YouTube video by Seinfeld

«Vi aner ikke når dette er over».

Aujourd’hui de plus en plus d’enfants sourds se trouvent dans la nécessité d’apprendre la langue anglaise, comme leurs petits camarades entendants.Michel FRANÇOIS, parent de deux enfants sourds et pro...

Chinese hackers used a combined Chrome and Windows zero-day chain to execute remote code.

La Commission nationale de lutte contre la prolifération et la circulation illicite des armes légères et de petit calibre (ComNat-ALPC) a réuni, ce vendredi 29 novembre 2025, ses points focaux, respon...

# 974 CVEs in One Month: Mapping the Windows Patch Surface With Internet-Wide Data Microsoft's September 2026 Patch Tuesday fixed 974 CVEs, including two exploited zero-days (CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC). Vulnerability management teams usually read such releases as internal work queues. Internet asset mapping adds a second, external view: which Windows-exposed services sit on public IPs, which of them leak version information, and how the patch backlog translates into a measurable external footprint. ## From patch counts to external footprint A Windows server missing September's fixes does not advertise the fact, but the services it runs often do. RDP, SMB, IIS, Exchange OWA, and remote access components all expose version and configuration signals that mapping platforms index. The useful question for a team facing 974 fixes is not "how many CVEs affect us" but "which of our systems present an external face that maps onto the exploited or wormable subset." September's release included 438 elevation-of-privilege issues, 257 remote code execution issues, and 20 wormable-class vulnerabilities. The EoP bugs mostly matter after a foothold exists. The RCE and wormable subset maps directly onto external exposure: an internet-reachable system running affected remote access components is a different risk object from an internal workstation with the same patch level. ## Three mapping queries that operationalize the queue 1. Enumerate external RDP and remote access surfaces per organization or per ASN, so the exploited zero-day triage (both September zero-days are local, post-compromise bugs) gets paired with exposure triage of the remote-facing services where an RCE foothold starts. 2. Index Exchange OWA and other webmail surfaces separately. The September bulletin included a Critical Exchange RCE triggered via a Visio file over email, and OWA instances visible from the internet are the population where that path opens first. 3. Verify post-patch disappearance: after deployment, external banners and service versions shift, and mapping data can confirm the external footprint shrank, complementing internal patch compliance reports. Mapping platforms such as ZoomEye support these query patterns through product, service, and version fingerprints (https://www.zoomeye.org/). ## What mapping cannot do External fingerprinting does not see patch levels behind firewalls, and version banners lag the underlying build in cloud and containerized deployments. The two zero-days are local privilege escalations, which mapping cannot detect at all; they require internal inventory. The honest division of labor: internal tools own patch state, mapping owns the external face, and the queue priority comes from joining the two. ## Limitations This article synthesizes published September 2026 advisories and media reporting. No live mapping queries were executed for publication in this piece; the query channel was unavailable at writing time. Counts and CVE designations come from the cited sources. ## References * Microsoft MSRC September 2026 release notes (msrc.microsoft.com/update-guide/releaseNote/2026-Sep) * FreeBuf coverage of the record Patch Tuesday, September 9, 2026 * Huawei Cloud advisory summary, September 9, 2026

😍✨Beau reportage sur le stage de l'ALPC ! Merci à Savoie News de nous avoir donné la parole pour dire l'essentiel sur l'association et sur la LfPC !😀👍 https://lnkd.in/eJxPdbdR

https://www.osintinvestigate.com A Chinese-linked threat actor known as UTA0565 has been observed exploiting a Chrome-Windows zero-day chain to deliver CLEANGULP malware. The attacks, detected on September 3 and 4, 2026, combined two Google Chrome vulnerabilities and a Windows ALPC flaw to escape the browser sandbox and achieve remote code execution. The campaign used phishing emails, fake websites, hidden iframes, and impersonated media organizations and NGOs to deceive targeted victims. In this episode, we examine how the BlueMoon exploit chain was used, how CLEANGULP operates, and why the reuse of the same exploit kit across multiple threat actors is attracting attention from cybersecurity researchers.