the Super Heavy booster malfunctioned, forcing controllers to abort its return before it exploded after splashing down in the Gulf of Mexico. The upper-stage Starship did, however, successfully deploy 26 Starlink satellites and is scheduled to complete 15 orbits before attempting an unprecedented tower catch on Saturday. If successful, it would mark the first time a spacecraft has returned from orbit to land vertically at a launch tower. The Bakersfield Californian reports: The original goal was to retrieve every single piece of the rocket for the purpose of future recycling, something yet to be achieved anywhere in the world. Musk sees this leading to the kind of fast and consistent launch rates necessary for building moon bases and sending people to Mars. Shortly after reaching orbit, Starship dropped off 26 of the company's most advanced Starlink satellites. The plan is for Starship to complete 15 laps around the world at an altitude of around 170 miles (275 kilometers) before heading back to the launch site for Saturday's grand finale. SpaceX had already made three booster grabs at the company's sprawling Starbase near the U.S.-Mexico border. That made Friday's miss all the more surprising. "Well, that certainly isn't the news that we had hoped to hear for today," observed SpaceX launch commentator Kate Tice, adding that it was in line with the many rigorous safety checks to protect the pad. No explanation was provided for what went wrong. This was the first attempt to capture the upgraded version of the booster that stretches 236 feet (72 meters) -- the production model for moon and Mars expeditions. It will also be the first time the company attempts to catch the spacecraft, which spans 171 feet (52 meters). Together, they form the world's biggest and most powerful rocket -- an astounding 407 feet (124 meters) in height. The spacecraft portion of the 14 previous Starships ended up in the ocean, either by design at flight's end or by accident in a stream of flaming wreckage. During the first full-scale test flight in 2023, multiple engines failed to ignite and the tumbling rocket's self-destruct system was activated. The last test, in September, was the first to reach orbit, but SpaceX did not try to recover any of the rocket stages. You can watch a recorded livestream of the launch on YouTube.

Read more of this story at Slashdot.

14 Nov 2026 1:00am GMT

Wine 11.22 adds AVX support for x86 emulation on ARM64, introduces address space randomization, and fixes 34 bugs affecting games and apps.

13 Nov 2026 9:10pm GMT

KDE Frameworks 6.32 adds safer file operations on removable drives, improved Baloo search, and fixes across KDE components.

13 Nov 2026 4:45pm GMT

Manjaro developers establish a German nonprofit association following months of governance disputes and concerns over project leadership.

13 Nov 2026 1:20pm GMT