Webkit Vulnerability
The latest Webkit Vulnerability coverage — news, analysis, and updates from the WindowsNews.AI desk.
CISA Flags Critical API Flaws in iDirect iQ-Series Satellite Terminals Used Worldwide
CISA published an advisory on July 2, 2026, warning that two high-severity API vulnerabilities in ST Engineering iDirect iQ-Series satellite terminals could allow unauthenticated remote attackers to gain full control over the devices. The flaws, tracked with CVSS scores of 8.1 and 8.6, affect firmware version 4.5.2.1 and earlier and can be exploited to intercept traffic or pivot into critical networks. Users are urged to upgrade to version 4.5.2.2 and implement network-level mitigations immediately.
Smart Garden Nightmare: CVSS 10 Flaws in Gardyn Hub Let Attackers Seize Control, CISA Urges Patching
CISA has published an urgent advisory for Gardyn IoT Hub vulnerabilities with a maximum CVSS score of 10, allowing unauthenticated attackers to remotely control smart garden devices. The flaws could compromise home networks and sensitive data. Users are urged to apply patches immediately and isolate affected devices.
CISA Advisory: CubeSpace CW0057 Firmware Vulnerability Allows Malicious Code Injection
CISA issued an advisory on July 2, 2026, warning that CubeSpace CW0057 Reaction Wheel firmware before version 5.0.20 lacks secure boot, allowing attackers to inject malicious firmware. The critical vulnerability (CVE-2026-38214, CVSS 9.8) affects satellites worldwide and could let an attacker take persistent control of a spacecraft's attitude system. CubeSpace has released an update that adds cryptographic signature verification and urges all operators to apply the fix immediately.
Azure CLI Brute-Force Bypasses MFA, Exposes 78 Cloud Accounts
A massive brute-force attack leveraging Azure CLI and the OAuth ROPC flow bypassed MFA to compromise 78 Microsoft cloud accounts across 64 organizations. The incident reveals that enabling MFA is not enough—organizations must also disable legacy authentication protocols and enforce strong Conditional Access policies to block such attacks.
Beyond the Password: How Windows Hello for Business PINs Use TPM to Lock Down Your Identity
Windows Hello for Business PINs are far more secure than traditional passwords because they are device-bound, TPM-protected, and never transmitted over the network. This article explains how the PIN merely unlocks a cryptographic key pair that provides phishing-resistant authentication, stops lateral movement, and resists brute force. Enterprises adopting Windows 11 can leverage this built-in security to move toward a passwordless future.
Windows 11's New Point-in-Time Restore: Don't Turn It On Until You Pass These 4 Tests
Windows 11 now includes a point-in-time restore feature that lets users roll back their system to a previous state from WinRE. However, before enabling it, devices must pass four critical checks—OS volume size (200 GB+), free space, VSS health, and BitLocker recovery key availability—to prevent data loss. IT admins should pilot the feature on a subset of devices and monitor for issues before broader deployment.
Microsoft Imposes Stricter Bot Controls in Teams Amid Rising Identity Attacks
Microsoft enforces strict admin approval for Teams bots to counter surging identity attacks, while a researcher exposes a flaw in Apple's Hide My Email that reveals real addresses. The roundup also covers new token-theft techniques and defenses, with practical guidance for Windows users.
Apple Drops No-Feature iOS 26.5.2 Update With 25+ Security Fixes — Here’s Why It Matters to Windows IT
Apple released iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 on June 29, 2026, with over 25 security fixes and no new features, signaling urgent vulnerabilities like WebKit flaws. This article examines why Windows IT admins must pay attention to cross-platform risks in mixed environments, comparing Apple’s update secrecy to Microsoft’s Patch Tuesday and offering deployment guidance for enterprises.
1998 Called: Windows Movie Maker 6.0 Installer Resurfaces on Windows 11, and It Actually Works
A preserved Windows Movie Maker 6.0 installer emerged on the Internet Archive in June 2026, proving fully functional on Windows 11. The reemergence sparked a wave of nostalgia and a fierce debate over security risks versus radical simplicity, contrasting sharply with Microsoft’s subscription-based, cloud-reliant Clipchamp. While thousands have downloaded the legacy app, experts warn of unpatched vulnerabilities lurking beneath the beloved interface.
Windows 11’s 2026 Security Overhaul: Mandatory Secure Boot Certificate Renewal and a New Consent Model
Microsoft is rolling out a mandatory Secure Boot certificate rollover for all Windows 11 devices in 2026, replacing the decade-old root certificates to close security gaps and prepare for future threats. Simultaneously, the company is introducing a user consent model for BitLocker encryption and streamlined recovery options, addressing years of user frustration with opaque security defaults. The changes will require firmware updates from OEMs and explicit user actions, marking a foundational shift in Windows security beyond simple software toggles.
BlackBerry AtHoc Cloud 7.22 Deepens Microsoft Integration with Direct Entra ID Sync and Enhanced Teams Crisis Tools
BlackBerry AtHoc Cloud 7.22, released June 30, 2026, introduces direct Microsoft Entra ID synchronization and expanded Microsoft Teams crisis collaboration tools. These enhancements streamline user provisioning and turn Teams into a real-time incident command center, making critical event management more native for Windows-centric organizations.
Microsoft Aims to Be Quantum-Safe by 2029, Azure CTO Announces
Microsoft is accelerating its Quantum Safe Program with the goal of transitioning all its products and services to post-quantum cryptography by 2029. Azure CTO Mark Russinovich revealed the deadline on June 30, 2026, underscoring the urgent need to protect against future quantum threats. The move aligns with NIST standards and positions Microsoft ahead of the curve in cryptographic resilience.
Huntress Uncovers 81M-Login Azure CLI Spray Attack: 78 Microsoft 365 Accounts Breached
A massive password-spraying campaign targeted Azure CLI sign-ins, compromising 78 Microsoft 365 accounts after 81 million login attempts. The attack exploited gaps in Conditional Access policies that often neglect non-browser authentication, highlighting the urgent need to enforce MFA across all client apps and monitor CLI activity.